Isolation‐based anomaly detection using nearest‐neighbor ensembles. (5th January 2018)

• Record Type: Journal Article
• Authors: Bandaragoda, Tharindu R.; Ting, Kai Ming; Albrecht, David; Liu, Fei Tony; Zhu, Ye; Wells, Jonathan R.
• Is Part Of: Computational intelligence. Volume 34:Number 4(2018)
• Page Start: 968
• Page End: 998
• Publication Date: 2018-01-05
• Subjects: anomaly detection -- ensemble learning -- isolation‐based -- nearest neighbor -- outlier detection; Artificial intelligence -- Periodicals; Computational linguistics -- Periodicals; 006.3
• DOI: 10.1111/coin.12156
• Languages: English
• ISSNs: 0824-7935

Abstract

Abstract: The first successful isolation‐based anomaly detector, ie, iForest, uses trees as a means to perform isolation. Although it has been shown to have advantages over existing anomaly detectors, we have identified 4 weaknesses, ie, its inability to detect local anomalies, anomalies with a high percentage of irrelevant attributes, anomalies that are masked by axis‐parallel clusters, and anomalies in multimodal data sets. To overcome these weaknesses, this paper shows that an alternative isolation mechanism is required and thus presents iNNE or isolation using Nearest Neighbor Ensemble. Although relying on nearest neighbors, iNNE runs significantly faster than the existing nearest neighbor–based methods such as the local outlier factor, especially in data sets having thousands of dimensions or millions of instances. This is because the proposed method has linear time complexity and constant space complexity.