An example using IsolationForest for anomaly detection.
The IsolationForest ?isolates? observations by randomly selecting a feature and then randomly selecting a split value between the maximum and minimum values of the selected feature.
Since recursive partitioning can be represented by a tree structure, the number of splittings required to isolate a sample is equivalent to the path length from the root node to the terminating node.
This path length, averaged over a forest of such random trees, is a measure of normality and our decision function.
Random partitioning produces noticeable shorter paths for anomalies. Hence, when a forest of random trees collectively produce shorter path lengths for particular samples, they are highly likely to be anomalies.
| [1] | Liu, Fei Tony, Ting, Kai Ming and Zhou, Zhi-Hua. ?Isolation forest.? Data Mining, 2008. ICDM?08. Eighth IEEE International Conference on. |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | print(__doc__)import numpy as npimport matplotlib.pyplot as pltfrom sklearn.ensemble import IsolationForestrng = np.random.RandomState(42)# Generate train dataX = 0.3 * rng.randn(100, 2)X_train = np.r_[X + 2, X - 2]# Generate some regular novel observationsX = 0.3 * rng.randn(20, 2)X_test = np.r_[X + 2, X - 2]# Generate some abnormal novel observationsX_outliers = rng.uniform(low=-4, high=4, size=(20, 2))# fit the modelclf = IsolationForest(max_samples=100, random_state=rng)clf.fit(X_train)y_pred_train = clf.predict(X_train)y_pred_test = clf.predict(X_test)y_pred_outliers = clf.predict(X_outliers)# plot the line, the samples, and the nearest vectors to the planexx, yy = np.meshgrid(np.linspace(-5, 5, 50), np.linspace(-5, 5, 50))Z = clf.decision_function(np.c_[xx.ravel(), yy.ravel()])Z = Z.reshape(xx.shape)plt.title("IsolationForest")plt.contourf(xx, yy, Z, cmap=plt.cm.Blues_r)b1 = plt.scatter(X_train[:, 0], X_train[:, 1], c='white')b2 = plt.scatter(X_test[:, 0], X_test[:, 1], c='green')c = plt.scatter(X_outliers[:, 0], X_outliers[:, 1], c='red')plt.axis('tight')plt.xlim((-5, 5))plt.ylim((-5, 5))plt.legend([b1, b2, c], ["training observations", "new regular observations", "new abnormal observations"], loc="upper left")plt.show() |
Total running time of the script: (0 minutes 0.539 seconds)
plot_isolation_forest.py
plot_isolation_forest.ipynb
Please login to continue.