Anomaly Detection in Computer Networks Using Isolation Forest in Data Mining

Anomaly detection in database transactions is critical for safeguarding sensitive information and ensuring the integrity of operations in industries like finance, healthcare, and e-commerce. Existing techniques, including rule-based, machine learning, and deep learning methods, face challenges such as high false positive rates, poor adaptability to evolving patterns, and limited scalability in imbalanced datasets. This research proposes a novel Reinforcement Learning (RL)-based anomaly detection system to address these limitations. The model employs a dynamic reward mechanism and anomaly scoring system to classify transactions accurately while reducing false positives. It leverages the Kaggle Anomaly Detection in Transactions Dataset and a synthetically generated dataset for training and evaluation. Experimental results show that the RL-based model outperforms traditional methods, achieving a precision of 95.2%, recall of 92.4%, and an AUC-ROC score of 97.2%, significantly higher than Autoencoders, Isolation Forest, and Support Vector Machines. The proposed model’s adaptability and robustness make it a scalable solution for real-time anomaly detection, addressing critical gaps in existing techniques. This study advances database security by offering a highly accurate, adaptive, and efficient system for detecting anomalies in complex transactional environments.

Network intrusion detection system are significant features that contribute to the enterprises and organization network success. In the past decade, Intrusion Detection system (IDS) using several methods have been proposed and implemented to safeguard the networks within an organization to be reliable, secure, and readily available. Although, some of these methods are built utilizing machine learning concepts. IDS utilizing machine learning techniques are accurate, effective and efficient in spotting attacks. However, the machine learning model performance reduces with high dimensional intrusion dataset. Therefore, it is sacrosanct to implement an efficient feature selection technique that can generate a great impact on the classification stage. Also, the feature selection phase is the most serious phase in IDS based on machine learning. This phase is expensive both in time and efforts. Furthermore, most of the proposed machine learning intrusion detection system suffered from low detection accuracy and high false positive rate when the models are experimented on high dimensional dataset. The aim of this paper is to propose a binary firefly algorithm (BFFA) based feature selection for IDS. We first performed normalization in the first stage of the model. Subsequently, the BFFA algorithm was used for feature selection stage. We adopted random forest algorithm for the classification phase. The experiment was performed on high dimensional University of New South Wales-NB 2015 (UNSW-NB15) dataset with seventy five percent of the data used for training the model and twenty percent for testing. The findings showed an accuracy of 99.72%, detection rate of 99.84%, precision of 99.27%, recall of 99.84% and F-score of 99.56%. The results were gauge with the state-of-the-art results and our results were found outstanding.

Anomaly detection is essential in applications such as financial fraud detection, network security, and system health monitoring. This study presents a hybrid anomaly detection model for financial transactions, combining the strengths of both unsupervised and supervised learning techniques—Isolation Forest and Random Forest, respectively. the Isolation Forest algorithm, performs unsupervised detection of outliers, effectively identifying rare or irregular data points without requiring labeled input. The detected anomalies are then used to construct a pseudo-labeled dataset, which is subsequently used to train a Random Forest classifier. The Random Forest model learns discriminative patterns between normal and anomalous data, enhancing overall detection capabilities. The system is implemented in Python using Scikit-learn for model development and evaluation. Experiments on benchmark financial transaction "Credit Card Fraud Detection Dataset from Kaggle" The hybrid model achieved a precision of 99.7%, recall of near 100%, and an F1-score of 99.98%, outperforming standalone algorithm The model also improved robustness to noise and better scalability for large datasets. Keywords: Anomaly Detection, Financial Fraud, Hybrid Machine Learning, Supervised Learning, Security, Unsupervised Learning. CISDI Journal Reference Format Azubuike Nnendah Daisy; Anireh, Vincent Ike-Emeka & Sako, D.J.S. (2025): A Model for Anomaly Detection in Financial Transactions using Hybrid Machine Learning Technique. Computing, Information Systems, Development Informatics and Allied Research Journal. Vol 16 No 3, Pp 37-50 Available online at www.isteams.net/cisdijournal. dx.doi.org/10.22624/AIMS/CISDI/V16N3P3

Fuzzy anomaly scores for Isolation Forest

BACKGROUND Patient heterogeneity is a key challenge in immunotherapy for IDH-wildtype glioblastoma (GBM), where hypermutated tumors or highly immunosuppressive tumor microenvironments (TME) act as clinical outliers affecting treatment response and trial stratification. We developed Alert-GBM, a radiogenomic AI model designed to flag such outliers based on radiomic signatures from diagnostic imaging. MATERIAL AND METHODS We used multicenter open-access radiogenomic datasets (n = 176) to train unsupervised outlier detection models. Principal Component Analysis (PCA) served as a first-pass filter to harmonize data before applying Isolation Forest (IF) modeling. Three IF models were trained using inter-dataset leave-one-out cross-validation (LOOCV) to simulate real-world performance and were benchmarked against each other. The final model was selected using stratified 10-fold cross-validation (CV). Outliers were validated through visual inspection, statistical profiling, comparison with other outlier detection methods (Local Outlier Factor, One-Class SVM, Mahalanobis distance), and correlation with biological and immune profiles from imaging and omics data. RESULTS The PCA filter identified 3 initial outliers based on MRI metadata. The final IF model, following stratified 10-fold CV, detected 6 outliers across the datasets, with anomaly scores plotted. Flagged cases included large, highly enhancing tumors, minimally enhancing tumors, and post-operative scans. Visualizations using PCA, t-SNE, and UMAP were generated to illustrate separability. False positives and negatives were assessed using immune-based scores, and the distribution of anomaly scores was analyzed with KDE plots. Cross-validation against alternative outlier models confirmed consistency of the flagged cases. CONCLUSION Alert-GBM is a proof-of-concept AI architecture for outlier detection in GBM MRI radiogenomics, capable of flagging cases with atypical immune TME profiles. Integrating such models with radiogenomic immune predictors at the time of diagnosis may support multidisciplinary decision-making and improve patient stratification for immunotherapy trials. Incorporating a human-in-the-loop framework ensures that AI outputs remain clinically interpretable and actionable.

The theoretical and practical aspects of an anomaly detection system in DNS queries, which serves as a crucial tool for ensuring the security of internet infrastructure, are examined. Anomalous DNS queries pose a serious threat to network security and stability as they can be an indicator of cyber attacks or malicious activity. One of the most common threats is the use of DNS to carry out DDoS attacks, in particular through the DNS amplification mechanism. An analysis of existing anomaly detection methods, including statistical, signature-based approaches, and machine learning methods, is conducted. The key stages of the proposed system's development are described, including data collection, preprocessing, and analysis, as well as the creation of a normal activity profile for identifying deviations. Innovative methods based on deep learning and time series analysis open new horizons in automated detection of anomalies in DNS traffic. Deep neural networks, such as recurrent neural networks (RNNs) and convolutional neural networks (CNNs), are used to detect complex patterns in large data sets, including the textual and temporal aspects of DNS queries. The primary goal of the study is to demonstrate the effectiveness of a combined approach to DNS traffic analysis, utilizing modern machine learning algorithms such as Isolation Forest, One-Class SVM, and K-means. The proposed system achieves a high level of accuracy (92%) and completeness (90%) in anomaly detection, as confirmed by testing results on the CAIDA Passive DNS Dataset. A description of the modular architecture of the system is presented, which allows for scalability in large networks with high traffic levels. The proposed approach is flexible and adaptive, enabling integration with existing network security and incident response tools.

Lithology identification holds a pivotal role in the characterization of subsurface formations. In recent years, the advent of big data and the need for more precise lithology identification have spurred the growing adoption of machine learning algorithms. This paper's primary objective is to leverage unsupervised machine learning techniques for the identification and subsequent removal of anomalies inherent in complex datasets. The Isolation Forest model is the cornerstone of our approach for anomaly detection and elimination. To initiate this process, we employed the K-means algorithm to create clusters, followed by a evaluation using silhouette coefficients. Subsequently, we selected input data for each cluster and conducted exploratory data analysis both prior to and after the removal of outliers. The histograms portraying average anomaly scores for each cluster were thoughtfully presented. For real-time anomaly detection, we harnessed the power of the Isolation Forest model, which facilitated the creation of an Isolation Forest anomalies map by plotting neutron-porosity against bulk density. Our rigorous data analysis employed various statistical techniques, including data statistics, histograms, and cross plots between neutron-porosity and bulk density. This multifaceted approach successfully eradicated anomalies from the dataset, a fact vividly illustrated by the histograms, where anomalies were discernible through their negative scores. The Isolation Forest map conclusively demonstrated the effective removal of outliers from the dataset, underscoring the model's proficiency in identifying and mitigating these anomalies based on their negative scores. The Isolation Forest model has thus exhibited remarkable efficacy in the identification and elimination of data anomalies. Its versatility makes it a valuable asset for the detection and removal of outliers, deviations, or noise from datasets, rendering it particularly well-suited for anomaly detection and outlier mitigation in various analytical scenarios. Notably, the combination of the K-means and Isolation Forest algorithms emerges as a potent and advantageous approach, especially when dealing with extensive datasets and conducting comprehensive analyses.

The need for detection, identification and prediction of anomalies emerged just a short time ago. This task brings multiple challenges that are mainly associated with recording and detection of novel attacks and influences. It draws attention of experts in network security and diagnostics of information and industrial systems. Detection of anomalies in dynamic dataflows largely determines the efficiency of management of computer network information security within information and industrial systems. At the same time, the technology of dynamic dataflow prediction is also very important for building systems intended to detect anomalies in data protection within industrial control systems. Any automated systems are based on available computer capabilities and advances in management theory, mathematical modeling and optimizations methods. Processes that occur in industrial automated systems and that are reflected in dataflows being observed constitute complex multi-component processes, thus making it more complicated to predict such processes. In this case, complex multi-component time series data should be predicted at different (short-term, medium-term and long-term) time scales. A neural network architecture matching the structure of the multi-component time series being predicted should be built for generating a multi-component prediction. It is proposed to decompose the complex multi-component time series into several basic components using the digital signal processing technology, i. e. to perform a preliminary structural analysis of multi-component time series within the observed range of all time series that reflect operation of the industrial control system. Separate predictions with different time horizon are formed for each basic component of the multi-component time series using the available neural network architecture and machine learning taking into account dynamic characteristics of the above components. Anomalies in the observed range of multiple time series that reflect operation of the industrial control system are detected (identified) through component-wise comparison of each component (resulted from the above preliminary digital processing) of any time series within the observed range of all time series, with each prediction of the relevant component of the above time series within the observed range of all time series. This approach that implies component-wise comparison will allow to detect anomalies within the range of observed time series of the industrial control system separately by their different dynamic characteristics, and thus will improve the efficiency of management of information security within information and industrial systems.

Bayesian active learning isolation forest (B-ALIF): A weakly supervised strategy for anomaly detection

The digital age has ushered in unprecedented connectivity and technological advancement, which have also introduced a surge in sophisticated and frequent cyber threats. To safeguard systems, anomaly detection has become a cornerstone of cybersecurity, enabling the identification of deviations from normal system behaviour. This study presents a comparative analysis of three machine learning techniques—Isolation Forest, Long Short-Term Memory (LSTM), and Q-Learning—for cyberattack anomaly detection. The study designed and implemented a system using the CICIDS-2017 dataset (2,830,743 records) in Python, preceded by data preprocessing and feature engineering. Evaluation metrics, including Accuracy, F1-Score, and error rates (FPR, FNR) revealed a clear performance hierarchy. The LSTM model proved superior, achieving a near-perfect Accuracy of 99.53% with minimal errors (FPR: 0.35%, FNR: 0.50%). Q-Learning showed strong, adaptive potential, recording an Accuracy of 92.80% and an F1-Score of 90.25%, though with higher error rates (FPR: 8.58%). Conversely, the unsupervised Isolation Forest was inadequate for this labeled task, with metrics around 50%. The findings establish LSTM as ideal for maximum accuracy, Q-Learning as a viable option for dynamic environments, and highlight the limitations of simple unsupervised methods on complex security datasets.

Anomaly detection is a cornerstone of modern intelligent systems, with critical applications in healthcare, cybersecurity, smart grids, and IoT environments. While traditional machine learning and deep learning models have shown promise in identifying outliers, they often face challenges such as dependence on large labeled datasets, high computational costs, and limited scalability to edge devices or high-dimensional data streams. This study introduces D2H-AD, a novel anomaly detection framework built upon Hyperdimensional Computing (HDC), a brain-inspired paradigm that encodes information using high-dimensional distributed vectors. Unlike prior HDC-based approaches, D2H-AD fuses distance-based similarity and density-aware encoding in a hybrid design, significantly improving anomaly characterization and detection accuracy. Ablation experiments confirm that hyperdimensional encoding alone contributes up to 5.4% higher ROC-AUC compared to applying the same density-distance scoring in the original Euclidean feature space, and D2H-AD consistently outperforms all five published baselines (HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders) across every evaluated dataset. The method is designed to be lightweight, interpretable, and computationally efficient, suggesting strong suitability for deployment in resource-constrained and real-time environments. To validate its effectiveness, we evaluate D2H-AD on five diverse benchmark datasets, comparing its performance against five leading techniques: HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders. Our results show that D2H-AD consistently achieves superior F1 scores and ROC-AUC metrics, demonstrating robustness against class imbalance, noise, and data complexity. Beyond accuracy, D2H-AD offers practical advantages including scalability, minimal memory footprint, and an expected low-latency profile derived from its binary operations and lightweight design. These characteristics are crucial for TinyML and edge AI applications. This work highlights the untapped potential of HDC for high-performance anomaly detection and opens new avenues for secure, interpretable, and energy-efficient AI solutions in dynamic environments such as IoT, embedded systems, and beyond. Additionally, D2H-AD provides feature-level interpretability through hypervector decoding, enabling transparent explanations for safety-critical applications.

Anomaly detection is a major issue for several applications such as industrial failure detection, cybersecurity or transport. Several approaches, such as statistical methods, machine learning and sketch, have been explored by different research communities to detect anomalies in an increasingly challenging context. Indeed, facing the huge volume of data generated at an increasingly fast speed, the response time of the algorithms and their distributivity have become determining criteria, in addition to their accuracy in detecting anomalies. We focus in this paper on the unsupervised anomaly detection algorithm based on binary trees: Isolation Forest. It is a very powerful algorithm with an excellent accuracy and a very low execution time thanks to its linear complexity. In particular, we study the architecture of two distribution solutions of Isolation Forest based on the Apache Spark framework. We then compare the performance of these two solutions by testing them against 4 real commonly used datasets.

Traditional anomaly detection is mostly based on single-dimensional data for identification and analysis. The isolated forest algorithm is not a description of normal samples, but a field is divided by isolated anomalies. This paper introduces a multi-dimensional segmentation plane anomaly detection algorithm for isolated forest. By using multi-dimensional plane segmentation in the process of constructing hyperplane segmentation, and controlling the generation process of the isolated tree, the generation process of the isolated forest is optimized. By adding some common datasets for comparative experiments, good results have been achieved

The Interval Control Valve (ICV) tool goes through a rigorous bench-test called the System Integration Test (SIT) to ensure the tool is safe for use before downhole deployment. The data from each sensor is stored in separate streams. Manual analysis of this high-volume stream data (often up to ∼300k data points) is time-consuming and usually involves visual judgement of the traces, which is prone to inconsistency and mistakes. This paper aims to automate anomaly detection and compliance reporting to improve speed, accuracy, and repeatability of SIT validation. A physics-informed ensemble machine learning (ML) system was developed to automate the process of detecting anomalies for the subsurface ICV tool during SIT. An ensemble of 10 models was trained on unlabeled SIT data. This ensemble comprises both Isolation Forest and XGB residuals machine learning models. A web application was built that ingests data directly from the data source in the cloud, displays the analysis on a dashboard interface, and enables one-click PDF report generation. The ensemble achieved high accuracy; the physics-guided feature selection proved successful with the model achieving a mean F1 score of 0.93. Notably, a simple delta Temperature-based Isolation Forest outperformed more complex models in detecting seal leakage (F1 = 0.99), underscoring the value of domain knowledge in anomaly detection. The system demonstrated operational efficiency, batch processing ∼30k datapoints in 58 seconds with only 14 MB memory usage, making it lightweight enough for deployment without GPU resources. Detected anomalies included power drops, jittering choke positions, and temperature divergence, all of which correlate with failure modes identified by engineers. By automating SIT review, the system reduces analysis time from hours to minutes and ensures standardized, auditable documentation. The results highlight how lightweight ML models can accelerate SIT workflows, improve tool qualification, and reduce the risk of faulty tools reaching deployment. This work presents one of the first physics-informed ensemble ML systems applied to SIT of downhole completion tools. Unlike previous studies focusing on production surveillance, this solution targets the qualification stage, bridging anomaly detection with automated reporting.

In the rapidly emerging field of transferring healthcare from hospitals to patients' homes, it is essential that signs of remote deterioration at home should be detected early to timely upscale care when needed. As patient deterioration is a rare event, datasets have insufficient event data for supervised machine learning. Personalized anomaly detection (AD) may be a good alternative. Therefore, this study aimed to obtain insight into the use of personalized AD models in detecting early signs of patient deterioration at home using wearable sensor data. To address this, Isolation Forest and Local Outlier Factor models were applied to detect signs of deterioration in terms of mortality or unplanned readmission in the 24 preceding hours in two datasets: one of heterogeneous patients, the other of postoperative patients. A pipeline was developed for continuously updating personalized AD models over time and applying them to detection windows twice per day. Results were compared with the Remote Early Warning Score. Isolation Forest (AUROC: 0.69) and Local Outlier Factor (AUROC: 0.67) models were able to find some early signs of deterioration in heterogeneous patients (n = 113). However, in postoperative patients (n = 193), Isolation Forest (AUROC: 0.41) and Local Outlier Factor (AUROC 0.44) performed badly. The Remote Early Warning Score was able to find some early signs of deterioration for both groups (AUROC: 0.63-0.76). Based on these findings, three requirements were formulated that should be fulfilled for a potentially successful application of personalized AD. First, the training set should be normal and representative of non-deteriorating patients. Second, signs of deterioration should exhibit abnormal characteristics. Third, non-deteriorating patients should not exhibit abnormal characteristics.