Bayesian active learning isolation forest (B-ALIF): A weakly supervised strategy for anomaly detection

BACKGROUND Patient heterogeneity is a key challenge in immunotherapy for IDH-wildtype glioblastoma (GBM), where hypermutated tumors or highly immunosuppressive tumor microenvironments (TME) act as clinical outliers affecting treatment response and trial stratification. We developed Alert-GBM, a radiogenomic AI model designed to flag such outliers based on radiomic signatures from diagnostic imaging. MATERIAL AND METHODS We used multicenter open-access radiogenomic datasets (n = 176) to train unsupervised outlier detection models. Principal Component Analysis (PCA) served as a first-pass filter to harmonize data before applying Isolation Forest (IF) modeling. Three IF models were trained using inter-dataset leave-one-out cross-validation (LOOCV) to simulate real-world performance and were benchmarked against each other. The final model was selected using stratified 10-fold cross-validation (CV). Outliers were validated through visual inspection, statistical profiling, comparison with other outlier detection methods (Local Outlier Factor, One-Class SVM, Mahalanobis distance), and correlation with biological and immune profiles from imaging and omics data. RESULTS The PCA filter identified 3 initial outliers based on MRI metadata. The final IF model, following stratified 10-fold CV, detected 6 outliers across the datasets, with anomaly scores plotted. Flagged cases included large, highly enhancing tumors, minimally enhancing tumors, and post-operative scans. Visualizations using PCA, t-SNE, and UMAP were generated to illustrate separability. False positives and negatives were assessed using immune-based scores, and the distribution of anomaly scores was analyzed with KDE plots. Cross-validation against alternative outlier models confirmed consistency of the flagged cases. CONCLUSION Alert-GBM is a proof-of-concept AI architecture for outlier detection in GBM MRI radiogenomics, capable of flagging cases with atypical immune TME profiles. Integrating such models with radiogenomic immune predictors at the time of diagnosis may support multidisciplinary decision-making and improve patient stratification for immunotherapy trials. Incorporating a human-in-the-loop framework ensures that AI outputs remain clinically interpretable and actionable.

Lithology identification holds a pivotal role in the characterization of subsurface formations. In recent years, the advent of big data and the need for more precise lithology identification have spurred the growing adoption of machine learning algorithms. This paper's primary objective is to leverage unsupervised machine learning techniques for the identification and subsequent removal of anomalies inherent in complex datasets. The Isolation Forest model is the cornerstone of our approach for anomaly detection and elimination. To initiate this process, we employed the K-means algorithm to create clusters, followed by a evaluation using silhouette coefficients. Subsequently, we selected input data for each cluster and conducted exploratory data analysis both prior to and after the removal of outliers. The histograms portraying average anomaly scores for each cluster were thoughtfully presented. For real-time anomaly detection, we harnessed the power of the Isolation Forest model, which facilitated the creation of an Isolation Forest anomalies map by plotting neutron-porosity against bulk density. Our rigorous data analysis employed various statistical techniques, including data statistics, histograms, and cross plots between neutron-porosity and bulk density. This multifaceted approach successfully eradicated anomalies from the dataset, a fact vividly illustrated by the histograms, where anomalies were discernible through their negative scores. The Isolation Forest map conclusively demonstrated the effective removal of outliers from the dataset, underscoring the model's proficiency in identifying and mitigating these anomalies based on their negative scores. The Isolation Forest model has thus exhibited remarkable efficacy in the identification and elimination of data anomalies. Its versatility makes it a valuable asset for the detection and removal of outliers, deviations, or noise from datasets, rendering it particularly well-suited for anomaly detection and outlier mitigation in various analytical scenarios. Notably, the combination of the K-means and Isolation Forest algorithms emerges as a potent and advantageous approach, especially when dealing with extensive datasets and conducting comprehensive analyses.

Anomaly detection is essential in applications such as financial fraud detection, network security, and system health monitoring. This study presents a hybrid anomaly detection model for financial transactions, combining the strengths of both unsupervised and supervised learning techniques—Isolation Forest and Random Forest, respectively. the Isolation Forest algorithm, performs unsupervised detection of outliers, effectively identifying rare or irregular data points without requiring labeled input. The detected anomalies are then used to construct a pseudo-labeled dataset, which is subsequently used to train a Random Forest classifier. The Random Forest model learns discriminative patterns between normal and anomalous data, enhancing overall detection capabilities. The system is implemented in Python using Scikit-learn for model development and evaluation. Experiments on benchmark financial transaction "Credit Card Fraud Detection Dataset from Kaggle" The hybrid model achieved a precision of 99.7%, recall of near 100%, and an F1-score of 99.98%, outperforming standalone algorithm The model also improved robustness to noise and better scalability for large datasets. Keywords: Anomaly Detection, Financial Fraud, Hybrid Machine Learning, Supervised Learning, Security, Unsupervised Learning. CISDI Journal Reference Format Azubuike Nnendah Daisy; Anireh, Vincent Ike-Emeka & Sako, D.J.S. (2025): A Model for Anomaly Detection in Financial Transactions using Hybrid Machine Learning Technique. Computing, Information Systems, Development Informatics and Allied Research Journal. Vol 16 No 3, Pp 37-50 Available online at www.isteams.net/cisdijournal. dx.doi.org/10.22624/AIMS/CISDI/V16N3P3

IntroductionIn swine disease surveillance, obtaining labeled data for supervised learning models can be challenging because many farms lack standardized diagnostic routines and consistent health monitoring systems. Unsupervised learning is particularly suitable in such scenarios because it does not require labeled data, allowing for detecting anomalies without predefined labels. This study evaluates the effectiveness of unsupervised machine learning models in detecting anomalies in productivity indicators in swine breeding herds.MethodsAnomalies, defined as deviations from expected patterns, were identified in indicators such as abortions per 1000 sows, prenatal losses, preweaning mortality, total born, liveborn, culled sows per 1000 sows, and dead sows per 1000 sows. Three unsupervised models - Isolation Forest, Autoencoder, and K-Nearest Neighbors (KNN) - were applied to data from two swine production systems. The herd-week was used as the unit of analysis, and anomaly scores above the 75th percentile were used to flag anomalous weeks. A permutation test assessed differences between anomalous and non-anomalous weeks. Performance was evaluated using F1-score, precision, and recall, with true anomalous weeks defined as those coinciding with reported health challenges, including porcine reproductive and respiratory syndrome (PRRS) and Seneca Valley virus outbreaks. A total of 8,044 weeks were analyzed.ResultsThe models identified 336 anomalous weeks and 1,008 non-anomalous weeks in Production System 1, and 1,675 anomalous weeks and 5,025 non-anomalous weeks in Production System 2. The results from the permutation test revealed significant differences in productivity indicators between anomalous and non-anomalous weeks, especially during PRRS outbreaks, with more subtle changes observed during Seneca Valley virus outbreaks. The models performed well in detecting the PRRSV anomaly, achieving perfect precision (100%) across all models for both production systems. For anomalies like SVV the models showed lower performance compared to PRRSV.DiscussionThese findings suggest that unsupervised machine learning models are promising tools for early disease detection in swine herds, as they can identify anomalies in productivity data that may signal health challenges.

Fuzzy anomaly scores for Isolation Forest

Many real-world time series data exhibit outliers and noise like abnormal machine operation, emergency monitoring etc. Anomaly detection is the most important way to deal with it. During all the solutions, Prophet is an effective model for large-scale time series with complicated patterns in anomaly detection and forecasting scenarios. However, Prophet model is easy to fall into overfitting at special time points, which leads to large errors in some behaviors. In this paper we propose a robust complex univariate time series anomaly detection framework RobustProphet based on forecasting. Specifically, in the step of forecasting, linear regression function is adopted to fuse Prophet and XGBoost model which use L2 regularization to resolve the overfitting problem and optimize the prediction results. Once the final forecasting results are generated, we offer a nonparametric dynamic thresholding approach to evaluate residuals to detect anomalies in original time series. We made a comparative study between our proposed model and other classical anomaly detection methods such as Local Outlier Factor (LOF), Isolation Forest on datasets from Yahoo benchmark datasets. The experimental results show that our proposed anomaly detection model has better precision and higher AUC.

The rapid growth of network data has increased the complexity of detecting anomalies, which are crucial for ensuring the security and integrity of information systems. This study investigates the use of the Isolation Forest algorithm for anomaly detection in network traffic, utilizing the Luflow Network Intrusion Detection dataset, which contains 590,086 records with 16 features related to network activities. The methodology encompasses data preprocessing (cleaning, normalization, and feature scaling), feature selection (bytes in, bytes out, entropy, and duration), model training, and performance evaluation. The results demonstrate that Isolation Forest can effectively identify anomalies based on feature patterns, isolating suspicious data points without the need for labeled datasets. However, performance metrics, such as accuracy (42.92%), precision (14.37%), recall (2.87%), and F1-score (4.79%), reveal challenges such as high false-positive rates and low sensitivity to true anomalies. These findings highlight the potential of the algorithm for dynamic, high-dimensional datasets but also indicate the need for further improvements through hyperparameter tuning, feature engineering, and alternative approaches. This study contributes to the development of adaptive anomaly detection frameworks for network security and suggests future integration into real-time systems for proactive threat mitigation. The study's findings are particularly relevant for enhancing network security in environments such as corporate and governmental networks, where real-time anomaly detection is crucial.

Signal analysis and anomaly detection for water pollution early warning systems are important and necessary. In view of the nonlinear and volatile characteristics of water quality time series, this paper proposes a new method for water anomaly detection based on fluctuation feature analysis. The method has two steps. First, the water quality time series data are used to calculate the residuals between the observed value and the predicted value with the long short-term memory (LSTM) network. Second, the dynamic features are extracted by sliding time window and described by the Approximate Entropy (ApEn) which are input to the anomaly detection model with Isolation Forest. Compared with traditional anomaly detection methods, the results obtained by the proposed method show better performance in distinguishing water quality anomalies. The proposed method can be applied to real-time water quality anomaly detection and early warning.

Anomaly detection is a cornerstone of modern intelligent systems, with critical applications in healthcare, cybersecurity, smart grids, and IoT environments. While traditional machine learning and deep learning models have shown promise in identifying outliers, they often face challenges such as dependence on large labeled datasets, high computational costs, and limited scalability to edge devices or high-dimensional data streams. This study introduces D2H-AD, a novel anomaly detection framework built upon Hyperdimensional Computing (HDC), a brain-inspired paradigm that encodes information using high-dimensional distributed vectors. Unlike prior HDC-based approaches, D2H-AD fuses distance-based similarity and density-aware encoding in a hybrid design, significantly improving anomaly characterization and detection accuracy. Ablation experiments confirm that hyperdimensional encoding alone contributes up to 5.4% higher ROC-AUC compared to applying the same density-distance scoring in the original Euclidean feature space, and D2H-AD consistently outperforms all five published baselines (HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders) across every evaluated dataset. The method is designed to be lightweight, interpretable, and computationally efficient, suggesting strong suitability for deployment in resource-constrained and real-time environments. To validate its effectiveness, we evaluate D2H-AD on five diverse benchmark datasets, comparing its performance against five leading techniques: HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders. Our results show that D2H-AD consistently achieves superior F1 scores and ROC-AUC metrics, demonstrating robustness against class imbalance, noise, and data complexity. Beyond accuracy, D2H-AD offers practical advantages including scalability, minimal memory footprint, and an expected low-latency profile derived from its binary operations and lightweight design. These characteristics are crucial for TinyML and edge AI applications. This work highlights the untapped potential of HDC for high-performance anomaly detection and opens new avenues for secure, interpretable, and energy-efficient AI solutions in dynamic environments such as IoT, embedded systems, and beyond. Additionally, D2H-AD provides feature-level interpretability through hypervector decoding, enabling transparent explanations for safety-critical applications.

Anomaly detection is a major issue for several applications such as industrial failure detection, cybersecurity or transport. Several approaches, such as statistical methods, machine learning and sketch, have been explored by different research communities to detect anomalies in an increasingly challenging context. Indeed, facing the huge volume of data generated at an increasingly fast speed, the response time of the algorithms and their distributivity have become determining criteria, in addition to their accuracy in detecting anomalies. We focus in this paper on the unsupervised anomaly detection algorithm based on binary trees: Isolation Forest. It is a very powerful algorithm with an excellent accuracy and a very low execution time thanks to its linear complexity. In particular, we study the architecture of two distribution solutions of Isolation Forest based on the Apache Spark framework. We then compare the performance of these two solutions by testing them against 4 real commonly used datasets.

<p>Anomaly detection with multivariate time series data collected by multi-sensors is a challenging problem due to the complexity and high dimension of data and the difficulty of manually labelling data. This paper proposes a novel unsupervised anomaly detection model using spatial-temporal self-attention based on transformer architecture, denoted the biself-attention anomaly detection (BSAAD) model. The BSAAD model not only utilizes a time-step encoder with a self-attention mechanism to capture temporal correlation but also constructs a sensor encoder with a self-attention mechanism to capture spatial correlation among multivariate time series data. To amplify the reconstruction errors of anomalous points during network training, a two-phase training style with an adversarial training strategy is used to improve the anomaly detection performance of the BSAAD model. Experiments on six multivariate time series datasets show that the BSAAD model outperforms state-of-the-art anomaly detection methods.</p> <p> </p>

Traditional anomaly detection is mostly based on single-dimensional data for identification and analysis. The isolated forest algorithm is not a description of normal samples, but a field is divided by isolated anomalies. This paper introduces a multi-dimensional segmentation plane anomaly detection algorithm for isolated forest. By using multi-dimensional plane segmentation in the process of constructing hyperplane segmentation, and controlling the generation process of the isolated tree, the generation process of the isolated forest is optimized. By adding some common datasets for comparative experiments, good results have been achieved

We introduce an exploratory active learning (AL) algorithm using Gaussian process regression and marginalized graph kernel (GPR-MGK) to sample chemical compound space (CCS) at minimal cost. Targeting 251,728 enumerated alkane molecules with 4-19 carbon atoms, we applied the AL algorithm to select a diverse and representative set of molecules and then conducted high-throughput molecular simulations on these selected molecules. To demonstrate the power of the AL algorithm, we built directed message-passing neural networks (D-MPNN) using simulation data as the training set to predict liquid densities, heat capacities, and vaporization enthalpies of the CCS. Validations show that D-MPNN models built on the smallest training set considered in this work, which consists of 313 molecules or 0.124% of the original CCS, predict the properties with R2 > 0.99 against the computational data and R2 > 0.94 against the experimental data. The advantage of the presented AL algorithm is that the predicted uncertainty of GPR depends on only the molecular structures, which renders it compatible with high-throughput data generation.

In the rapidly emerging field of transferring healthcare from hospitals to patients' homes, it is essential that signs of remote deterioration at home should be detected early to timely upscale care when needed. As patient deterioration is a rare event, datasets have insufficient event data for supervised machine learning. Personalized anomaly detection (AD) may be a good alternative. Therefore, this study aimed to obtain insight into the use of personalized AD models in detecting early signs of patient deterioration at home using wearable sensor data. To address this, Isolation Forest and Local Outlier Factor models were applied to detect signs of deterioration in terms of mortality or unplanned readmission in the 24 preceding hours in two datasets: one of heterogeneous patients, the other of postoperative patients. A pipeline was developed for continuously updating personalized AD models over time and applying them to detection windows twice per day. Results were compared with the Remote Early Warning Score. Isolation Forest (AUROC: 0.69) and Local Outlier Factor (AUROC: 0.67) models were able to find some early signs of deterioration in heterogeneous patients (n = 113). However, in postoperative patients (n = 193), Isolation Forest (AUROC: 0.41) and Local Outlier Factor (AUROC 0.44) performed badly. The Remote Early Warning Score was able to find some early signs of deterioration for both groups (AUROC: 0.63-0.76). Based on these findings, three requirements were formulated that should be fulfilled for a potentially successful application of personalized AD. First, the training set should be normal and representative of non-deteriorating patients. Second, signs of deterioration should exhibit abnormal characteristics. Third, non-deteriorating patients should not exhibit abnormal characteristics.

Anomaly detection in database transactions is critical for safeguarding sensitive information and ensuring the integrity of operations in industries like finance, healthcare, and e-commerce. Existing techniques, including rule-based, machine learning, and deep learning methods, face challenges such as high false positive rates, poor adaptability to evolving patterns, and limited scalability in imbalanced datasets. This research proposes a novel Reinforcement Learning (RL)-based anomaly detection system to address these limitations. The model employs a dynamic reward mechanism and anomaly scoring system to classify transactions accurately while reducing false positives. It leverages the Kaggle Anomaly Detection in Transactions Dataset and a synthetically generated dataset for training and evaluation. Experimental results show that the RL-based model outperforms traditional methods, achieving a precision of 95.2%, recall of 92.4%, and an AUC-ROC score of 97.2%, significantly higher than Autoencoders, Isolation Forest, and Support Vector Machines. The proposed model’s adaptability and robustness make it a scalable solution for real-time anomaly detection, addressing critical gaps in existing techniques. This study advances database security by offering a highly accurate, adaptive, and efficient system for detecting anomalies in complex transactional environments.