Fuzzy anomaly scores for Isolation Forest

Explaining anomalies in coal proximity and coal processing data with Shapley and tree-based models

BACKGROUND Patient heterogeneity is a key challenge in immunotherapy for IDH-wildtype glioblastoma (GBM), where hypermutated tumors or highly immunosuppressive tumor microenvironments (TME) act as clinical outliers affecting treatment response and trial stratification. We developed Alert-GBM, a radiogenomic AI model designed to flag such outliers based on radiomic signatures from diagnostic imaging. MATERIAL AND METHODS We used multicenter open-access radiogenomic datasets (n = 176) to train unsupervised outlier detection models. Principal Component Analysis (PCA) served as a first-pass filter to harmonize data before applying Isolation Forest (IF) modeling. Three IF models were trained using inter-dataset leave-one-out cross-validation (LOOCV) to simulate real-world performance and were benchmarked against each other. The final model was selected using stratified 10-fold cross-validation (CV). Outliers were validated through visual inspection, statistical profiling, comparison with other outlier detection methods (Local Outlier Factor, One-Class SVM, Mahalanobis distance), and correlation with biological and immune profiles from imaging and omics data. RESULTS The PCA filter identified 3 initial outliers based on MRI metadata. The final IF model, following stratified 10-fold CV, detected 6 outliers across the datasets, with anomaly scores plotted. Flagged cases included large, highly enhancing tumors, minimally enhancing tumors, and post-operative scans. Visualizations using PCA, t-SNE, and UMAP were generated to illustrate separability. False positives and negatives were assessed using immune-based scores, and the distribution of anomaly scores was analyzed with KDE plots. Cross-validation against alternative outlier models confirmed consistency of the flagged cases. CONCLUSION Alert-GBM is a proof-of-concept AI architecture for outlier detection in GBM MRI radiogenomics, capable of flagging cases with atypical immune TME profiles. Integrating such models with radiogenomic immune predictors at the time of diagnosis may support multidisciplinary decision-making and improve patient stratification for immunotherapy trials. Incorporating a human-in-the-loop framework ensures that AI outputs remain clinically interpretable and actionable.

This paper presents an unsupervised network-based anomaly detection framework that integrates deep autoencoders with the Isolation Forest algorithm. The framework analyzes extracted traffic features, including packet length and IP address patterns, to detect deviations from normal behaviour without requiring labelled data. Autoencoders reconstruct benign traffic to highlight subtle deviations, while Isolation Forest efficiently assigns anomaly scores to identify statistical outliers in large-scale, unlabelled datasets. Experimental evaluation shows that the Isolation Forest model achieves a low mean squared error (MSE) of 0.0065 with an accuracy of 9.79%, indicating stable anomaly score separation, whereas the standalone autoencoder records a substantially higher reconstruction error (MSE = 3.92 × 10¹?) and an accuracy of 6.09%, reflecting the difficulty of modelling complex and highly variable network traffic patterns. By combining both approaches, the proposed framework improves overall detection performance, achieving a higher accuracy of 13.55%, and demonstrates enhanced capability in detecting both volumetric and stealthy attacks, such as application-layer denial-of-service (DoS) traffic. Visualization of traffic behaviour further supports the analysis, revealing clearer separation between normal and anomalous flows when both models are integrated. These findings highlight the complementary strengths of statistical outlier detection and deep learning-based reconstruction, providing a practical foundation for adaptive and real-time anomaly monitoring in dynamic network environments.

We present an extension to the model-free anomaly detection algorithm, Isolation Forest. This extension, named Extended Isolation Forest (EIF), resolves issues with assignment of anomaly score to given data points. We motivate the problem using heat maps for anomaly scores. These maps suffer from artifacts generated by the criteria for branching operation of the binary tree. We explain this problem in detail and demonstrate the mechanism by which it occurs visually. We then propose two different approaches for improving the situation. First we propose transforming the data randomly before creation of each tree, which results in averaging out the bias. Second, which is the preferred way, is to allow the slicing of the data to use hyperplanes with random slopes. This approach results in remedying the artifact seen in the anomaly score heat maps. We show that the robustness of the algorithm is much improved using this method by looking at the variance of scores of data points distributed along constant level sets. We report AUROC and AUPRC for our synthetic datasets, along with real-world benchmark datasets. We find no appreciable difference in the rate of convergence nor in computation time between the standard Isolation Forest and EIF.

Lithology identification holds a pivotal role in the characterization of subsurface formations. In recent years, the advent of big data and the need for more precise lithology identification have spurred the growing adoption of machine learning algorithms. This paper's primary objective is to leverage unsupervised machine learning techniques for the identification and subsequent removal of anomalies inherent in complex datasets. The Isolation Forest model is the cornerstone of our approach for anomaly detection and elimination. To initiate this process, we employed the K-means algorithm to create clusters, followed by a evaluation using silhouette coefficients. Subsequently, we selected input data for each cluster and conducted exploratory data analysis both prior to and after the removal of outliers. The histograms portraying average anomaly scores for each cluster were thoughtfully presented. For real-time anomaly detection, we harnessed the power of the Isolation Forest model, which facilitated the creation of an Isolation Forest anomalies map by plotting neutron-porosity against bulk density. Our rigorous data analysis employed various statistical techniques, including data statistics, histograms, and cross plots between neutron-porosity and bulk density. This multifaceted approach successfully eradicated anomalies from the dataset, a fact vividly illustrated by the histograms, where anomalies were discernible through their negative scores. The Isolation Forest map conclusively demonstrated the effective removal of outliers from the dataset, underscoring the model's proficiency in identifying and mitigating these anomalies based on their negative scores. The Isolation Forest model has thus exhibited remarkable efficacy in the identification and elimination of data anomalies. Its versatility makes it a valuable asset for the detection and removal of outliers, deviations, or noise from datasets, rendering it particularly well-suited for anomaly detection and outlier mitigation in various analytical scenarios. Notably, the combination of the K-means and Isolation Forest algorithms emerges as a potent and advantageous approach, especially when dealing with extensive datasets and conducting comprehensive analyses.

We focus on automatic anomaly detection in SQL databases for security systems. Many logs of database systems, here the Townhall database, contain detailed information about users, like the SQL queries and the response of the database. A database is a list of log instances, where each log instance is a Cartesian product of feature values with an attached anomaly score. All log instances with the anomaly score in the top percentile are identified as anomalous. Our contribution is multi-folded. We define a model for anomaly detection of SQL databases that learns the structure of Bayesian networks from data. Our method for automatic feature extraction generates the maximal spanning tree to detect the strongest similarities between features. Novel anomaly scores based on the joint probability distribution of the database features and the log-likelihood of the maximal spanning tree detect both point and contextual anomalies. Multiple anomaly scores are combined within a robust anomaly analysis algorithm. We validate our method on the Townhall database showing the performance of our anomaly detection algorithm.

The rapid growth of network data has increased the complexity of detecting anomalies, which are crucial for ensuring the security and integrity of information systems. This study investigates the use of the Isolation Forest algorithm for anomaly detection in network traffic, utilizing the Luflow Network Intrusion Detection dataset, which contains 590,086 records with 16 features related to network activities. The methodology encompasses data preprocessing (cleaning, normalization, and feature scaling), feature selection (bytes in, bytes out, entropy, and duration), model training, and performance evaluation. The results demonstrate that Isolation Forest can effectively identify anomalies based on feature patterns, isolating suspicious data points without the need for labeled datasets. However, performance metrics, such as accuracy (42.92%), precision (14.37%), recall (2.87%), and F1-score (4.79%), reveal challenges such as high false-positive rates and low sensitivity to true anomalies. These findings highlight the potential of the algorithm for dynamic, high-dimensional datasets but also indicate the need for further improvements through hyperparameter tuning, feature engineering, and alternative approaches. This study contributes to the development of adaptive anomaly detection frameworks for network security and suggests future integration into real-time systems for proactive threat mitigation. The study's findings are particularly relevant for enhancing network security in environments such as corporate and governmental networks, where real-time anomaly detection is crucial.

Bayesian active learning isolation forest (B-ALIF): A weakly supervised strategy for anomaly detection

Traditional anomaly detection is mostly based on single-dimensional data for identification and analysis. The isolated forest algorithm is not a description of normal samples, but a field is divided by isolated anomalies. This paper introduces a multi-dimensional segmentation plane anomaly detection algorithm for isolated forest. By using multi-dimensional plane segmentation in the process of constructing hyperplane segmentation, and controlling the generation process of the isolated tree, the generation process of the isolated forest is optimized. By adding some common datasets for comparative experiments, good results have been achieved

In the rapidly emerging field of transferring healthcare from hospitals to patients' homes, it is essential that signs of remote deterioration at home should be detected early to timely upscale care when needed. As patient deterioration is a rare event, datasets have insufficient event data for supervised machine learning. Personalized anomaly detection (AD) may be a good alternative. Therefore, this study aimed to obtain insight into the use of personalized AD models in detecting early signs of patient deterioration at home using wearable sensor data. To address this, Isolation Forest and Local Outlier Factor models were applied to detect signs of deterioration in terms of mortality or unplanned readmission in the 24 preceding hours in two datasets: one of heterogeneous patients, the other of postoperative patients. A pipeline was developed for continuously updating personalized AD models over time and applying them to detection windows twice per day. Results were compared with the Remote Early Warning Score. Isolation Forest (AUROC: 0.69) and Local Outlier Factor (AUROC: 0.67) models were able to find some early signs of deterioration in heterogeneous patients (n = 113). However, in postoperative patients (n = 193), Isolation Forest (AUROC: 0.41) and Local Outlier Factor (AUROC 0.44) performed badly. The Remote Early Warning Score was able to find some early signs of deterioration for both groups (AUROC: 0.63-0.76). Based on these findings, three requirements were formulated that should be fulfilled for a potentially successful application of personalized AD. First, the training set should be normal and representative of non-deteriorating patients. Second, signs of deterioration should exhibit abnormal characteristics. Third, non-deteriorating patients should not exhibit abnormal characteristics.

Anomaly detection plays a vital role in processing multi-source data through public cloud servers, yet existing privacy-preserving schemes fail to efficiently detect anomalies while protecting data source privacy. Although isolation forest offer advantages for unsupervised high-dimensional data analysis, implementing its tree-based privacy-preserving mechanisms remains challenging. In this paper, we propose IFAD, a novel isolation forest-based scheme for detecting anomalies in private data. IFAD guarantees end-to-end privacy protection by safeguarding original data, tree structures, and intermediate information throughout detection workflows. Our design achieves efficiency through three key contributions: 1) Cryptographic building blocks combining function secret sharing (FSS) and secret sharing (SS) to enable secure computations; 2) A split index protocol and layer update protocol to facilitate efficient, layer-by-layer isolation forest construction; 3) A detection phase optimization converting the anomaly score calculations into lookup table operations. Experimental evaluations demonstrate that IFAD achieves superior performance, outperforming prior schemes by 2.4×-3.1× in runtime under LAN and WAN environments, and by 1.8×-7.8× in online communication overhead, while maintaining comparable detection accuracy. Our solution establishes an effective balance between privacy preservation and operational efficiency for cloud-based anomaly detection.

Anomaly detection is a cornerstone of modern intelligent systems, with critical applications in healthcare, cybersecurity, smart grids, and IoT environments. While traditional machine learning and deep learning models have shown promise in identifying outliers, they often face challenges such as dependence on large labeled datasets, high computational costs, and limited scalability to edge devices or high-dimensional data streams. This study introduces D2H-AD, a novel anomaly detection framework built upon Hyperdimensional Computing (HDC), a brain-inspired paradigm that encodes information using high-dimensional distributed vectors. Unlike prior HDC-based approaches, D2H-AD fuses distance-based similarity and density-aware encoding in a hybrid design, significantly improving anomaly characterization and detection accuracy. Ablation experiments confirm that hyperdimensional encoding alone contributes up to 5.4% higher ROC-AUC compared to applying the same density-distance scoring in the original Euclidean feature space, and D2H-AD consistently outperforms all five published baselines (HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders) across every evaluated dataset. The method is designed to be lightweight, interpretable, and computationally efficient, suggesting strong suitability for deployment in resource-constrained and real-time environments. To validate its effectiveness, we evaluate D2H-AD on five diverse benchmark datasets, comparing its performance against five leading techniques: HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders. Our results show that D2H-AD consistently achieves superior F1 scores and ROC-AUC metrics, demonstrating robustness against class imbalance, noise, and data complexity. Beyond accuracy, D2H-AD offers practical advantages including scalability, minimal memory footprint, and an expected low-latency profile derived from its binary operations and lightweight design. These characteristics are crucial for TinyML and edge AI applications. This work highlights the untapped potential of HDC for high-performance anomaly detection and opens new avenues for secure, interpretable, and energy-efficient AI solutions in dynamic environments such as IoT, embedded systems, and beyond. Additionally, D2H-AD provides feature-level interpretability through hypervector decoding, enabling transparent explanations for safety-critical applications.

Anomaly detection is a major issue for several applications such as industrial failure detection, cybersecurity or transport. Several approaches, such as statistical methods, machine learning and sketch, have been explored by different research communities to detect anomalies in an increasingly challenging context. Indeed, facing the huge volume of data generated at an increasingly fast speed, the response time of the algorithms and their distributivity have become determining criteria, in addition to their accuracy in detecting anomalies. We focus in this paper on the unsupervised anomaly detection algorithm based on binary trees: Isolation Forest. It is a very powerful algorithm with an excellent accuracy and a very low execution time thanks to its linear complexity. In particular, we study the architecture of two distribution solutions of Isolation Forest based on the Apache Spark framework. We then compare the performance of these two solutions by testing them against 4 real commonly used datasets.

The advent of IoT technology and the increase in wireless networking devices has led to an enormous increase in network attacks from different sources. To maintain networks as safe and secure, the Intrusion Detection System (IDS) have become very critical. Intrusion Detection Systems (IDS) are designed to protect the network by identifying anomaly behaviors or improper uses. Intrusion Detection systems provide more meticulous security functionality than access control barriers by detecting attempted and successful attacks at the end-point or within the network. Intrusion prevention systems are the next logical step to this approach as they can take real-time action against breaches. To have an accurate IDS, detailed visibility is required into the network traffic. The intrusion detection system should be able to detect inside the network threats as well as access control breaches. IDS has been around for a very long time now. These traditional IDS were rules and signature-based. Though they were able to reduce false positives they were not able to detect new attacks. In today's world due to the growth of connectivity, attacks have increased at an exponential rate and it has become essential to use a data-driven approach to tackle these issues. In this paper, the KDD data set was used to train the unsupervised machine learning algorithm called Isolation Forest. The data set is highly imbalanced and contains various attacks such as DOS, Probe, U2R, R2L. Since this data set suffers from a redundancy of values and class imbalance, the data preprocessing will be performed first and also used unsupervised learning. For this network traffic based anomaly detection model isolation forest was used to detect outliers and probable attacks the results were evaluated using the anomaly score.

Casing deformation during hydraulic fracturing in unconventional reservoirs presents significant challenges, reducing well productivity, increasing costs, and restricting lateral access. While multi-finger calipers offer reliable diagnostics, they are often costly and typically used after issues arise. In contrast, the Casing Collar Locator (CCL) is routinely deployed, offering a cost-effective and scalable diagnostic alternative. This study evaluates the use of high-frequency CCL data for real-time anomaly detection, aiming to identify potential casing deformation earlier and proactively reduce the unstimulated lateral length with preventive actions. The goal is to give completion engineers timely insights that lower intervention costs and improve operational efficiency. The study proposes an end-to-end workflow including data ingestion, data processing, machine learning model deployment, and real-time visualizations. High-frequency CCL data (750Hz) is analyzed using an unsupervised anomaly detection algorithm based on isolation forests, eliminating the need for labeled datasets. The approach includes (1) validating the predictions with actual deformation events, (2) testing wireline data processing methods, and (3) applying downsampling algorithms. Techniques like frequency tuning, normalization, and downsampling (to 30–75Hz) improve efficiency without compromising resolution. A collar tagging method helps distinguish true deformation from collar-induced signals. CCL data is combined with stage and well context for accurate depth matching and real-time anomaly scoring. The developed Anomaly Detection Tool (ADT) has successfully identified casing deformations in multiple wells in a high-impact region. The model flagged deformation risks early, preventing operational disruptions. Notably, collar tagging enhances model precision by filtering collar-related signal noise. Higher resolution (0.01m sampling) sharpened anomaly resolution and improved detection. Overlaying the runs and anomalies enabled confirmation of casing degradation trends. Field testing included two phases: a shadow mode deployment where ADT findings supported contingency planning (e.g., slim plugs, longer stages) that enabled full lateral stimulation; and a live field test, where near real-time results informed operational decisions as deformation signals evolved, offering operators critical lead time for intervention planning. This study presents a scalable, real-time casing deformation detection system leveraging machine learning and ubiquitous CCL data without requiring additional tools or expensive sensors. The novelty lies in the use of an unsupervised learning approach, which performs well in the absence of labeled data and adapts across geologies and operational styles. Signal processing advancements, including collar tagging, further elevate the tool's reliability. This methodology was first developed in the Vaca Muerta formation and has since been validated across U.S. and Canadian basins, confirming its generalizability. Future work will focus on integrating supervised learning as labels mature to further improve precision and usability.