1
$\begingroup$

I am using Isolation Forests for Anomaly Detection. Say, my set has 10 variables, var1, var2, ..., var10, and I found an anomaly. Can I rank the 10 variables var1, var2, ..., var10 in such a way I can say that I have an anomaly and the main reason is, say, var6.

For example, if I had var1, var2, var3 only, and my set were:

5   25   109
7   26   111
6   23   108
6   26   109
6   978  108
5   25   110
7   24   107

I would say that 6, 978, 108 is an anomaly and, in particular, the reason is var2.

Is there a way to determine the main reason why a particular entry is an anomaly?

$\endgroup$
2
$\begingroup$

A naive approach would be to use a supervised model to predict the target anomaly vs no anomaly that your IsolationForest model outputs, then if and only if this supervised binary classification model performs well(maybe you can use cv score), you can use your favorite feature importance tool to examine the impact/contribution of each feature

  1. Mean decrease impurity if your model is a tree-based one (useful also to plot the/a tree of your model to understand the rules that make an observation an outlier.
  2. Permutation importance for model agnostic (pre defined metric)
  3. SHAP values for knowing more precisely the influence of each feature on your target (anomaly/no anomaly)

Edit:

I just make some research and I found that SHAP library has support for Isolation forest (check)

$\endgroup$
5
  • 1
    $\begingroup$ This would be a separate problem solution after the isolation forest, right? $\endgroup$ Aug 26 at 7:09
  • 3
    $\begingroup$ correct, once you have label your data as anomaly, non-anomaly, that becomes your target for the supervised approach $\endgroup$ Aug 26 at 12:27
  • $\begingroup$ @JulioJesus -Thank you. Would it matter what supervised model I use? Is there anyone that would be more suited to this specific problem? $\endgroup$
    – user
    Aug 26 at 15:20
  • $\begingroup$ @user check my edit, I think this solves your problem directly, without any additional surrogate model $\endgroup$ Aug 26 at 15:55
  • $\begingroup$ @JulioJesus Thank you, but I like your suggestion. In my work environment SHAP is not yet supported, but I could use your suggestion as a work around and use other supported feature importance tools, instead. $\endgroup$
    – user
    Aug 26 at 16:51
0
$\begingroup$

Since a while back one can use SHAP to exlain scikit-learn Isolation Forest models. Example code and output in this answer.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.