I'm trying to build an anomaly detection model using Isolation Forest. I currently have 12 features, about half of them depends on the presence of a particular data field, say
A. For example,
feature_1 could be if
A is longer than a specific length, and
feature_2 could be if
A contains a certain substring. The problem is
A may not be present for all data points. So I have 3 values for my features:
A does not meet the criteria,
1 if it does, and
A does not exist.
I have 2 datasets, one contains data points that I'm highly confident is anomalous, the other contains data points that I'm relatively confident should be benign. However, my model is predicting only a small subset of the first dataset as "anomalous".
It appears that a lot of the "benign" data samples have the value
2 for many of the features, because
A does not exist in these data samples.
I'm wondering if using
2 to indicate the absence of
A is affecting my results. How should I engineer my features then, or should I drop samples without