0
$\begingroup$

I'm trying to build an anomaly detection model using Isolation Forest. I currently have 12 features, about half of them depends on the presence of a particular data field, say A. For example, feature_1 could be if A is longer than a specific length, and feature_2 could be if A contains a certain substring. The problem is A may not be present for all data points. So I have 3 values for my features: 0 if A does not meet the criteria, 1 if it does, and 2 if A does not exist.

I have 2 datasets, one contains data points that I'm highly confident is anomalous, the other contains data points that I'm relatively confident should be benign. However, my model is predicting only a small subset of the first dataset as "anomalous".

It appears that a lot of the "benign" data samples have the value 2 for many of the features, because A does not exist in these data samples.

I'm wondering if using 2 to indicate the absence of A is affecting my results. How should I engineer my features then, or should I drop samples without A?

Improve this question
$\endgroup$
6
  • $\begingroup$ Are you saying that you have added a separate feature which encodes whether a particular column in the data is present? And this is also supposed to indicate whether some other features should be considered or not? $\endgroup$
    – Jon Nordby
    Oct 14, 2022 at 18:47
  • $\begingroup$ How do you wish datapoints that are missing A to be classified? Always benign, always anomalous, or dependent on the remaining data? $\endgroup$
    – Jon Nordby
    Oct 14, 2022 at 18:49
  • $\begingroup$ @JonNordby I don't have a separate feature to indicate whether a particular column in the data is present. I'm using the same column to indicate if A does not exist for that data point (value is 2), and if it does exist, then 1 if it fits the criteria, 0 if it does not. I'm wondering if I should be doing this. $\endgroup$
    – Rayne
    Oct 16, 2022 at 3:14
  • $\begingroup$ For datapoints that are missing A, their classification should depend on the remaining features. $\endgroup$
    – Rayne
    Oct 16, 2022 at 3:19
  • 1
    $\begingroup$ Two models and splitting instances based on the (missing) data, is what you need to do. Don't think there is any other way. You can package this into a single scikit-learn estimator / pipeline, so that this complexity is not seen from the outside. $\endgroup$
    – Jon Nordby
    Oct 16, 2022 at 10:09

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.