0
$\begingroup$

I'm trying to build an anomaly detection model using Isolation Forest. I currently have 12 features, about half of them depends on the presence of a particular data field, say A. For example, feature_1 could be if A is longer than a specific length, and feature_2 could be if A contains a certain substring. The problem is A may not be present for all data points. So I have 3 values for my features: 0 if A does not meet the criteria, 1 if it does, and 2 if A does not exist.

I have 2 datasets, one contains data points that I'm highly confident is anomalous, the other contains data points that I'm relatively confident should be benign. However, my model is predicting only a small subset of the first dataset as "anomalous".

It appears that a lot of the "benign" data samples have the value 2 for many of the features, because A does not exist in these data samples.

I'm wondering if using 2 to indicate the absence of A is affecting my results. How should I engineer my features then, or should I drop samples without A?

$\endgroup$
6
  • $\begingroup$ Are you saying that you have added a separate feature which encodes whether a particular column in the data is present? And this is also supposed to indicate whether some other features should be considered or not? $\endgroup$
    – Jon Nordby
    Oct 14, 2022 at 18:47
  • $\begingroup$ How do you wish datapoints that are missing A to be classified? Always benign, always anomalous, or dependent on the remaining data? $\endgroup$
    – Jon Nordby
    Oct 14, 2022 at 18:49
  • $\begingroup$ @JonNordby I don't have a separate feature to indicate whether a particular column in the data is present. I'm using the same column to indicate if A does not exist for that data point (value is 2), and if it does exist, then 1 if it fits the criteria, 0 if it does not. I'm wondering if I should be doing this. $\endgroup$
    – Rayne
    Oct 16, 2022 at 3:14
  • $\begingroup$ For datapoints that are missing A, their classification should depend on the remaining features. $\endgroup$
    – Rayne
    Oct 16, 2022 at 3:19
  • 1
    $\begingroup$ Two models and splitting instances based on the (missing) data, is what you need to do. Don't think there is any other way. You can package this into a single scikit-learn estimator / pipeline, so that this complexity is not seen from the outside. $\endgroup$
    – Jon Nordby
    Oct 16, 2022 at 10:09

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy