2
$\begingroup$

I'm currently working on an unsupervised anomaly detection project, and for it I'm using IsolationForest through scikit-learn. My question is, why/how is it possible for the model to predict something to be an anomaly when it is within the decision function space for inliers?

I've attached my results here:

figure1

Could the size of the decision function space be due to my input dimension vs this 2 dimensional projection?

I also made a quick plot of anomaly score vs. prediction (0 = inlier, 1 = anomaly):

anomalies

As seen, there exists outliers above the threshold score, which doesn't make sense to me. Can someone explain?

$\endgroup$
  • 1
    $\begingroup$ The prediction is based off an anomaly threshold, and it looks consistent. It looks like there should be ~20 predicted anomalies. How many variables are you using? If you are projecting many into 2 dimension via PCA, your mapping may not be perfect. $\endgroup$ – Hobbes Jul 11 '17 at 18:57
  • $\begingroup$ the higher the score the less abnormal... and the threshold is basically computed as a percentile based on the "contamination" parameter $\endgroup$ – oW_ Jul 11 '17 at 20:21
  • $\begingroup$ @Hobbes I have a total of 13 dimensions; in the pictures I've posted There's around 500 anomalies (out of 10,000). $\endgroup$ – kdavid2 Jul 11 '17 at 20:46
  • $\begingroup$ @oW_ that is true, however, in the first picture there are clearly outliers within the decision function space, which shouldn't happen because the decision function should only contain points whose anomaly scores were above the threshold. $\endgroup$ – kdavid2 Jul 11 '17 at 20:51
  • $\begingroup$ got it... I thought they were your labels because you call them "true" inliers and "true" outliers $\endgroup$ – oW_ Jul 11 '17 at 22:10
0
$\begingroup$

It looks that your PCA is not mapping well the data. I recommend you to look at other dimensionality reductions techniques, such as, UMAP, TSNE, in order to see if you can achieve better representation. If you do not have too much data, you could use also MDS since it will preserve local distances (however, computationally very expensive):

https://scikit-learn.org/stable/modules/generated/sklearn.manifold.MDS.html

If only the visualization is what your are after, then you could just simply run Isolation Forest on 2 Principal components, then the boundaries should be more obvious in the first picture. Of course, the actual results may be misleading.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.