Isolation forest: Difference between revisions
KomradKenny (talk | contribs) m Corrected the spelling from "normalise" to "normalize" |
→Anomaly score: Fixed m back to n in c(m) Tags: Manual revert Mobile edit Mobile web edit |
||
(26 intermediate revisions by 11 users not shown) | |||
Line 1: | Line 1: | ||
{{Advert|date=September 2022}} |
|||
{{short description|Algorithm for anomaly detection}} |
{{short description|Algorithm for anomaly detection}} |
||
{{COI|date= |
{{COI|date=October 2023}} |
||
'''Isolation Forest''' is an algorithm for data [[anomaly detection]] initially developed by Fei Tony Liu |
'''Isolation Forest''' is an algorithm for data [[anomaly detection]] initially developed by Fei Tony Liu in 2008.<ref>{{Cite web |url=https://sourceforge.net/projects/iforest/|title = First Isolation Forest implementation on Sourceforge|last = Liu |first = Fei Tony}}</ref> Isolation Forest detects anomalies using [[Binary tree|binary trees]]. The algorithm has a linear time complexity and a low memory requirement, which works well with high-volume data.<ref name=":0">{{Cite book|last1=Liu|first1=Fei Tony|last2=Ting|first2=Kai Ming|last3=Zhou|first3=Zhi-Hua|title=2008 Eighth IEEE International Conference on Data Mining |chapter=Isolation Forest |date=December 2008|pages=413–422|doi=10.1109/ICDM.2008.17|isbn=978-0-7695-3502-9|s2cid=6505449}}</ref><ref name=":1">{{Cite journal|last1=Liu|first1=Fei Tony|last2=Ting|first2=Kai Ming|last3=Zhou|first3=Zhi-Hua|title=Isolation-Based Anomaly Detection |journal=ACM Transactions on Knowledge Discovery from Data |date=December 2008|volume=6 |pages=3:1–3:39|url=https://dl.acm.org/doi/10.1145/2133360.2133363|doi=10.1145/2133360.2133363|s2cid=207193045 }}</ref> |
||
In essence, the algorithm relies upon the characteristics of anomalies, i.e., being few and different, in order to detect anomalies. No density estimation is performed in the algorithm. The algorithm is different from decision tree algorithms in that only the path-length measure or approximation is being used to generate the anomaly score, no leaf node statistics on class distribution or target value is needed. |
|||
[[File:Normalized Anomaly Scores of Isolation Forest.png|thumb|The normalized anomaly scores of the Isolation Forest algorithm fit on the Old Faithful dataset]] |
|||
Isolation Forest splits the data space using |
Isolation Forest is fast because it splits the data space randomly, using randomly selected attribute and randomly selected split point. The anomaly score is invertedly associated with the path-length as anomalies need fewer splits to be isolated, due to the fact that they are few and different. |
||
== History == |
== History == |
||
Line 11: | Line 10: | ||
The Isolation Forest (iForest) algorithm was initially proposed by Fei Tony Liu, Kai Ming Ting and [[Zhou Zhi-Hua|Zhi-Hua Zhou]] in 2008.<ref name=":0" /> In 2010, an extension of the algorithm - SCiforest <ref name=":2">{{Cite journal|last1=Liu|first1=Fei Tony|last2=Ting|first2=Kai Ming|last3=Zhou|first3=Zhi-Hua|date=September 2010|title=On Detecting Clustered Anomalies Using SCiForest|journal=Joint European Conference on Machine Learning and Knowledge Discovery in Databases - ECML PKDD 2010: Machine Learning and Knowledge Discovery in Databases|series=Lecture Notes in Computer Science|volume=6322|pages=274–290|doi=10.1007/978-3-642-15883-4_18|isbn=978-3-642-15882-7|doi-access=free}}</ref> was developed to address clustered and axis-paralleled anomalies. In 2012<ref name=":1" /> the same authors demonstrated that iForest has linear time complexity, a small memory requirement, and is applicable to high dimensional data. |
The Isolation Forest (iForest) algorithm was initially proposed by Fei Tony Liu, Kai Ming Ting and [[Zhou Zhi-Hua|Zhi-Hua Zhou]] in 2008.<ref name=":0" /> In 2010, an extension of the algorithm - SCiforest <ref name=":2">{{Cite journal|last1=Liu|first1=Fei Tony|last2=Ting|first2=Kai Ming|last3=Zhou|first3=Zhi-Hua|date=September 2010|title=On Detecting Clustered Anomalies Using SCiForest|journal=Joint European Conference on Machine Learning and Knowledge Discovery in Databases - ECML PKDD 2010: Machine Learning and Knowledge Discovery in Databases|series=Lecture Notes in Computer Science|volume=6322|pages=274–290|doi=10.1007/978-3-642-15883-4_18|isbn=978-3-642-15882-7|doi-access=free}}</ref> was developed to address clustered and axis-paralleled anomalies. In 2012<ref name=":1" /> the same authors demonstrated that iForest has linear time complexity, a small memory requirement, and is applicable to high dimensional data. |
||
In 2013 Zhiguo Ding and Minrui Fei proposed a framework based on iForest to resolve the problem of detecting anomalies in streaming data.<ref>{{Cite journal|last1=Ding|first1=Zhiguo|last2=Fei|first2=Minrui|date=September 2013|title=An Anomaly Detection Approach Based on Isolation Forest Algorithm for Streaming Data using Sliding Window|url=https://www.researchgate.net/publication/271493755|journal=3rd IFAC International Conference on Intelligent Control and Automation Science}}</ref> More applications of iForest to streaming data are described in papers by Tan et al.,<ref name=":4">{{Cite book|title=Proceedings of the Twenty-Second international joint conference on Artificial Intelligence|author1=Tan|first=Swee Chuan|last2=Ting|first2=Kai Ming|last3=Liu|first3=Fei Tony|publisher=AAAI Press|year=2011|isbn=9781577355144|volume=2|pages=1511–1516|chapter=Fast anomaly detection for streaming data|doi=10.5591/978-1-57735-516-8/IJCAI11-254|chapter-url=https://dl.acm.org/citation.cfm?id=2283647}}</ref> Susto et al.<ref>{{Cite book |doi = 10.1109/ASMC.2017.7969205|chapter = Anomaly detection through on-line isolation Forest: An application to plasma etching|title = 2017 28th Annual SEMI Advanced Semiconductor Manufacturing Conference (ASMC)|pages = 89–94|year = 2017|last1 = Susto|first1 = Gian Antonio|last2 = Beghi|first2 = Alessandro|last3 = McLoone|first3 = Sean|isbn = 978-1-5090-5448-0|chapter-url = https://pure.qub.ac.uk/portal/en/publications/anomaly-detection-through-online-isolation-forest-an-application-to-plasma-etching(61b40f8b-8a8b-47a8-80f7-97a07eccad41).html|url = http://asmc2017.conferencespot.org/polopoly_fs/1.3585615.1494356183!/fileserver/file/768609/filename/04.4.pdf}}</ref> and Weng et al.<ref>{{Cite journal|last1=Weng|first1=Yu|last2=Liu|first2=Lei|date=15 April 2019|title=A Collective Anomaly Detection Approach for Multidimensional Streams in Mobile Service Security|journal=IEEE Access|volume=7|pages=49157–49168|doi=10.1109/ACCESS.2019.2909750|doi-access=free}}</ref> |
|||
In 2018,<ref name=":5">{{cite journal |last1=Hariri |first1=Sahand |last2=Carrasco Kind |first2=Matias |last3=Brunner |first3=Robert J. |year=2019 |title=Extended Isolation Forest |journal=IEEE Transactions on Knowledge and Data Engineering |volume=33 |issue=4 |pages=1479–1489 |arxiv=1811.02141 |doi=10.1109/TKDE.2019.2947676 |s2cid=53236735}}</ref> an extension of iForest, aimed at improving the reliability of the anomaly score produced for a given data point was proposed. |
|||
== Algorithm == |
== Algorithm == |
||
Line 38: | Line 34: | ||
== Properties of isolation forest == |
== Properties of isolation forest == |
||
* '''Sub-sampling''': As iForest does not need to isolate all normal instances, it can frequently ignore the majority of the training sample. As a consequence, iForest works very well when the sampling size is kept small, a property that is in contrast with the great majority of existing methods, where a large sampling size is usually desirable.<ref name=":0" /><ref name=":1" /> |
* '''Sub-sampling''': As iForest does not need to isolate all normal instances, it can frequently ignore the majority of the training sample. As a consequence, iForest works very well when the sampling size is kept small, a property that is in contrast with the great majority of existing methods, where a large sampling size is usually desirable.<ref name=":0" /><ref name=":1" /> |
||
* '''Swamping''': When normal instances are too close to anomalies, the number of partitions required to separate anomalies increases, a phenomenon known as ''swamping'', which makes it more difficult for iForest to discriminate between anomalies and normal points. One of the main reasons for swamping is the presence of too much data for the purpose of anomaly detection, which implies one possible solution to the problem is sub-sampling. Since |
* '''Swamping''': When normal instances are too close to anomalies, the number of partitions required to separate anomalies increases, a phenomenon known as ''swamping'', which makes it more difficult for iForest to discriminate between anomalies and normal points. One of the main reasons for swamping is the presence of too much data for the purpose of anomaly detection, which implies one possible solution to the problem is sub-sampling. Since it responds very well to sub-sampling in terms of performance, the reduction of the number of points in the sample is also a good way to reduce the effect of swamping.<ref name=":0" /> |
||
* '''Masking''': When the number of anomalies is high it is possible that some of those aggregate in a dense and large cluster, making it more difficult to separate the single anomalies and, in turn, to detect such points as anomalous. Similarly, to swamping, this phenomenon (known as “''masking''”) is also more likely when the number of points in the sample is big and can be alleviated through sub-sampling.<ref name=":0" /> |
* '''Masking''': When the number of anomalies is high it is possible that some of those aggregate in a dense and large cluster, making it more difficult to separate the single anomalies and, in turn, to detect such points as anomalous. Similarly, to swamping, this phenomenon (known as “''masking''”) is also more likely when the number of points in the sample is big and can be alleviated through sub-sampling.<ref name=":0" /> |
||
* '''High Dimensional Data''': One of the main limitations of standard, distance-based methods is their inefficiency in dealing with high dimensional datasets.<ref>{{cite arXiv|last1=Dilini Talagala|first1=Priyanga|last2=Hyndman|first2=Rob J.|last3=Smith-Miles|first3=Kate|date=12 Aug 2019|title=Anomaly Detection in High Dimensional Data|eprint=1908.04000|class=stat.ML}}</ref> The main reason for that is, in a high dimensional space every point is equally sparse, so using a distance-based measure of separation is pretty ineffective. Unfortunately, high-dimensional data also affects the detection performance of iForest, but the performance can be vastly improved by adding a features selection test, like [[Kurtosis]], to reduce the dimensionality of the sample space.<ref name=":0" /><ref name=":2" /> |
* '''High Dimensional Data''': One of the main limitations of standard, distance-based methods is their inefficiency in dealing with high dimensional datasets.<ref>{{cite arXiv|last1=Dilini Talagala|first1=Priyanga|last2=Hyndman|first2=Rob J.|last3=Smith-Miles|first3=Kate|date=12 Aug 2019|title=Anomaly Detection in High Dimensional Data|eprint=1908.04000|class=stat.ML}}</ref> The main reason for that is, in a high dimensional space every point is equally sparse, so using a distance-based measure of separation is pretty ineffective. Unfortunately, high-dimensional data also affects the detection performance of iForest, but the performance can be vastly improved by adding a features selection test, like [[Kurtosis]], to reduce the dimensionality of the sample space.<ref name=":0" /><ref name=":2" /> |
||
Line 69: | Line 65: | ||
== Open source implementations == |
== Open source implementations == |
||
Original implementation by the paper authors was [https://sourceforge.net/projects/iforest/ Isolation Forest] in [[R (programming language)|R]]. |
|||
Original implementation: |
|||
* [https://sourceforge.net/projects/iforest/ Isolation Forest], an algorithm that detects data-anomalies using binary trees written in [[R (programming language)|R]]. Released by the paper's first author [https://sourceforge.net/projects/iforest/ Liu, Fei Tony] in 2009. |
|||
Other implementations (in alphabetical order): |
Other implementations (in alphabetical order): |
||
* [[ELKI]] contains a Java implementation. |
|||
* [https://github.com/linkedin/isolation-forest Isolation Forest] - A Spark/Scala implementation, created by [https://www.linkedin.com/in/jamesverbus/ James Verbus] from the LinkedIn Anti-Abuse AI team. |
|||
* [https://github.com/linkedin/isolation-forest Isolation Forest] - A Spark/Scala implementation.<ref>{{Cite web |title=Detecting and preventing abuse on LinkedIn using isolation forests |url=https://engineering.linkedin.com/blog/2019/isolation-forest |access-date=2023-07-02 |website=LinkedIn Engineering Blog |language=en |date= 13 August 2019 |first=James |last=Verbus}}</ref> |
|||
* [https://docs.h2o.ai/h2o/latest-stable/h2o-docs/data-science/if.html Isolation Forest by H2O-3] - |
* [https://docs.h2o.ai/h2o/latest-stable/h2o-docs/data-science/if.html Isolation Forest by H2O-3] - A Python implementation. |
||
* [https://github.com/talegari/solitude Package solitude] implementation in [[R (programming language)|R] |
* [https://github.com/talegari/solitude Package solitude] implementation in [[R (programming language)|R]]. |
||
* [https://scikit-learn.org/stable/auto_examples/ensemble/plot_isolation_forest.html Python implementation] with examples in [[scikit-learn]]. |
* [https://scikit-learn.org/stable/auto_examples/ensemble/plot_isolation_forest.html Python implementation] with examples in [[scikit-learn]]. |
||
* [https://github.com/titicaca/spark-iforest Spark iForest] - A distributed |
* [https://github.com/titicaca/spark-iforest Spark iForest] - A distributed [[Apache Spark]] implementation in Scala/Python. |
||
* [https://pyod.readthedocs.io/en/latest/pyod.models.html#module-pyod.models.iforest PyOD IForest] - Another Python implementation in the popular [https://pyod.readthedocs.io/en/latest/ Python Outlier Detection (PyOD)] library. |
* [https://pyod.readthedocs.io/en/latest/pyod.models.html#module-pyod.models.iforest PyOD IForest] - Another Python implementation in the popular [https://pyod.readthedocs.io/en/latest/ Python Outlier Detection (PyOD)] library. |
||
Other variations of Isolation Forest algorithm implementations: |
Other variations of Isolation Forest algorithm implementations: |
||
* [https://github.com/sahandha/eif Extended Isolation Forest] – An implementation of Extended Isolation Forest |
* [https://github.com/sahandha/eif Extended Isolation Forest] – An implementation of Extended Isolation Forest.<ref>{{Cite journal |last1=Hariri |first1=Sahand |last2=Kind |first2=Matias Carrasco |last3=Brunner |first3=Robert J. |date=April 2021 |title=Extended Isolation Forest |url=https://ieeexplore.ieee.org/document/8888179 |journal=IEEE Transactions on Knowledge and Data Engineering |volume=33 |issue=4 |pages=1479–1489 |doi=10.1109/TKDE.2019.2947676 |s2cid=53236735 |issn=1558-2191|arxiv=1811.02141 }}</ref> |
||
* [https://docs.h2o.ai/h2o/latest-stable/h2o-docs/data-science/eif.html Extended Isolation Forest by H2O-3] - An implementation of Extended Isolation Forest |
* [https://docs.h2o.ai/h2o/latest-stable/h2o-docs/data-science/eif.html Extended Isolation Forest by H2O-3] - An implementation of Extended Isolation Forest. |
||
* [https://github.com/david-cortes/isotree (Python, R, C/C++) Isolation Forest and variations |
* [https://github.com/david-cortes/isotree (Python, R, C/C++) Isolation Forest and variations] - An implementation of Isolation Forest and its variations.<ref>{{cite arXiv | eprint=1910.12362 | last1=Cortes | first1=David | title=Distance approximation using Isolation Forests | year=2019 | class=stat.ML }}</ref> |
||
== See also == |
== See also == |
||
* [[Anomaly detection]] |
* [[Anomaly detection]] |
||
* [[Random forest]] |
|||
== References == |
== References == |
Revision as of 08:36, 11 January 2024
![]() | A major contributor to this article appears to have a close connection with its subject. (October 2023) |
Isolation Forest is an algorithm for data anomaly detection initially developed by Fei Tony Liu in 2008.[1] Isolation Forest detects anomalies using binary trees. The algorithm has a linear time complexity and a low memory requirement, which works well with high-volume data.[2][3] In essence, the algorithm relies upon the characteristics of anomalies, i.e., being few and different, in order to detect anomalies. No density estimation is performed in the algorithm. The algorithm is different from decision tree algorithms in that only the path-length measure or approximation is being used to generate the anomaly score, no leaf node statistics on class distribution or target value is needed.
Isolation Forest is fast because it splits the data space randomly, using randomly selected attribute and randomly selected split point. The anomaly score is invertedly associated with the path-length as anomalies need fewer splits to be isolated, due to the fact that they are few and different.
History
The Isolation Forest (iForest) algorithm was initially proposed by Fei Tony Liu, Kai Ming Ting and Zhi-Hua Zhou in 2008.[2] In 2010, an extension of the algorithm - SCiforest [4] was developed to address clustered and axis-paralleled anomalies. In 2012[3] the same authors demonstrated that iForest has linear time complexity, a small memory requirement, and is applicable to high dimensional data.
Algorithm
![](http://upload.wikimedia.org/wikipedia/commons/thumb/c/ce/Isolating_a_Non-Anomalous_Point.png/300px-Isolating_a_Non-Anomalous_Point.png)
The premise of the Isolation Forest algorithm is that anomalous data points are easier to separate from the rest of the sample. In order to isolate a data point, the algorithm recursively generates partitions on the sample by randomly selecting an attribute and then randomly selecting a split value between the minimum and maximum values allowed for that attribute.
![Isolating an Anomalous Point](http://upload.wikimedia.org/wikipedia/commons/thumb/f/ff/Isolating_an_Anomalous_Point.png/300px-Isolating_an_Anomalous_Point.png)
An example of random partitioning in a 2D dataset of normally distributed points is given in Fig. 2 for a non-anomalous point and Fig. 3 for a point that's more likely to be an anomaly. It is apparent from the pictures how anomalies require fewer random partitions to be isolated, compared to normal points.
Recursive partitioning can be represented by a tree structure named Isolation Tree, while the number of partitions required to isolate a point can be interpreted as the length of the path, within the tree, to reach a terminating node starting from the root. For example, the path length of point in Fig. 2 is greater than the path length of in Fig. 3.
Let be a set of d-dimensional points and . An Isolation Tree (iTree) is defined as a data structure with the following properties:
- for each node in the Tree, is either an external-node with no child, or an internal-node with one “test” and exactly two child nodes ( and )
- a test at node consists of an attribute and a split value such that the test determines the traversal of a data point to either oder .
In order to build an iTree, the algorithm recursively divides by randomly selecting an attribute and a split value , until either
- the node has only one instance, or
- all data at the node have the same values.
When the iTree is fully grown, each point in is isolated at one of the external nodes. Intuitively, the anomalous points are those (easier to isolate, hence) with the smaller path length in the tree, where the path length of point is defined as the number of edges traverses from the root node to get to an external node.
A probabilistic explanation of iTree is provided in the original iForest paper.[2]
Properties of isolation forest
- Sub-sampling: As iForest does not need to isolate all normal instances, it can frequently ignore the majority of the training sample. As a consequence, iForest works very well when the sampling size is kept small, a property that is in contrast with the great majority of existing methods, where a large sampling size is usually desirable.[2][3]
- Swamping: When normal instances are too close to anomalies, the number of partitions required to separate anomalies increases, a phenomenon known as swamping, which makes it more difficult for iForest to discriminate between anomalies and normal points. One of the main reasons for swamping is the presence of too much data for the purpose of anomaly detection, which implies one possible solution to the problem is sub-sampling. Since it responds very well to sub-sampling in terms of performance, the reduction of the number of points in the sample is also a good way to reduce the effect of swamping.[2]
- Masking: When the number of anomalies is high it is possible that some of those aggregate in a dense and large cluster, making it more difficult to separate the single anomalies and, in turn, to detect such points as anomalous. Similarly, to swamping, this phenomenon (known as “masking”) is also more likely when the number of points in the sample is big and can be alleviated through sub-sampling.[2]
- High Dimensional Data: One of the main limitations of standard, distance-based methods is their inefficiency in dealing with high dimensional datasets.[5] The main reason for that is, in a high dimensional space every point is equally sparse, so using a distance-based measure of separation is pretty ineffective. Unfortunately, high-dimensional data also affects the detection performance of iForest, but the performance can be vastly improved by adding a features selection test, like Kurtosis, to reduce the dimensionality of the sample space.[2][4]
- Normal Instances Only: iForest performs well even if the training set does not contain any anomalous point,[4] the reason being that iForest describes data distributions in such a way that high values of the path length correspond to the presence of data points. As a consequence, the presence of anomalies is pretty irrelevant to iForest's detection performance.
Anomaly detection with isolation forest
Anomaly detection with Isolation Forest is a process composed of two main stages:[4]
- in the first stage, a training dataset is used to build iTrees.
- in the second stage, each instance in the test set is passed through these iTrees, and a proper “anomaly score” is assigned to the instance.
Once all the instances in the test set have been assigned an anomaly score, it is possible to mark as “anomaly” any point whose score is greater than a predefined threshold, which depends on the domain the analysis is being applied to.
Anomaly score
The algorithm for computing the anomaly score of a data point is based on the observation that the structure of iTrees is equivalent to that of Binary Search Trees (BST): a termination to an external node of the iTree corresponds to an unsuccessful search in the BST.[4] As a consequence, the estimation of average for external node terminations is the same as that of the unsuccessful searches in BST, that is[6]
where is the testing data size, is the size of the sample set and is the harmonic number, which can be estimated by , where is the Euler-Mascheroni constant.
The value of c(m) above represents the average of given , so we can use it to normalize and get an estimation of the anomaly score for a given instance x:
where is the average value of from a collection of iTrees. It is interesting to note that for any given instance :
- if is close to then is very likely to be an anomaly
- if is smaller than then is likely to be a normal value
- if for a given sample all instances are assigned an anomaly score of around , then it is safe to assume that the sample doesn't have any anomaly
Open source implementations
Original implementation by the paper authors was Isolation Forest in R.
Other implementations (in alphabetical order):
- ELKI contains a Java implementation.
- Isolation Forest - A Spark/Scala implementation.[7]
- Isolation Forest by H2O-3 - A Python implementation.
- Package solitude implementation in R.
- Python implementation with examples in scikit-learn.
- Spark iForest - A distributed Apache Spark implementation in Scala/Python.
- PyOD IForest - Another Python implementation in the popular Python Outlier Detection (PyOD) library.
Other variations of Isolation Forest algorithm implementations:
- Extended Isolation Forest – An implementation of Extended Isolation Forest.[8]
- Extended Isolation Forest by H2O-3 - An implementation of Extended Isolation Forest.
- (Python, R, C/C++) Isolation Forest and variations - An implementation of Isolation Forest and its variations.[9]
See also
References
- ^ Liu, Fei Tony. "First Isolation Forest implementation on Sourceforge".
- ^ a b c d e f g Liu, Fei Tony; Ting, Kai Ming; Zhou, Zhi-Hua (December 2008). "Isolation Forest". 2008 Eighth IEEE International Conference on Data Mining. pp. 413–422. doi:10.1109/ICDM.2008.17. ISBN 978-0-7695-3502-9. S2CID 6505449.
- ^ a b c Liu, Fei Tony; Ting, Kai Ming; Zhou, Zhi-Hua (December 2008). "Isolation-Based Anomaly Detection". ACM Transactions on Knowledge Discovery from Data. 6: 3:1–3:39. doi:10.1145/2133360.2133363. S2CID 207193045.
- ^ a b c d e Liu, Fei Tony; Ting, Kai Ming; Zhou, Zhi-Hua (September 2010). "On Detecting Clustered Anomalies Using SCiForest". Joint European Conference on Machine Learning and Knowledge Discovery in Databases - ECML PKDD 2010: Machine Learning and Knowledge Discovery in Databases. Lecture Notes in Computer Science. 6322: 274–290. doi:10.1007/978-3-642-15883-4_18. ISBN 978-3-642-15882-7.
- ^ Dilini Talagala, Priyanga; Hyndman, Rob J.; Smith-Miles, Kate (12 Aug 2019). "Anomaly Detection in High Dimensional Data". arXiv:1908.04000 [stat.ML].
- ^ Shaffer, Clifford A. (2011). Data structures & algorithm analysis in Java (3rd Dover ed.). Mineola, NY: Dover Publications. ISBN 9780486485812. OCLC 721884651.
- ^ Verbus, James (13 August 2019). "Detecting and preventing abuse on LinkedIn using isolation forests". LinkedIn Engineering Blog. Retrieved 2023-07-02.
- ^ Hariri, Sahand; Kind, Matias Carrasco; Brunner, Robert J. (April 2021). "Extended Isolation Forest". IEEE Transactions on Knowledge and Data Engineering. 33 (4): 1479–1489. arXiv:1811.02141. doi:10.1109/TKDE.2019.2947676. ISSN 1558-2191. S2CID 53236735.
- ^ Cortes, David (2019). "Distance approximation using Isolation Forests". arXiv:1910.12362 [stat.ML].