Active Learning-based Isolation Forest (ALIF): Enhancing Anomaly Detection in Decision Support Systems
This work addresses the need for more effective anomaly detection in Decision Support Systems, offering a practical solution for security and reliability applications, though it is incremental as it builds on existing Isolation Forest methods.
The paper tackles the problem of detecting domain-specific anomalies without fully labeled datasets by proposing ALIF, an active learning-based modification of Isolation Forest, which reduces required labels and improves detection performance across multiple real datasets.
The detection of anomalous behaviours is an emerging need in many applications, particularly in contexts where security and reliability are critical aspects. While the definition of anomaly strictly depends on the domain framework, it is often impractical or too time consuming to obtain a fully labelled dataset. The use of unsupervised models to overcome the lack of labels often fails to catch domain specific anomalies as they rely on general definitions of outlier. This paper suggests a new active learning based approach, ALIF, to solve this problem by reducing the number of required labels and tuning the detector towards the definition of anomaly provided by the user. The proposed approach is particularly appealing in the presence of a Decision Support System (DSS), a case that is increasingly popular in real-world scenarios. While it is common that DSS embedded with anomaly detection capabilities rely on unsupervised models, they don't have a way to improve their performance: ALIF is able to enhance the capabilities of DSS by exploiting the user feedback during common operations. ALIF is a lightweight modification of the popular Isolation Forest that proved superior performances with respect to other state-of-art algorithms in a multitude of real anomaly detection datasets.