Next Article in Journal
A Control-Oriented ANFIS Model of Evaporator in a 1-kWe Organic Rankine Cycle Prototype
Next Article in Special Issue
A Novel Approach for Network Intrusion Detection Using Multistage Deep Learning Image Recognition
Previous Article in Journal
Efficiently Mastering the Game of NoGo with Deep Reinforcement Learning Supported by Domain Knowledge
Previous Article in Special Issue
Botnet Attack Detection Using Local Global Best Bat Algorithm for Industrial Internet of Things
Article

On the Improvement of the Isolation Forest Algorithm for Outlier Detection with Streaming Data

1
Department of Computer Science and Engineering, Faculty of Applied Sciences, University of West Bohemia, Technická 8, 301 00 Plzeň, Czech Republic
2
Institute ProtectIT, Faculty of Computer Science, Deggendorf Institute of Technology, Dieter-Görlitz-Platz 1, 94469 Deggendorf, Germany
*
Author to whom correspondence should be addressed.
Academic Editors: Constantinos Kolias, Georgios Kambourakis and Weizhi Meng
Electronics 2021, 10(13), 1534; https://doi.org/10.3390/electronics10131534
Received: 18 May 2021 / Revised: 16 June 2021 / Accepted: 21 June 2021 / Published: 24 June 2021
(This article belongs to the Special Issue Design of Intelligent Intrusion Detection Systems)
In recent years, detecting anomalies in real-world computer networks has become a more and more challenging task due to the steady increase of high-volume, high-speed and high-dimensional streaming data, for which ground truth information is not available. Efficient detection schemes applied on networked embedded devices need to be fast and memory-constrained, and must be capable of dealing with concept drifts when they occur. Different approaches for unsupervised online outlier detection have been designed to deal with these circumstances in order to reliably detect malicious activity. In this paper, we introduce a novel framework called PCB-iForest, which generalized, is able to incorporate any ensemble-based online OD method to function on streaming data. Carefully engineered requirements are compared to the most popular state-of-the-art online methods with an in-depth focus on variants based on the widely accepted isolation forest algorithm, thereby highlighting the lack of a flexible and efficient solution which is satisfied by PCB-iForest. Therefore, we integrate two variants into PCB-iForest—an isolation forest improvement called extended isolation forest and a classic isolation forest variant equipped with the functionality to score features according to their contributions to a sample’s anomalousness. Extensive experiments were performed on 23 different multi-disciplinary and security-related real-world datasets in order to comprehensively evaluate the performance of our implementation compared with off-the-shelf methods. The discussion of results, including AUC, F1 score and averaged execution time metric, shows that PCB-iForest clearly outperformed the state-of-the-art competitors in 61% of cases and even achieved more promising results in terms of the tradeoff between classification and computational costs. View Full-Text
Keywords: intrusion detection; outlier detection; streaming data; network security; online learning; unsupervised learning; machine learning intrusion detection; outlier detection; streaming data; network security; online learning; unsupervised learning; machine learning
Show Figures

Figure 1

MDPI and ACS Style

Heigl, M.; Anand, K.A.; Urmann, A.; Fiala, D.; Schramm, M.; Hable, R. On the Improvement of the Isolation Forest Algorithm for Outlier Detection with Streaming Data. Electronics 2021, 10, 1534. https://doi.org/10.3390/electronics10131534

AMA Style

Heigl M, Anand KA, Urmann A, Fiala D, Schramm M, Hable R. On the Improvement of the Isolation Forest Algorithm for Outlier Detection with Streaming Data. Electronics. 2021; 10(13):1534. https://doi.org/10.3390/electronics10131534

Chicago/Turabian Style

Heigl, Michael, Kumar A. Anand, Andreas Urmann, Dalibor Fiala, Martin Schramm, and Robert Hable. 2021. "On the Improvement of the Isolation Forest Algorithm for Outlier Detection with Streaming Data" Electronics 10, no. 13: 1534. https://doi.org/10.3390/electronics10131534

Find Other Styles
Note that from the first issue of 2016, MDPI journals use article numbers instead of page numbers. See further details here.

Article Access Map by Country/Region

1
Back to TopTop