基于k近邻隔离森林的异常检测  

Anomaly Detection Based on k-nearest Neighbor Isolation Forest

作　　者：丁鹏霖 DING Peng-Lin(College of Computer and Cyber Security,Fujian Normal University,Fuzhou 350117,China)

机构地区：[1]福建师范大学计算机与网络空间安全学院,福州350117

出　　处：《计算机系统应用》2023年第2期199-206,共8页Computer Systems & Applications

基　　金：国家自然科学基金(61772004);福建省科技计划重大项目(2020H6011);福建省自然科学基金(2020J01161)。

摘　　要：异常检测是机器学习与数据挖掘的热点研究领域之一,主要应用于故障诊断、入侵检测、欺诈检测等领域.当前已有很多有效的相关研究工作,特别是基于隔离森林的异常检测方法,但在处理高维数据时仍然存在许多困难.提出了一种新的k近邻隔离森林的异常检算法:k-nearest neighbor based isolation forest(KNIF).该方法采用超球体作为隔离工具,利用第k近邻的方法来构建隔离森林,并构建基于距离的异常值计算方法.通过充分实验表明KNIF方法能有效地进行复杂分布环境下的异常检测,并能适应不同分布形式的应用场景.Anomaly detection is one of the research focuses in machine learning and data mining,which is mainly used in fault diagnosis,intrusion detection,and fraud detection.There have been many effective related studies,especially those of the anomaly detection method based on isolation forest,but there are still many difficulties in the processing of highdimensional data.A new anomaly detection algorithm,k-nearest neighbor based isolation forest(KNIF),is proposed.The method uses hyperspheres as an isolation tool,utilizes the k-nearest neighbor method to construct an isolation forest,and constructs a distance-based outlier calculation method.Sufficient experiments show that the KNIF method can effectively detect anomalies in complex distribution environments and can adapt to application scenarios of different distribution forms.

关 键 词：异常检测 隔离森林 K近邻 超球体 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程] TP311.13[自动化与计算机技术—控制科学与工程]