RIFT improves anomaly detection with tree-based geometry method
RIFT: Relative Isolation From Trees For Anomaly Detection
Machine Learning
Summary
Detecting unusual or rare data points, called anomalies, is important in many fields. This paper introduces RIFT, a method that uses a tree structure to measure how isolated each point is. Unlike some previous methods, RIFT does this in a way that works well for both simple and complex data without relying on random choices. The authors show that RIFT performs about as well as established methods but with more stable results across tries.
What this means in practice
- •For data engineers: Detect unusual patterns in large datasets with a method that reduces randomness and handles complex data shapes robustly.
- •For fraud detection teams: Identify fraudulent transactions by scoring data points using tree-based relationships that better capture varied transaction behaviors.
Authors
Mark Daniel Szalai, Gabor Horvath
Abstract
Isolation Forest (IF) is a widely used baseline for unsupervised anomaly detection. Recent studies provide a closed-form expression for the infinite-forest limit for one-dimensional data. Inspired by the geometric interpretation of this formula, we introduce RIFT (Relative Isolation From Trees), a deterministic anomaly detection method that generates the minimum spanning tree and scores each point by the sum of the apparent sizes of tree edges as viewed from that point. For one-dimensional data, the RIFT score recovers the closed-form IF limit exactly. In higher dimensions, it provides a parameter-free generalization that is deterministic, robust to varying density and clustered anomalies and avoids the axis-parallel artifacts of IF. We further propose an ensemble variant for large datasets. Experiments on synthetic data and the ADBench benchmark demonstrate that the accuracy is comparable to IF, while the ensemble variant exhibits significantly lower variance across random seeds.