Beginning Anomaly Detection Using

 Anomaly Detection with Isolation Forest

Now that you understand more about how an isolation forest works, you can move on to 

applying it to a data set. Before you start, it is important to note that an isolation forest 

performs well on high-dimensional data. For the invasive fish example, you had three 

features to work with: fish length, circumference, and proportion of tail fin length to 

overall length. In this next example, you will have 42 features per data entry.

You will use the KDDCUP 1999 data set, which contains an extensive amount of 

data representing a wide variety of intrusion attacks. In particular, you will focus on all 

data entries that involve an HTTP attack. The data set can be found at 

http://kdd.ics.

uci.edu/databases/kddcup99/kddcup99.html

. After opening the link, you should see 

something like Figure 

2-9

.

Chapter 2   traditional Methods of anoMaly deteCtion

---

37

Download the kddcup.data.gz file and extract it.

There shouldn’t be any issues with version mismatch and code functionality, but just 

in case, the exact Python 3 packages used in this example are as follows:

•  numpy 1.15.3

•  pandas 0.23.4

•  scikit-learn 0.19.1

•  matplotlib 2.2.2

First, import all the necessary modules that your code calls upon (Figure 

2-10

).

Figure 2-9.  This is what you should see when you open the link

Chapter 2   traditional Methods of anoMaly deteCtion

---

38

The module