Beginning Anomaly Detection Using

IURP

VNOHDUQPHWULFV

LPSRUW

URFBDXFBVFRUH

DQRPDOLHV DQRPDO\BVFRUHV!

PDWFKHV \BYDO  

OLVW

HQFRGHGFODVVHVB LQGH[ QRUPDO

DXF URFBDXFBVFRUH DQRPDOLHVPDWFKHV

SULQW

$8&^`IRUPDW  DXF

Figure 2-24.  Classifying anomalies based on a threshold that you picked from a 

graph and generating the AUC score from that set of labels for each point

Figure 2-25.  The generated AUC score after running the code

Chapter 2   traditional Methods of anoMaly deteCtion

---

50

You should get a graph like Figure 

2-27

.

There is a similar pattern of what appear to be anomalous data to the left of -0.15. 

Again, assume that there are expected outliers, and pick any average path length less 

than -0.19 as the cutoff for anomalies.

Run the code in Figure 

2-28

.

DQRPDO\BVFRUHVBWHVW LVRODWLRQBIRUHVWGHFLVLRQBIXQFWLRQ [BWHVW

SOWILJXUH ILJVL]H 

SOWKLVW DQRPDO\BVFRUHVBWHVWELQV 

SOW[ODEHO $YHUDJH3DWK/HQJWKV IRQWVL]H 

SOW\ODEHO 1XPEHURI'DWD3RLQWV IRQWVL]H 

SOWVKRZ

Figure 2-26.  Creating a histogram like in Figure 

2-23

 for the testing set instead of 

the validation set

Figure 2-27.  A histogram like in Figure 

2-23

, but for the testing set

Chapter 2   traditional Methods of anoMaly deteCtion

---

51

It should look like Figure 

2-29

.

That’s really good! It seems to perform very well on both the validation data and the 

test data.

Hopefully by now you will have gained a better understanding of what an isolation 

forest is and how to apply it. Remember, an isolation forest works well for multi- 

dimensional data (in this case, you had 41 columns after dropping the service column) 

and can be used for