保留正文与补采附件。源页面当前未重新核验；具体限制见交付清单。

Revisit consent button We value your privacy We use cookies to enhance your browsing experience, serve personalised ads or content, and analyse our traffic. By clicking "Accept All", you consent to our use of cookies. Customise Reject All Accept All Customise Consent Preferences We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below. The cookies that are categorised as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site. ... Show more NecessaryAlways Active Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

Functional Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

Analytics Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

Performance Performance cookies are used to understand and analyse the key performance indexes of the website which helps in delivering a better user experience for the visitors.

Advertisement Advertisement cookies are used to provide visitors with customised advertisements based on the pages you visited previously and to analyse the effectiveness of the ad campaigns.

Uncategorised Other uncategorised cookies are those that are being analysed and have not been classified into a category as yet. No cookies to display. Reject All Save My Preferences Accept All Toggle SearchToggle Mobile Navigation Publish AI, ML & data-science insights to a global community of data professionals. Sign inSubmit an Article LatestEditor's PicksNewsletterShipAI

Write For TDS LinkedInXToggle Search

Ensemble Learning for Anomaly Detection

A dive into the isolation forest model to detect anomalies in time-series data. Alex Davis October 30, 20247 min read

A dive into the isolation forest model to detect anomalies in time-series data

Anomaly detection is a must-have capability for any organization. By detecting anomalies and outliers, we not only identify data that seems suspicious (or possibly wrong), but can also establish what 'normal' data looks like. Anomaly detection can prove to be a vital capability for a strong data governance system by identifying data errors. And for analysis, outliers can be a point of interest in certain cases such as fraud detection and predictive maintenance. However, as data grows, anomaly detection can prove more and more difficult. High-dimensional data comes with noise and makes it difficult to use for analysis and insights. Large datasets are also likely to have errors and/or special cases. Thankfully, ensemble learning brings speed and efficiency to help us wrangle high-dimensional data and detect anomalies.

What is ensemble learning?

Ensemble learning is a machine learning technique that combines the predictions from multiple individual models to obtain a better predictive performance than any single model. Each model is considered a "weak learner" and is trained on a small subset of the data to make a prediction. Then it goes to a vote. Each weak learner is surveyed and the majority vote wins for the final prediction. Image by Wikimedia Commons https://commons.wikimedia.org/wiki/File:Random_forest_explain.png Image by Wikimedia Commons (https://commons.wikimedia.org/wiki/File:Random_forest_explain.png) Ensemble models (trained on high-quality data) are robust, accurate, efficient, and are good at avoiding overfitting. They have many use cases such as classification, optimization, and in our case, anomaly detection.

The Isolation Forest Model

The isolation forest model is an ensemble of trees that isolates observations that are few and far between. It is very similar to the popular 'Random Forest' model, but instead of a forest of decision trees, the isolation forest produces a forest of 'isolation trees'. So how does it work? Let's look at one isolation tree. Image by the author Image by the author Consider the data above. We can see that one data point is farther away from the rest of the data (our suspected anomaly). Each isolation tree randomly chooses a 'split value' to begin to isolate observations. In this case, the suspected outlier is immediately isolated. This would be the case for most of the isolation trees due to its distance from the rest of the data. Image by the author Image by the author Next, it chooses another split. This time, the suspected 'normal' data begins to get cut up. This process repeats until each observation is isolated. Ultimately, the model 'isolates' observations by randomly selecting a feature and then randomly selecting a split value between the maximum and minimum values of the selected feature. Image by the author Image by the author Now that each observation is isolated, we need to ask: How many splits did it take for each observation to be isolated? In other words, how long is the partition path for each data point? Let's say the results are the following: Image by the author Image by the author Now that we know how many splits it took to isolate each observation, we calculate the mean number of splits. In our example, on average, it takes 2.6 splits to isolate an observation. Observations that have a noticeably shorter partition path, or took noticeably less splits to be isolated, are highly likely to be anomalies or outliers. The degree to which they differ from the mean number of splits is a parameter in the model. Finally, the isolation tree determines the observation G is an anomaly. The last step of the isolation forest model is for each isolation tree to 'vote' on which observations are anomalies. If a majority of them think that observation G is an anomaly, then the model determines that it is.

Detecting Anomalies in Time Series Data

Lets see a simple example using the isolation forest model to detect anomalies in time-series data. Below, we have imported a sales data set that contains the day of an order, information about the product, geographical information about the customer, and the amount of the sale. To keep this example simple, lets just look at one feature (sales) over time. See data here:https://www.kaggle.com/datasets/rohitsahoo/sales-forecasting (GPL 2.0) python

#packages for data manipulation
import pandas as pd
from datetime import datetime

#packages for modeling
from sklearn.ensemble import IsolationForest

#packages for data visualization
import matplotlib.pyplot as plt

python

#import sales data
sales = pd.read_excel("Data/Sales Data.xlsx")

#subset to date and sales
revenue = sales[['Order Date', 'Sales']]
revenue.head()

Image by the author Image by the author As you can see above, we have the total sale amount for every order on a particular day. Since we have a sufficient amount of data (4 years worth), let's try to detect months where the total sales is either noticeably higher or lower than the expected total sales. First, we need to conduct some preprocessing, and sum the sales for every month. Then, visualize monthly sales. python

#format the order date to datetime month and year
revenue['Order Date'] = pd.to_datetime(revenue['Order Date'],format='%Y-%m').dt.to_period('M')

#sum sales by month and year
revenue = revenue.groupby(revenue['Order Date']).sum()

#set date as index
revenue.index = revenue.index.strftime('%m-%Y')

python

#set the fig size
plt.figure(figsize=(8, 5))

#create the line chart
plt.plot(revenue['Order Date'],
         revenue['Sales'])

#add labels and a title
plt.xlabel('Moth')
plt.ylabel('Total Sales')
plt.title('Monthly Sales')

#rotate x-axis labels by 45 degrees for better visibility
plt.xticks(rotation = 90)

#display the chart
plt.show()

Image by the author Image by the author Using the line chart above, we can see that while sales fluctuates from month-to-month, total sales trends upward over time. Ideally, our model will identify months where total sales fluctuates more that expected and is highly influential to our overall trend. Now we need to initialize and fit our model. The model below uses the default parameters. I have highlighted these parameters as they are the most important to the model's performance.

python

#set isolation forest model and fit to the sales
model = IsolationForest(n_estimators = 100, max_samples = 'auto', contamination = float(0.1), max_features = 1.0)
model.fit(revenue[['Sales']])

Next, lets use the model to display the anomalies and their anomaly score. The anomaly score is the mean measure of normality of an observation among the base estimators. The lower the score, the more abnormal the observation. Negative scores represent outliers, positive scores represent inliers. python

#add anomaly scores and prediction
revenue['scores'] = model.decision_function(revenue[['Sales']])
revenue['anomaly'] = model.predict(revenue[['Sales']])

Image by the author Image by the author Lastly, lets bring up the same line chart from before, but highlighting the anomalies with plt.scatter. Image by the author Image by the author The model appears to do well. Since the data fluctuates so much month-to-month, a worry could be that inliers would get marked as anomalies, but this is not the case due to the bootstrap sampling of the model. The anomalies appear to be the larger fluctuations where sales deviated from the trend a 'significant' amount. However, knowing the data is important here as some of the anomalies should come with a caveat. Let's look at the first (February 2015) and last (November 2018) anomaly detected. At first, we see that they both are large fluctuations from the mean. However, the first anomaly (February 2015) is only our second month of recording sales and the business may have just started operating. Sales are definitely low, and we see a large spike the next month. But is it fair to mark the second month of business an anomaly because sales were low? Or is this the norm for a new business? For our last anomaly (November 2018), we see a huge spike in sales that appears to deviate from the overall trend. However, we have run out of data. As data continues to be recorded, it may not have been an anomaly, but perhaps an identifier of a steeper upwards trend.

Conclusion

In conclusion, anomaly detection is a must-have capability for both strong data governance and rigorous analysis. While detecting outliers and anomalies in large data can be difficult, ensemble learning methods can help as they are robust and efficient with large, tabular data. The isolation forest model detects these anomalies by for using a forest of 'weak learners' to isolate observations that are few and far between.

I hope you have enjoyed my article! Please feel free to comment, ask questions, or request other topics.

Register Now to Continue Reading

Unlock Towards Data Science with a Free Account

All articles on Towards Data Science are available to registered users. Create a free account today to access this article and thousands more. Register for freeSign in to your account

Written By

Alex Davis

See all from Alex Davis Anomaly DetectionEnsemble LearningGetting StartedOutliersPython Share This Article

Towards Data Science is a community publication. Submit your insights to reach our global audience and earn through the TDS Author Payment Program. Write for TDS

Related Articles

Dramatically Improve Your Exploratory Data Analysis (EDA)

Data Science CRASH COURSE ON EXPLORATORY DATA ANALYSIS IN PYTHON TheDataProf February 15, 20218 min read

How to create a real-time Face Detector

Machine Learning using Python, TensorFlow/Keras and OpenCV Dmytro Nikolaiev (Dimid) September 20, 202115 min read

How to use trending Twitter Hashtags and Google Keywords in 2020 to build word clouds

Data Visualization We will be building a Streamlit Web App to showcase a word cloud of Trending Google Keywords and Twitter Hashtags in 2020 Rahul Banerjee December 30, 20207 min read

Mastering Synchronization Primitives in Python Asyncio: A Comprehensive Guide

Data Science Best practices for asyncio.Lock, asyncio.Semaphore, asyncio.Event and asyncio.Condition Peng Qian May 29, 20237 min read

Support Vector Machines under the hood

Artificial Intelligence An advanced explanation (Classification tasks) - Part 1 Christos Theodoropoulos December 21, 20209 min read

The Comprehensive Guide to Moving Averages in Time Series Analysis

Data Science Exploring the Nuances of Simple Moving Averages and Exponentially Weighted Moving Averages Eryk Lewinson October 30, 20239 min read

Three Common Data Analysis Operations with Three Common Tools

Programming Pandas, data.table and SQL Soner Yıldırım October 13, 20225 min read

How To Test If a Function Throws An Exception in Python

Machine Learning Writing test cases to verify that functions raise Exceptions with the expected messages Giorgos Myrianthous October 11, 20223 min read

Why Is The Log-uniform Distribution Useful For Hyperparameter Tuning?

Machine Learning Improve your grid search with this small change Eryk Lewinson March 14, 20226 min read

Your home for data science and AI. The world's leading publication for data science, data analytics, data engineering, machine learning, and artificial intelligence professionals. Subscribe to Our NewsletterWrite For TDS•About•Advertise•Privacy Policy•Terms of Use © Insight Media Group, LLC 2026•The New Stack•roadmap.sh•Creator Network

Recommended Articles

Close