Random Partitioning Forest for Point-Wise and Collective Anomaly
  Detection -- Application to Intrusion Detection
  In this paper, we propose DiFF-RF, an ensemble approach composed of random
partitioning binary trees to detect point-wise and collective (as well as
contextual) anomalies. Thanks to a distance-based paradigm used at the leaves
of the trees, this semi-supervised approach solves a drawback that has been
identified in the isolation forest (IF) algorithm. Moreover, taking into
account the frequencies of visits in the leaves of the random trees allows to
significantly improve the performance of DiFF-RF when considering the presence
of collective anomalies. DiFF-RF is fairly easy to train, and excellent
performance can be obtained by using a simple semi-supervised procedure to
setup the extra hyper-parameter that is introduced. We first evaluate DiFF-RF
on a synthetic data set to i) verify that the limitation of the IF algorithm is
overcome, ii) demonstrate how collective anomalies are actually detected and
iii) to analyze the effect of the meta-parameters it involves. We assess the
DiFF-RF algorithm on a large set of datasets from the UCI repository, as well
as two benchmarks related to intrusion detection applications. Our experiments
show that DiFF-RF almost systematically outperforms the IF algorithm, but also
challenges the one-class SVM baseline and a deep learning variational
auto-encoder architecture. Furthermore, our experience shows that DiFF-RF can
work well in the presence of small-scale learning data, which is conversely
difficult for deep neural architectures. Finally, DiFF-RF is computationally
efficient and can be easily parallelized on multi-core architectures.
