IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, VOL. 33, NO.

4, APRIL 2021 1479

Extended Isolation Forest

Sahand Hariri , Matias Carrasco Kind , and Robert J. Brunner

Abstract—We present an extension to the model-free anomaly detection algorithm, Isolation Forest. This extension, named Extended
Isolation Forest (EIF), resolves issues with assignment of anomaly score to given data points. We motivate the problem using heat
maps for anomaly scores. These maps suffer from artifacts generated by the criteria for branching operation of the binary tree. We
explain this problem in detail and demonstrate the mechanism by which it occurs visually. We then propose two different approaches
for improving the situation. First we propose transforming the data randomly before creation of each tree, which results in averaging out
the bias. Second, which is the preferred way, is to allow the slicing of the data to use hyperplanes with random slopes. This approach
results in remedying the artifact seen in the anomaly score heat maps. We show that the robustness of the algorithm is much improved
using this method by looking at the variance of scores of data points distributed along constant level sets. We report AUROC and
AUPRC for our synthetic datasets, along with real-world benchmark datasets. We find no appreciable difference in the rate of
convergence nor in computation time between the standard Isolation Forest and EIF.

Index Terms—Anomaly detection, isolation forest

1 INTRODUCTION
the age of big data and high volume information, anom- Those samples that travel deeper into the tree branches
I N
aly detection finds many areas of application, including
network security, financial data, medical data analysis, and
are less likely to be anomalous, while shorter branches are
indicative of anomaly. As such, the aggregated lengths of
discovery of celestial events from astronomical surveys, the tree branches provide for a measure of anomaly or an
among many more. The need for reliable and efficient algo- “anomaly score” for every given point. However, before
rithms is plentiful, and there are many techniques that have using this anomaly score for processing of data, there are
been developed over the years to address this need includ- issues with the standard Isolation Forest algorithm that
ing multivariate data [15] and more recently, streaming need to be addressed.
data with need for updates on data with missing variables It turns out that while the algorithm is computationally
[14]. For a survey in research in anomaly detection see [3], efficient, it suffers from a bias that arises because of the
[6]. Among the different anomaly detection algorithms, way the branching of the trees takes place. In this paper
Isolation Forest [9], [11] is one with unique capabilities. we study this bias and discuss where it comes from and
It is a model free algorithm that is computationally efficient, what effects it has on the anomaly score of a given data
can easily be adapted for use with parallel computing point. We further introduce an extension to the Isolation
paradigms [7], and has been proven to be very effective Forest, named Extended Isolation Forest (EIF), that reme-
in detecting anomalies [16]. The main advantage of the dies this shortcoming. While the basic idea is similar
algorithm is that it does not rely on building a profile for to the Isolation Forest, the details of implementation are
data in an effort to find nonconforming samples. Rather, modified to accommodate a more general approach.
it utilizes the fact that anomalous data are “few and As we will see later, the proposed extension relies on the
different”. Most anomaly detection algorithms find anoma- use of hyperplanes with random slopes (non-axis-parallel)
lies by understanding the distribution of their properties for splitting the data in creating the binary search trees. The
and isolating them from the rest of normal data samples [4], idea of using hyperplanes with random slopes in the con-
[5], [13]. In an Isolation Forest, data is sub-sampled, and text of Isolation Forest with random choice of the slope is
processed in a tree structure based on random cuts in mentioned in [10]. However, the main focus there is to find
the values of randomly selected features in the dataset. optimal slicing planes in oder to detect clustered anomalies.
No further discussion on developing this method, or why it

S. Hariri is with the Department of Mechanical Science and Engineering, might benefit the algorithm is presented. The methods for
University of Illinois at Urbana-Champaign, Champaign, IL 61820 USA. choosing random slopes for hyperplanes, the effects of these
E-mail: sahandha@gmail.com. choices on the algorithm, and the consequences of this,

M. Carrasco Kind is with the National Center for Supercomputing Applica-
tions, University of Illinois at Urbana-Champaign, Champaign, IL 61820
especially in higher dimensional data, are also omitted.
USA. E-mail: mcarras2@illinois.edu. Using oblique hyperplanes in tree based methods has also

R. J. Brunner is with the Gies College of Business, University of Illinois at been studied in random forests [12] but again, not in the
Urbana-Champaign, Champaign, IL 61820 USA. E-mail: bigdog@illinois.edu. context of Isolation Forest. An approach to anomaly detec-
Manuscript received 3 Nov. 2018; revised 15 June 2019; accepted 2 Oct. 2019. tion which utilizes the concept of isolation is presented in
Date of publication 31 Oct. 2019; date of current version 5 Mar. 2021. [1], [2] where a nearest neighbor algorithm instead of a tree
(Corresponding author: Sahand Hariri.)
Recommended for acceptance by E. Keogh. based method is used for isolating data points. While this
Digital Object Identifier no. 10.1109/TKDE.2019.2947676 algorithm performs better than the Isolation Forest by
This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/
1480 IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, VOL. 33, NO. 4, APRIL 2021

Fig. 1. Data and anomaly score map produced by Isolation Forest for two Fig. 2. Data points and anomaly score maps of two clusters of normally
dimensional normally distributed points with zero mean and unity covari- distributed points.
ance matrix. Darker areas indicate higher anomaly scores.

distribution with zero mean vector and covariance given by

various metrics, and while the problem of the isolation for-
the identity matrix. It is immediately obvious that a data
est discussed here is remedied because of the fundamen-
point should be considered nominal if it falls somewhere
tally different nature of achieving isolation, a discussion of
close to (0,0). However, as the data points move away from
what the causes of the problem with Isolation Forest is miss-
the origin, their anomaly scores should increase. Therefore
ing. Here we show one can achieve better performance by
we expect to see an anomaly score map with an almost cir-
adjusting the algorithm and utilizing the tree based nature
cular and symmetric pattern with increasing values as we
of the algorithm without having to resort to fundamentally
move radially outward.
different algorithms such as nearest neighbor.
Fig. 1b shows the anomaly score map obtained using the
As such, and perhaps most importantly, to the best of our
standard Isolation Forest. We sample points uniformly
knowledge, there is no discussion of the shortcomings of
within the range of the plot and assign scores to those points
standard Isolation Forest as an anomaly detection algorithm
based on the trees created for the forest. We can clearly see
in literature. Here we present an insightful review and show
that the points in the center get the lowest anomaly score,
the need for an improvement on the algorithm based on heat
and as we move radially outward, the score values increase.
maps for anomaly scores, henceforth simply referred to as
However, we also observe rectangular regions of lower
score maps. We discuss the sources of the problem in great
anomaly score in the x and y directions, compared to other
detail, and what consequences these shortcomings bear. The
points that fall roughly at the same radial distance from the
importance of improving the algorithm comes to shine when
center. Based on our understanding of how the data is dis-
we need to identify anomalies in regions where it is not
tributed, the score map should maintain an approximately
immediately obvious whether a point is anomalous or not.
circular shape for all radii, i.e., similar score values for fixed
Robust score maps are needed in assigning probabilities for
distances from the origin. As we will see in later sections,
given data points in terms of being anomalies.
the difference in the anomaly score in the x and y directions
This paper is divided into five sections. Section 2 provides
are indeed an artifacts introduced by the algorithm. It is crit-
some examples that motivate this study. In Section 3 we
ical to fix this issue for a precise and robust anomaly detec-
lay out the extension to the algorithm and present its applica-
tion algorithm. One example of potential problems caused
tion to higher dimensional datasets. In Section 4 we com-
by this artifact is that depending on the threshold of score to
pare the results obtained by the Extended Isolation Forest to
label a data point an anomaly, two data points of similar
those of standard Isolation Forest, using score maps, and var-
importance can get categorized differently, which reduces
iance plots. Additionally, we compare rates of convergence
the reliability of the algorithm. Another example might be
between the two methods. We also present a comparison of
the case where the user wants to obtain probability density
AUROC and AUPRC for the two algorithms. Lastly, we close
functions for distribution of data points based on their
with some concluding remarks in Section 5. Discussion is
anomaly scores. In this case, the results shown in Fig. 1 can
provided throughout the various sections in the paper.
certainly not be relied upon for accurate representation of
anomaly score distributions.
2 MOTIVATION A second example is shown in Fig. 2. Here we have two
Given a dataset, we would like to be able to train our Isola- separate clusters of normally distributed data concentrated
tion Forest so that it can assign an anomaly score for each of around (0,10) and (10,0). We expect very low anomaly scores
the data points, rank them, and help draw conclusions at the centers of the blobs, and higher scores elsewhere.
about the distribution of anomalies as well as the nominal The anomaly score map clearly shows the two cluster
points. A closer look at scores produced by Isolation Forest locations and the scores distributed around them, where we
however, reveals that these anomaly scores are inconsistent can see a concentration of lower scores near the center of
and need some work. the clusters and higher values further away. Not surpris-
The best way to see the problem is to examine very sim- ingly we still observe the same artifacts as in Fig. 1 shown
ple datasets where we have an intuition of how the scores as rectangular bands aligned with the cluster centers. More-
should be distributed and what constitutes an anomaly. over, we also see that this artifact is amplified at the inter-
Consider the dataset shown in Fig. 1a. This is a two dimen- section of the bands, close to (0,0) and (10,10) where we
sional random dataset sampled from a 2-D normal observe “ghost” clusters. This introduces a real problem. In
HARIRI ET AL.: EXTENDED ISOLATION FOREST 1481

Fig. 3. Data with a sinusoidal structure and the anomaly score map.
Fig. 4. Schematic representation of a single tree (a) and a forest (b)
this case, if we observed an anomalous data point that hap- where each tree is a radial line from the center to the outer circle. Red
pened to lie near the origin, the algorithm would most likely represents an anomaly while blue represents a nominal point.
categorize it as a nominal point. Given the nature of these
artifacts it is clear that these results cannot be fully trusted is assigned based on the depth the point reaches in each tree
for more complex data point distributions where this effect as shown in Fig. 4.
is enhanced. Not only does this increase the chances of false Fig. 4a shows a single tree after training. The red line
positives, it also wrongly indicates a non-existent structure depicts the trajectory of a single anomalous point traveling
in the data. down the tree, while the blue line shows that of a nominal
As a third example we will look at a dataset with more point. The anomalous point is isolated very quickly, but the
structure as shown in Fig. 3. nominal point travels all the way to the maximum depth in
In this case the data has an inherent structure, the sinu- this case. In Fig. 4b we can see a full forest for an ensemble
soidal shape with Gaussian noise added on top. It is very of 60 trees. Each radial line represents one tree, while the
important for the algorithm to detect this structure repre- outer circle represents the maximum depth limit. The red
senting a more complex case. However, looking at the lines are trajectories that the single anomalous point has
anomaly score map generated by the standard Isolation For- taken down each tree, and the blue ones show trajectories of
est, we can see that the algorithm performs very poorly. a nominal point. As can be seen, on average, the blue lines
Essentially this data is treated as one large rectangular blob achieve a much larger radius than the red ones. It is on the
with horizontal and vertical bands emanating parallel to the basis of this idea that Isolation Forest is able to separate
coordinate axes as seen before. An anomalous data point anomalies from nominal points.
that is in between two “hills” will get a very low score and Using the two dimensional data from Fig. 1a as a refer-
be categorized as a nominal point. ence, during the training phase, the algorithm will create a
In this work, we will discuss why these undesirable fea- tree by recursively picking a random dimension and com-
tures arise, and how we can fix them using an extension of paring the value of any given point to a randomly selected
the Isolation Forest algorithm. cutoff value for the selected dimension. The data points are
then sent down the left or the right branch according to the
3 GENERALIZATION OF ISOLATION FOREST rules of the algorithm. By creating many such trees, we can
use the average depths of the branches to assign anomaly
3.1 Overview scores. So any newly observed data point can traverse
The general algorithm for Isolation Forest [9], [11] starts down each tree following such trained rules. The average
with the training of the data, which in this case is construc- depth of the branches this data point traverses will be trans-
tion of the trees. Given a dataset of dimension N, the algo- lated to an anomaly score using Equation (1).
rithm chooses a random sub-sample of data to construct a
binary tree. The branching process of the tree occurs by sðx; nÞ ¼ 2EðhðxÞÞ=cðnÞ ; (1)
selecting a random dimension xi with i 2 f1; 2; . . . ; Ng of
the data (a single variable). It then selects a random value v where EðhðxÞÞ is the mean value of the depths a single data
within the minimum and maximum values in that dimen- point, x, reaches in all trees. cðnÞ is the normalizing factor
sion. If a given data point possesses a value smaller than v defined as the average depth in an unsuccessful search in a
for dimension xi , then that point is sent to the left branch, Binary Search Tree (BST):
otherwise it is sent to the right branch. In this manner the
data on the current node of the tree is split in two. This pro- cðnÞ ¼ 2Hðn  1Þ  ð2ðn  1Þ=nÞ; (2)
cess of branching is performed recursively over the dataset
until a single point is isolated, or a predetermined depth where HðiÞ is the harmonic number and can be estimated
limit is reached. The process begins again with a new ran- by lnðiÞ þ 0:5772156649 (Euler’s constant) [11] and n is the
dom sub-sample to build another randomized tree. After number of points used in the construction of trees.
building a large ensemble of trees, i.e., a forest, the training Trees are assigned maximum depth limits as described in
is complete. During the scoring step, a new candidate data [9]. In the case a point runs too deep in the tree, the branch-
point (or one chosen from the data used to create the trees) ing process is stopped and the point is assigned the maxi-
is run through all the trees, and an ensemble anomaly score mum depth value. Fig. 5 shows the branching process
1482 IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, VOL. 33, NO. 4, APRIL 2021

Fig. 6. Branch cuts generated by the standard Isolation Forest during the
training phase. In each step, a random value is selected from a random
feature (dimension). Then the training data points are determined to go
down the left or right branches of the tree based on what side of that line
Fig. 5. 5a shows the branching process for an anomalous data point (red they reside.
point). The branching takes place until the point is isolated. In this case it
only took three random cuts to isolate the point. 5b shows the same
branching process for a nominal point (red point). Since the point is bur- Fig. 3b. It is then evident that regions of similar anomalous
ied deep inside the data, it takes many cuts to isolate the point. In this properties receive very different branching operations
case the depth limit of the tree was reached before the point was throughout the training process.
completely isolated. The numbers on the lines represent the order of
branching process. We propose two different ways of addressing this limita-
tion to provide a much more robust algorithm. In the first
method, the standard Isolation Forest algorithm is allowed
during the training phase for an anomaly and a nominal to run as is, but with a small modification. Each time it picks
example points using the standard Isolation Forest for the a sub-sample of the training data to create a tree, the train-
data depicted in Fig. 1. The numbers on the branching lines ing data has to undergo a random transformation (rotation
represent the order in which they were created. In the case in plane). In this case each tree has to carry the information
of the nominal point, the depth limit was reached since the about this transformation as it will be necessary in the scor-
point is very much at the center of the data and requires ing stage, increasing the bookkeeping. In the second method
many random cuts to be completely isolated. In this case the we modify and generalize the branching process by allow-
random cuts are all either vertical or horizontal. This is ing the branch cuts to occur in random directions with
because of how we define the branching criteria (picking respect the current data points on the tree node. Under this
one dimension at each step). This is also the reason for the perspective, the latter method is the truly general case,
strange behavior we observed in the anomaly score maps of while the former can be considered a special case of this
the previous section. general method. In fact we will show in the rest of the paper
To build intuition for why this is, let’s consider one ran- that the standard Isolation Forest is also a special case of
domly selected, fully grown tree with all its branch rules this general method proposed here. In the following two
and criteria. Fig. 6 shows the branch cuts generated for a sub-sections we explore and present each method.
tree for the three examples we have introduced in Section 2.
Note that in each step, we pick a random feature (dimen-
3.2 Rotated Trees
sion), xi , and a random value, v, for this feature. Naturally,
Before we present the completely general case, we discuss
the branch cuts are simply parallel to the coordinate axes.
rotation of the data in order to minimize the effect of the
But as we move down the branches of the tree and data is
rectangular slicing. In this approach the construction of
divided by these lines, the range of possible values for v
each individual tree takes place using the standard Isolation
decreases and so the lines tend to cluster where most of the
Forest, but before that happens, the sub-sample of the data
data points are concentrated. However, because of the con-
that is used to construct each one of the trees, is rotated in
straint that the branch cuts are only vertical and horizontal,
plane, by a random angle. As such, each tree is “twisted” in
regions that don’t necessarily contain many data points end
a unique way, differently than all the other trees, while
up with many branch cuts through them. In fact Fig. 7 shows
keeping the structure of the data intact. Once the training is
a typical distribution of the only possible branching lines
complete, and a we are computing the scores of the data
(hyperplanes in general) that could possibly be produced. In
points, the same transformation has to take place for each
Fig. 7a, a data point near (4,0) will be subject to many more
tree before the point is allowed to run down the tree
branching operations compared to a point that falls near
(3,3), despite the fact that they are both anomalies with
respect to the center of the dataset. As the number of branch-
ing operations is directly related to the anomaly score, these
two points might end up with very different scores.
The same phenomenon happens in the other two cases,
but it is even worsened as these branch cuts intersect and
form “ghost” cluster regions, e.g., near (0,0) in Fig. 7b as
seen in previous anomaly score maps. Fig. 7c shows an
even more extreme case. The data repeats itself over one fea-
ture many times, and so the branch cuts in one direction are Fig. 7. A typical distribution of the only possible branch cuts. The biased
treatment of various regions in the domain of the data accumulate as
created in a much more biased fashion resulting in an many trees are generated, and as a result, regions of similar anomaly
inability to decipher the structure of the data as we saw in scores are subject to very different scoring possibilities.
HARIRI ET AL.: EXTENDED ISOLATION FOREST 1483

Fig. 9. Branch cuts generated by the Extended Isolation Forest. In each

step, a normal vector, ~n, along with a random intercept point, ~ p, is
selected. A data point, ~x, is determined to go down the left or right
branches of the tree based on the criteria shown in inequality (3).

Fig. 8. Branching process for the Extended Isolation Forest. Fig. 8a

shows the branching process for an anomalous data point. The branch-
horizontal or vertical, and this introduces a bias and artifacts
ing takes place until the point is isolated. In this case it only took three in the anomaly score map. There is no fundamental reason in
random cuts to isolate the point. 8b shows the same branching process the algorithm that requires this restriction, and so at each
for a nominal point. Since the point is near the center of the data, it takes branching point, we can select a branch cut that has a random
many cuts to isolate the point. In this case the depth limit of the tree was
reached before the point was isolated. “slope”. A single branching process for branch cuts with
random slopes in our 2-D example is visualized in Fig. 8
branches. This approach does indeed improve the perfor- for both cases of anomaly and nominal data points, analogous
mance quite a bit as we will see in the results section. to Fig. 5.
With this method, in each case, the same bias exists as Similarly to the standard Isolation Forest algorithm,
before, but only for single trees. Each tree carries with itself anomalies can be isolated very quickly, whereas the nomi-
a different bias. When the aggregate score is computed, the nal points require many branch cuts to be isolated. In the
total sum of the biases is averaged out resulting in a large case of the standard Isolation Forest algorithm, the selection
improvement in score robustness. However, this is not the of the branch cuts requires two pieces of information: 1) a
ideal solution for fixing problems presented above, despite random feature or coordinate, and 2) a random value for
the fact that it seems to produce better results. Some reasons the feature from the range of available values in the data.
as to why this method is less desirable are: For the extended case, the selection of the branch cuts still
only requires two pieces of information, but they are: 1)
1) Each tree has to be tagged with its unique rotation so a random slope for the branch cut, and 2) a random inter-
that when we are scoring observed data, we can cept for the branch cut which is chosen from the range
compensate for the rotation in the coordinates of the of available values of the training data. Notice that this is
data point. simpler than the tree rotations in the previous section,
2) Even though the ensemble results seem good, each because in that case in addition to the two pieces of informa-
tree still suffers from the rectangular bias introduced tion at each branch cut, each tree needs to store the informa-
by the underlying algorithm. In a sense the problem tion for transforming the data so that it can be used in the
is not resolved, but only averaged out. scoring stage.
3) This approach can become cumbersome to apply For an N dimensional dataset, selecting a random slope
especially with large datasets and higher dimensions. for the branch cut is the same as choosing a normal vector,
4) It is prone to simple errors if datasets lack symmetries. n, uniformly over the unit N-Sphere. This can easily be
~
5) The rotation is not obvious in higher dimensions accomplished by drawing a random number for each coor-
than 2-D. For each tree we can pick a random axis in dinate of ~n from the standard normal distribution N ð0; 1Þ
the space and perform planar rotation around that [8]. This results in a uniform selection of points on the
axis, but there are many other choices that can be N-sphere. For the intercept, ~ p, we simply draw from a uni-
made, which might result in inconsistencies among form distribution over the range of values present at each
different runs. branching point. Once these two pieces of information are
6) There is extra bookkeeping and meta data store for determined, the branching criteria for the data splitting for
each tree. a given point ~x is as follows:
A much more robust fix to the problem can be achieved
by truly randomizing the branching process in addition to ð~
x ~
pÞ  ~
n  0; (3)
the randomization already in place. That is, instead of sim-
ply running the Isolation Forest for each tree using a rotated
If the condition is satisfied, the data point ~
x is passed to
sub-sample, we select different angles for the data slices at
the left branch, otherwise it moves down to the right branch.
each branching point.
As we saw in Fig. 8, the branch cuts are drawn with ran-
dom slopes until they isolate the data points, or until the
3.3 Extended Isolation Forest depth limit is reached. Fig. 9 is analogous to Fig. 6. The
Isolation Forest relies on randomness in selection of features branch cuts are shown for training of a single tree. We note
and values. Since anomalous points are “few and different”, that despite the randomness of the process, higher density
they quickly stand out with respect to these random selec- points are better represented schematically in comparison
tions. But as we have seen, the branch cuts are always either with Fig. 6.
1484 IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, VOL. 33, NO. 4, APRIL 2021

equivalent to the standard Isolation Forest algorithm. At

each branching step we essentially have one active coordi-
nate or feature over which a random value is selected to
slice the training data. See Fig. 11
So for any given N dimensional dataset, the lowest level
of extension of the Extended Isolation Forest is coincident
with the standard Isolation Forest. As the extension level of
the algorithm is increased, the bias of the algorithm is
Fig. 10. A typical distribution of the possible branch cuts for the case of reduced, see Fig. 18 for an example. The idea of having multi-
Extended Isolation Forest. The branch cuts produced can now pass ple levels of extension can be useful in cases where the
through any part of the region free of biases introduced by the coordinate dynamic range of the data in various dimensions are very
axes constraints.
different. In such cases, reducing the extension level can help
in more appropriate selection of split hyperplanes and
Fig. 10 shows typical plots of all the possible branch cuts reducing the computational overhead. As an extreme case, if
that can be produced by the Extended Isolation Forest for we had three dimensional data, but the range in two of the
each of the examples we have considered thus far, similar to dimensions were much smaller compared to the third (essen-
the figures shown in Fig. 7. Unlike the previous case, we tially data distributed along a line), the standard Isolation
can clearly see that branch cuts are possible in all regions of Forest method would probably yield the most optimal result.
the domain regardless of the coordinate axes.
The important property of concentrating where the data
3.5 The Algorithm
is clustered, persists. The intercept points ~
p tend to accumu-
The are few changes to the original algorithm, published in
late where the data is, since the selection of these points gets
[9] which are presented here. Algorithm 1 remains the same
restricted to available data at each branching point as we
which we show for completeness.
move deeper into the tree. This results in more possible
branching options where the data is clustered and fewer
Algorithm 1. iForestðX; t; c)
possible branching where there is less concentration of data.
However, there are no regions that artificially receive more Input: X - input data, t - number of trees, c - sub-sampling size
attention than the rest. The results of this are score maps Output: a set of t iTrees
that are free of artifacts previously observed. 1: Initialize Forests
2: set height limit l ¼ ceilingðlog2 cÞ
3: for i ¼ 1 to t do
3.4 High Dimensional Data and Extension Levels
4: X 0 sampleðX; cÞ
So far we have only been looking at two dimensional data
5: Forest Forest [ iTreeðX 0 ; 0; lÞ
because they are easy to visualize. However, the algorithm
generalizes readily to higher dimensions. In this case, the 6: end for
branch cuts are no longer straight line, but N  1 dimen-
sional hyperplanes. These hyperplanes can still be specified Algorithm 2. iTreeðX; e; l)
with a random normal vector ~ n and a random intercept point Input: X - input data, e - current tree height, l - height limit
p whose selection are identical to that of the two dimensional
~ Output: an iTree
case. The same criteria for branching process specified by 1: if e  l or jXj  1 then
inequality (3) applies to the high dimensional case. 2: return exNodefSize jXjg
It is interesting to note that for an N dimensional dataset 3: else
we can consider N levels of extension. In the fully extended 4: randomly select a normal vector ~ n 2 IRjXj by drawing
case, we select our normal vector by drawing each compo- each coordinate of ~ n from a standard Gaussian
nent from N ð0; 1Þ as seen before. This results in hyperplanes distribution.
that can intersect any of the coordinates axes. For example 5: randomly select an intercept point ~ p 2 IRjXj in the range
in the case of two dimensions, it resulted in oblique lines. of X
However, we can exclude exactly one dimension in specify- 6: set coordinates of ~ n to zero according to extension level
ing the lines so that they are parallel to one of the two coor- 7: Xl filterðX; ðX  ~pÞ  ~
n  0Þ
dinate axes. This is simply accomplished by setting a 8: Xr filterðX; ðX  ~pÞ  ~
n > 0Þ
coordinate of the normal vector to zero, in which case we 9: return inNode fLeft iTreeðXl ; e þ 1; lÞ;
recover the standard Isolation Forest. Right iTreeðXr ; e þ 1; lÞ;
In the case of three dimensional data for example, the Normal n;
~
fully extended case is when the normal vectors are selected Intercept pg
~
so that the hyperplanes (in this case 2-D planes) are allowed 10: end if
to intersect with all three axes. We call that the fully
extended case or 2nd Extension (Ex 2). If we reduce the As mentioned before, the Extended Isolation Forest algo-
extension level by one, the 2-D planes are always parallel to rithm only requires determining two random pieces of
one of the three coordinates, and we call that 1st Extension information at the branching nodes: the normal vector, and
(Ex 1). Reducing the extension yet again, we arrive at 0th the intercept point. In Algorithm 2, we modified the two
extension, which is the case where the random slices are lines that pick a random feature and a random value for
always parallel to two of the axes. This case is identically that feature with lines 4 and 5. In addition to that, we also
HARIRI ET AL.: EXTENDED ISOLATION FOREST 1485

Fig. 11. Sample branch hyperplane for three dimensional data for each Fig. 12. Comparison of the Standard Isolation Forest, Rotated Isolation
level of extension. The case of extension 0 11c is identical to the stan- Forest, and Extended Isolation Forest for the case of the single blob.
dard Isolation Forest.

extending the algorithm. Note that these plots are only pos-
change the test condition to reflect inequality (3). In addi-
sible for two dimensional data, even though it is somewhat
tion, we have added line 6 which has to do with allowing
manageable to visualize these maps and artifacts in 3-D. We
the extension level to change. With these changes, the algo-
will use different metrics in order to analyze higher dimen-
rithm can be used as either the standard Isolation Forest, or
sional data.
as the Extended Isolation Forest with any desired extension
First consider the case of a single blob normally distrib-
level. This extension customization can be useful in cases,
uted in 2-D space. Fig. 12 compares the anomaly score maps
for example, of a complex multidimensional data with low
for all the mentioned methods.
cardinality in one dimension where that feature can be
By comparing Figs. 12a and 12b we can already see a con-
ignored to reduce the introduction of possible selection bias.
siderable difference in the anomaly score map. The rotation
In Algorithm 3, we make the changes accordingly. We
of the sub-sampled data for each tree averages out the arti-
now have to receive the normal and intercept point from
facts and produces a more symmetric map as expected in
each tree, and use the appropriate test condition to set off the
this example. Taking it a step further, we look at the score
recursion for figuring out path length (depth of each branch).
map in Fig. 12c, which was obtained by the Extended Isola-
tion Forest. We can see an anomaly score map as we might
Algorithm 3. PathLengthð~
x; T; eÞ expect for this example. The low score artificial bands in the
Input: ~x - an instance, T - an iTree, e - current path length; to be x and y direction are no longer present and the score
initialized to zero when first called increases roughly monotonically in all directions as we move
Output: path length of ~ x radially outward from the center in a quasi-symmetric way.
1: if T is an external node then Now we turn to the case of multiple blobs presented in
2: return e þ cðT:sizeÞfcð:Þ is defined in Equation (2)g Fig. 13. As we saw for the single blob case and as shown in
3: end if Fig. 13a, the creation of branch cuts that were only parallel
4: ~ n T:Normal to the coordinate axes was causing two “ghost” regions in
5: ~ p T:Intercept the score map, in addition to the bands observed in the sin-
6: if ð~ x ~ pÞ  ~
n  0 then gle blob case.
7: return PathLengthð~ x; T:left; e þ 1Þ
As shown in Figs. 13b and 13c, in both cases, namely, the
8: else if ð~ x~ pÞ  ~
n > 0 then
Rotated and Extended Isolation Forest, these “ghost”
9: return PathLengthð~ x; T:rigth; e þ 1Þ
regions are completely gone. The two blobs are clearly
10: end if
scored with low anomaly scores, as expected. The interest-
ing feature to notice here is the higher anomaly score region
As we can see the algorithm can easily be modified to take
directly in between the two blobs. The Extended Isolation
into account all the necessary changes for this extension. We
Forest algorithm is able to capture this detail quite well.
have made publicly available a Python implementation of
This additional feature is important as this region can be
these algorithms1 accompanied by example Jupyter note-
considered as close to nominal given the proximity to the
books to reproduce the figures in the text.
blobs, but with higher score since it is far from the concen-
trated distribution. The Standard Isolation Forest fails in
4 RESULTS AND DISCUSSION capturing this extra structure from the data.
Here we present the results of the Extended Isolation Forest As for the sinusoidal data, we observed before that the
compared to the standard Isolation Forest. We compare the standard Isolation Forest failed to detect the structure of the
anomaly score maps, variance plots and convergence of the
anomaly scores. We also report on the AUROC and AUPRC
values in order to quantify the comparison between the two
methods.

4.1 Score Maps

We first look at the score maps of the two dimensional
examples presented in section 1. The score maps of these
examples were the initial motivation for improving and
Fig. 13. Comparison of the standard Isolation Forest with rotated Isola-
1. https://github.com/sahandha/eif tion Forest, and Extended Isolation Forest for the case of two blobs.
1486 IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, VOL. 33, NO. 4, APRIL 2021

Fig. 14. Comparison of the standard Isolation Forest with rotated Isola- Fig. 16. Mean and variance of the scores for data points at fixed distan-
tion Forest, and Extended Isolation Forest for the case of sinusoid. ces from the center line.

data and treated it as one rectangular blob with very wide (close to the center of the blob), the variance is quite small in
rectangular bands. all three cases. All three methods are able to detect the cen-
Fig. 14 shows a comparison of the results for this case. ter of concentration of data quite well. This however, is not
The improvement in both cases over the Standard Isola- the goal for anomaly detection algorithms. After about 3s,
tion Forest is clear. The structure of the data is better pre- the variance among the scores computed by the Extended
served, and the anomaly score map is representative of Isolation Forest, and the case of Isolation Forest with rotated
the data. In the case of the Extended Isolation Forest, the trees, settle to a much smaller value compared to the stan-
score map tracks the sinusoidal data even more tightly dard Isolation Forest, which translates to a much more
than the rotated case. robust measurement. It is notable that this inconsistency
occurs in regions of high anomaly, which is very important
for an anomaly detection algorithm. In short, for data in
4.2 Variance of the Anomaly Scores
regions of high anomaly likelihood, the standard Isolation
Besides looking at anomaly score maps, we can consider Forest produces anomaly scores which vary largely depend-
some other metrics in order to compare the Extended Isola- ing on alignment of these data points with the training data
tion Forest with the standard one. One such metric is look- and the axes, rather than whether they are true anomalous
ing at the mean and variance of the anomaly scores of points or not. This increases the chances of false positives in
points distributed along roughly constant score lines for scoring stage.
various cases. The advantage of this metric is that we can We can do a similar study for the sine curve by consider-
test this for higher dimensional data. ing lines at a similar distances above and below where the
Consider our randomly distributed data in two dimen- data points lie as shown in Fig. 16a. We assume data lying
sions shown in Fig. 15a. The blue dots represent the train- on each line to be scored more or less the same. This is how-
ing data, used to create the forest in each case. The gray ever not quite true. If the data stretched to infinity in the
dots form concentric circles. Since our data is normally horizontal direction, or we had periodic boundary condi-
distributed, anomaly scores along each circle should tions in that direction, this would indeed be true. However,
remain more or less a constant. The red lines represent since our data is bounded in the horizontal direction, there
the circles at 1s, 2s, and 3s of the original normal distri- will be variations in the scores along each line as in the map
bution from which the training data is sampled. We will shown in Fig. 14c.
run the data from the gray circles through our trained Nonetheless we performed the analysis as shown in
Isolation Forest for the standard, the rotated and the Fig. 16. Similarly to the previous plots, the three red lines on
extended cases, and look at the variation of the score as a each side of the center line correspond to 1s, 2s, and 3s
function of distance from the center. from the Gaussian noise added to the sine curve. The gray
From Fig. 15b we can see that the mean score varies the lines represent data points that lie at constant distance from
same way among the three methods. It increases quickly the center of the data. These are points that are used in the
within 3s from the center and then keeps monotonically scoring stage. The blue data points are used for training.
increasing. At higher values the rate of increase slows down Fig. 16b shows the change in the mean score as we move
until it converges far away from the center where the blob out on both sides in the y direction. We observe that in this
resembles a single point. case, the mean scores behave differently. The mean score
As far as the variance of the scores goes, looking at for the standard Isolation forest reaches a constant value
Figs. 12 and 15c, we can see for very small anomaly scores very quickly. This is consistent with what we observed in
the score maps, Fig. 14a. We saw that the standard Isolation
Forest was unable to capture the structure present in this
dataset, and treated it as a rectangular blob. The rapid rise
of the anomaly score for this case represents moving
through the boundary of this rectangular region into a high
anomaly score area. Outside this region, all data points look
the same to the standard Isolation Forest. This rapid rise is
undesirable. In addition to not capturing the structure of
the data, these scores are much more sensitive to choosing
Fig. 15. Mean and variance of the scores for the datapoints located an anomaly threshold value which results in reducing
radially at fixed distances from the center. AUCROC, as we will see below. In the other two cases, we
HARIRI ET AL.: EXTENDED ISOLATION FOREST 1487

TABLE 1
AUC Values for Both ROC and PRC for Example Datasets
Using Standard Isolation Forest and Extended Isolation Forest

AUC ROC AUC PRC

Data iForest EIF iForest EIF
Single Blob 0.919 0.999 0.800 0.999
Double Blob 0.869 0.999 0.303 0.997
Sinusoid 0.809 0.924 0.430 0.504

point in any direction within all the dimensions of the prob-

Fig. 17. Mean and variance for concentric points around a normally dis-
tributed 3-D blob. lem), produces the most reliable and robust anomaly scores.

observe a similar trend as before where the mean is con- 4.3 AUC Comparison
verging to a steady score value, but much more slowly, In this section we report AUC values for both ROC and PRC
making it less sensitive to choosing threshold values. and compare the two methods. Initially, we produce these
Fig. 16c shows the variance of the scores obtained. We results for the examples provided earlier, since these exam-
notice that, as before, the variance is much higher for the ples are designed to highlight the specific shortcoming of
standard Isolation Forest, and lower for the extended Isola- Isolation Forest studied in this paper. We then report the
tion Forest. After 3s the variance for the standard case AUC for ROC and PRC for some real world benchmark
drops rapidly to a constant value but higher than that datasets of varying sizes and dimensions.
obtained by EIF, as the mean score reaches a steady value. In order to obtain the AUC values for the example data-
The constant value here is a clear indication that the stan- sets, we first train both algorithms on 2000 data points in
dard Isolation Forest is unable to capture any useful infor- each case distributed as seen previously. We then add 200
mation outside the rectangular region discussed before. The anomalous points, score the data, and compute AUC’s. The
EIF again provides a more robust scoring prediction. results are summarized in Table 1.
In addition to the two examples above, we can perform In all cases the improvement is obvious, especially in the
the same analysis on higher dimensional data. We choose case of the double blob, where we have “ghost” regions,
3-D and 4-D blobs of normally distributed data in space and the sinusoid, where we have a high variability in the
around the origin with unit variance in all directions, simi- structure of the dataset. This highlights the importance of
larly to the 2-D case. Recall that as soon as we move beyond understanding the problem that arises due to using axis-
the two dimensional case, we have more levels of extension parallel hyperplanes.
that we can consider with regards to generating the plane We perform the same analysis on some real world bench-
cuts. These are represented by Exn as discussed above. We mark datasets. Table 2 lists the datasets used as well as their
do not include the rotated case in the following analysis. properties. The results are summarized in Table 3.
As before and not surprisingly, we can see from Figs. 17 We can see the improved AUC values in the case of
and 18 that the mean score increases with increasing radius Extended Isolation Forest. Even though in some cases the
very similarly in all cases, which was also observed in the improvement may seem modest, in others, there is an
2-D blob case. However, again we see in the region beyond appreciable difference. Naturally, the axis-parallel limita-
3s, which is where the anomalies lie, the Extended Isolation tion has more effects on some datasets than other. Neverthe-
Forest produces much lower values in the score variance. less, we can see that the EIF in general achieves better
We also observe that for each case, the variance decreases as results than the standard Isolation Forest.
the extension level increases. In other words, the Extended
Isolation Forest, i.e., the fully general case (when the planes 4.4 Convergence of Anomaly Scores
subdividing the data have no constrains and the normal can In a final comparison, we would like to find out how efficient
the Extended Isolation Forest is compared to the standard
case. For this purpose we consider convergence plots for the
anomaly score as a function of forest size (the number of
trees). We perform this for the 2-D, 3-D, and 4-D blobs. In the
case of 2-D we also include the method of tree rotations,

TABLE 2
Table of Data Properties

Size Dimension % Anomally

Cardio 1831 21 9.6
ForestCover 286048 10 0.9
Ionosphere 351 33 36
Mammography 11183 6 2.32
Fig. 18. Mean and variance for concentric points around a normally dis- Satellite 6435 36 32
tributed 4-D blob.
1488 IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, VOL. 33, NO. 4, APRIL 2021

TABLE 3
AUC Values for Both ROC and PRC for Benchmark Datasets
Using Standard Isolation Forest and Extended Isolation Forest

AUC ROC AUC PRC

Data iForest EIF iForest EIF
Cardio 0.888 0.915 0.466 0.483
ForestCover 0.809 0.924 0.430 0.504
Ionosphere 0.85 0.913 0.877 0.893
Mammography 0.859 0.862 0.4198 0.4271
Satellite 0.714 0.778 0.783 0.808

Fig. 20. Convergence plots for the 3-D blob for the standard and fully
extended cases.

Fig. 19. Convergence plots for the 2-D Blob case and the three methods
described in the text.

described before. Fig. 19 shows the convergence plots for the

standard, rotated and Extended Isolation forest.
Figs. 20 and 21 show the same plots for the 3-D blob and
4-D blobs respectively, except for the Rotated Isolation For- Fig. 21. Convergence plots for the 4-D blob for the standard and fully
est case. extended cases.
For the convergence plots, the error bars show the
variance among the scores of 500 data points tested selected features. This introduced a bias in terms of the
along constant level sets as before (concentric shells of 2 number of branching operations performed based on the
and 3-spheres). As we can see, in all the cases the score location of the data point with respect to the coordinate
settles very quickly as a function of the forest size. There frame. Since the length of tree branches are used directly in
might be a slight difference between the nominal and computing the anomaly scores, we saw regions in the
anomalous points but the differences are very small. domain that showed inconsistent anomaly scores, introduc-
Moreover we find no appreciable difference between the ing artificial zones of higher/lower scores which are not
standard Isolation Forest and the Extended Isolation For- present in the original data.
est, including all the extension levels. In the case of stan- In order to remedy the situation we proposed two differ-
dard Isolation Forest, the variances are much higher, ent approaches. First we showed the score maps can be
consistent with the results found in the previous subsec- improved if the data undergoes a rotation before the con-
tion, but in terms of rates of convergence, there is not struction of each tree. The second approach, Extended Isola-
much difference which indicates that the number of trees tion Forest, allows the branching hyperplanes to take on any
on each method should be the same. slope as opposed to hyperplanes only parallel to the coordi-
We have seen that the Extended Isolation Forest is able to nate frame. This extension in the algorithm completely
improve on the robustness of the scores generated com- resolves the bias introduced in the case of standard Isolation
pared to the standard case of Isolation Forest. It accom- Forest. We show the algorithm is readily extended to high
plishes this without sacrificing computational efficiency as dimensional datasets, while it possesses Ex ¼ N  1 levels
evidenced by the convergence plots presented in this sec- of extensions for an N dimensional dataset, with Ex ¼ 0
tion. The fully extended case seems to produce the best being identical to the standard Isolation Forest. All of these
results when higher dimensional data are considered. extension levels show better performance than the standard
case, and we suggest the EIF should be preferred over the
rotation approach.
5 CONCLUSIONS We showed score maps for various examples. We also
We have presented an extension to the anomaly detection showed that for the region of anomaly, the standard Isola-
algorithm known as Isolation Forest [9]. The motivation for tion Forest algorithm produces high variance in the scores
the study arose from the observation that score maps in two along constant level sets of anomaly scores, while the
dimensional datasets demonstrated unexpected artifacts. Extended Isolation Forest resulted in remarkably smaller
We showed these artifacts can be traced to the branching variances which decreased as the extension level increased.
procedure in the algorithm itself. The branching procedure We presented AUC for ROC and PRC for all the examples
followed slicing data along random values of randomly considered in the paper as well as various real world
HARIRI ET AL.: EXTENDED ISOLATION FOREST 1489

benchmark data. The EIF performed consistently better than Sahand Hariri received the bachelor’s and
master’s degrees in mechanical engineering from
the standard Isolation Forest in all cases considered. Temple University. He then joined Wolfram Alpha
The results of this extension are more reliable and robust LLC, where he was a research developer for two
anomaly scores, and in some cases more accurate detection and a half years. After that, while a graduate
of structure of a given dataset. We additionally saw these student at the University of Illinois in theoretical
and applied mechanics, He worked at the National
results can be achieved without sacrificing computational Center for Supercomputing Applications through
efficiency. We have made a Python implementation of the the summers of 2016, 2017, and 2018 where he
Extended Isolation Forest algorithm publicly available2, met and started his collaboration with Matias Car-
rasco Kind. His interests include applications of
accompanied by example Jupyter notebooks to reproduce computational methods in sciences, more specifically, dynamical and com-
the figures in this paper. plex systems. Currently, he works at PSI Metals GmbH in Berlin, Germany.

ACKNOWLEDGMENTS Matias Carrasco Kind received the PhD degree

in astronomy with the computational science
The authors would like to thank Seng Keat Yeoh for his and engineering CSE graduate option at Univer-
useful comments and discussion in regards to the imple- sity of Illinois at Urbana-Champaign (UIUC) which
focused in machine learning techniques applied to
mentation. MCK’s work has been supported by Grant proj- Astronomy. He is currently a senior research and
ects NSF AST 07-15036 and NSF AST 08-13543. Data Scientist at the National Center for Super-
computing Applications (NCSA) and assistant
research professor in astronomy with UIUC. He is
REFERENCES also a Trusted CI fellow for the NSF Cybersecurity
[1] T. R. Bandaragoda, K. M. Ting, D. Albrecht, F. T. Liu, and Center of Excellence and the Data Release Scien-
J. R. Wells, “Efficient anomaly detection by isolation using nearest tist for the Dark Energy Survey (DES) Project. He is an expert in scientific
neighbour ensemble,” in Proc. IEEE Int. Conf. Data Mining Work- cloud computing and scientific platform and currently leads the DES Data
shop, 2014, pp. 698–705. Release Infrastructure. He is also a member of the LSST Data Manege-
[2] T. R. Bandaragoda, K. M. Ting, D. Albrecht, F. T. Liu, Y. Zhu, and ment team. He is interested in data-intensive science as well as artificial
J. R. Wells, “Isolation-based anomaly detection using nearest- intelligence, data visualization, image processing, web applications, sci-
neighbor ensembles,” Comput. Intell., vol. 34, no. 4, pp. 968–998, entific platforms, software engineering and architecture, and cyberin-
2018. frastructure in general. His interests in astrophysics are in the area of
[3] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly detection: A cosmology, extragalactic astronomy, machine and deep learning,
survey,” ACM Comput. Surveys, vol. 41, no. 3, 2009, Art. no. 15. especially in large scale structures, galaxy formation and evolution, and
[4] G. Chen, Y. L. Cai, and J. Shi, “Ordinal isolation: An efficient and photometric redshift estimation. Before that, he received the degree in
effective intelligent outlier detection algorithm,” in Proc. IEEE Int. astronomy at Universidad Catolica de Chile (PUC) with highest honors.
Conf. Cyber Technol. Automation Control Intell. Syst., Mar. 2011, For his undergraduate, he was at the Max-Planck Institute for Astrophys-
pp. 21–26. ics (MPA) in Germany where he also spent some time doing PhD studies
[5] S. Das, W. K. Wong, T. Dietterich, A. Fern, and A. Emmott, before working as an adjunct professor at the Universidad Andres Bello
“Incorporating expert feedback into active anomaly discovery,” in (UNAB) in Chile.
Proc. IEEE 16th Int. Conf. Data Mining, Dec. 2016, pp. 853–858.
[6] A. Emmott, S. Das, T. G. Dietterich, A. Fern, and W.-K. Wong, Robert J. Brunner received the PhD degree in
“A meta-analysis of the anomaly detection problem,” 2015. astrophysics from Johns Hopkins University,
[7] S. Hariri and M. C. Kind, “Batch and online anomaly detection for working under Alex Szalay on the development
scientific applications in a Kubernetes environment,” in Proc. 9th of the science archive for the Sloan Digital Sky
Workshop Sci. Cloud Comput., 2018, Art. no. 3. Survey. He is the associate dean for innovation
[8] R. Harman and V. Lacko, “On decompositional algorithms for and chief disruption officer with the Gies College
uniform sampling from n-spheres and n-balls,” J. Multivariate of Business at the University of Illinois. He is a
Anal., vol. 101, no. 10, pp. 2297–2304, 2010. professor of accountancy, an Arthur Anderson
[9] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in Proc. fellow, and the director of the University of Illinois
8th IEEE Int. Conf. Data Mining, 2008, pp. 413–422. - Deloitte Foundation Center for Business Analyt-
[10] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “On detecting clustered ics. He holds affiliate appointments in the As-
anomalies using SCiForest,” in Proc. Joint Eur. Conf. Mach. Learn. tronomy, Computer Science, Electrical and Computer Engineering,
Knowl. Discovery Databases, 2010, pp. 274–290. Informatics, Physics, the School of Information Sciences, and Statistics
[11] F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation-based anomaly Departments; at the Beckman Institute, in the Computational Science
detection,” ACM Trans. Knowl. Discovery Data, vol. 6, no. 1, and Engineering program; and at the National Center for Supercomput-
pp. 3:1–3:39, Mar. 2012. ing Applications. He is also the data science expert in residence at the
[12] B. H. Menze, B. M. Kelm, D. N. Splitthoff, U. Koethe, and Research Park at the University of Illinois. His primary research interests
F. A. Hamprecht, “On oblique random forests,” in Proc. Joint Eur. include application of statistical and machine learning to a variety of real-
Conf. Mach. Learn. Knowl. Discovery Databases, 2011, pp. 453–469. world problems, and in making these efforts easier, faster, and more pre-
[13] K. Noto, C. Brodley, and D. Slonim, “Anomaly detection using an cise. This work spans fundamental algorithm design to more effectively
ensemble of feature models,” in Proc. IEEE Int. Conf. Data Mining, incorporate uncertainty to optimization using novel computational tech-
Dec. 2010, pp. 953–958. nologies. More generally, he helps lead efforts to promote data science
[14] T. Pevnỳ, “Loda: Lightweight on-line detector of anomalies,” across campus and to encourage effective data management, analysis,
Mach. Learn., vol. 102, no. 2, pp. 275–304, 2016. and visualization techniques. His PhD thesis helped develop the statisti-
[15] D. M. Rocke and D. L. Woodruff, “Identification of outliers in cal approach to quantifying galaxy evolution, where large data are used
multivariate data,” J. American Statistical Assoc., vol. 91, no. 435, to place constraints on the original and evolution of the Universe. He
pp. 1047–1061, 1996. subsequently spent five years as a postdoctoral scholar at the California
[16] G. A. Susto, A. Beghi, and S. McLoone, “Anomaly detection Institute of Technology working under S. George Djorgovsi and Tom
through on-line isolation forest: An application to plasma Prince as the project scientist for the Digital Sky project.
etching,” in Proc. 28th Annu. SEMI Advanced Semicond. Manuf.
Conf., May 2017, pp. 89–94.
" For more information on this or any other computing topic,
please visit our Digital Library at www.computer.org/csdl.

2. https://github.com/sahandha/eif