# An Anomaly Detection Method for Wireless Sensor Networks Based on the Improved Isolation Forest
## 2 Related Work
First, it extracts the environmental feature set from the training set and then detects outliers of newly collected data according to the environment feature set. To resolve the problems of the weak robustness of such methods, [PERSON] et al. [29], for the first time, took advantage of the K-means clustering algorithm to build intrusion patterns on the training set, then detected intrusion by model matching. However, the primary task of the methods mentioned above is clustering. The effect of anomaly detection largely depends on the clustering effect, while the clustering computation cost is relatively high. The proximity-based anomaly detection methods compare the distance between data points [31] or calculate the density of each data area [32], treating data points that are different from others as anomalies. Generally used algorithms mainly include KNN, LOE, INFLO, LOOP, and RBF neural networks. Table 4 shows the advantages and disadvantages of several types of general anomaly detection algorithms based on proximity. Proximity-based methods have difficulties dealing with large-scale and high-latitude datasets in which internal density obviously costs much. To address the poor stability of LOE, [PERSON] et al. [33] associated each point with its nearest previous and subsequent points according to the Euclidean distance, and judged data points not associated with it to be an outlier, without supervising data and the number of neighbors K. To solve the consensus problem in WSN anomaly detection, [PERSON] et al. [34] aggregated neighborhood information using the correlation coefficient as a measure of the correlation between neighborhood sensors and local sensors, which can improve the accuracy of anomaly detection. To address the KNN method's difficulty in detecting WSN data online, [PERSON] et al. [35], for the first time, redefined anomalies from a hypersphere detection area to a hypercube, then used additional coefficients to transform the hyper-grid structure into a positive coordinate space, which significantly reduces the computational complexity. The main differences among the existing proximity-based methods lie in the selection of neighborhoods and the computation methods of abnormality; they are less effective at handling datasets with apparent internal density differences, being sensitive to parameters. Reasonably, setting parameters calls for professional domain knowledge. Through previous analysis, we can conclude that the existing anomaly detection methods are mostly based on the model of normal samples. Samples that do not fit the model are considered outliers and separated. The main disadvantage of these methods is that the anomaly detection model only optimizes the description of normal samples, but not the description of abnormal samples, which may cause numerous false positives and only detect a small number of anomalies. The Isolation Forest algorithm does not need \begin{table}
\begin{tabular}{c c c} \hline \hline
**Method** & **Advantages** & **Disadvantages** \\ \hline \multirow{3}{*}{K-means [29]} & simple, fast convergence and & \multirow{3}{*}{converges to the local optimal, \multirow{3}{*}{sensitive to the selection of initial cluster center}} \\  & excellent performance for & \\  & large-scale datasets & \\ \cline{3-3}  & Dense clusters of arbitrary & \multirow{3}{*}{difficult to process} \\  & shapes can be clustered to & \\ \cline{3-3}  & seek outliers & \\ \cline{3-3}  & Mapping data to & \\ \cline{3-3} SOM [28] & two-dimensional plane to & \multirow{2}{*}{highly complex and depends} \\  & achieve visualization and better & \\ \cline{3-3}  & clustering results & \\ \cline{3-3}  & Clusters that can handle & \multirow{2}{*}{many parameters, sensitive to} \\ \cline{3-3}  & complex spaces & \\ \cline{3-3}  & Good at dealing with & \\ \cline{3-3}  & high-dimensional data and & \\ \cline{3-3}  & large datasets & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Anomaly detection method based on clustering.