# An Anomaly Detection Method for Wireless Sensor Networks Based on the Improved Isolation Forest
## 3 Improved Anomaly Detection Based on Isolation Forest  
Isolation Forest is a kind of ensemble algorithm that takes advantage of two properties of abnormal data: (1) abnormal data accounts for a small proportion of the dataset; and (2) abnormal data is significantly different from the normal data. This makes abnormal data more sensitive to the \"isolation\" mechanism that can be realized by separating instances. Therefore, Isolation Forest algorithms do not depend on distance or density, reducing computational overhead based on distance or density, but by choosing a binary structured tree called iTree with limited depth to isolate anomaly data points efficiently. Although the Isolation Forest algorithm performs well in high-dimensional data and has low time complexity, strong randomness is still a limitation. Building an isolation tree, a traditional Isolation Forest randomly samples the original training set without putting it back. However, there may be no outliers in the subsample set. While building an isolation tree using such a subsample set will reduce the detection ability of the isolation tree, leading to abnormal samples not effectively being detected. Each isolation tree has \begin{table}
\begin{tabular}{c c c} \hline \hline
**Method** & **Advantages** & **Disadvantages** \\ \hline RBF neural network & dealing with complex nonlinear data, fast convergence speed during model learning process Simple model, produces better performance without too much adjustment & Highly dependent on training data, complex network structure low efficiency, highly dependent on training data, poor effect on high-dimensional data difficult to determine the minimum neighborhood, the data dimension increases, the computational complexity and time complexity increase greatly \\ INFLO [36] & suitable for clusters with slightly different densities & Low accuracy and efficiency \\  & Output abnormal probability instead of abnormal score; no need to input the threshold parameter based on experience & assume that the data conforms to Gaussian distribution and the scope of application area is small \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Anomaly detection method based on proximity. a different detection ability but the same voting weight on detection. Therefore, some isolation trees with poor detection ability may negatively affect the outcome. The judgment threshold is manually set according to experience, and the detection effects of different data sets greatly vary. When the path length intervals of positive and negative samples overlap, the detection performance is poor because judgments are made only based on the threshold. Aiming at these defects, this paper proposes an algorithm BS-iForest based on a box plot sampling isolation forest. To describe the characteristics of the BS-Forest algorithm, we list the characteristics of four algorithms based on isolation forest for comparison on Table 5.  
The BS-iForest algorithm first uses the box plot method to predict whether there are anomaly data points in the subsample set that are selected randomly to be the roots of trees. If there is an anomaly data point according to the results of the box plot for the subsample set, a tree rooted at the node will be created; otherwise, the iTree would not be created to reduce randomness. Secondly, since each tree has the same voting weight, BS-iForest selects trees that have higher accuracies to compose isolation forests to improve detection capability. Lastly, in the situation that path length intervals of positive samples intersect with path length intervals of negative samples, BS-iForest makes a judgment based on a combination of the first n samples that have the highest similarities. BS-iForest is based on an Isolation Forest algorithm adding phases to promote the detection ability. The intuitive differences between the standard Isolation Forest algorithm and BS-iForest are displayed in Figures 1 and 2. The number of trees, t, and sub-sampling size, \(\psi\), are two parameters that should be manually set.