# An Anomaly Detection Method for Wireless Sensor Networks Based on the Improved Isolation Forest
## 3 Improved Anomaly Detection Based on Isolation Forest
Firstly, subsampling by not putting back for T times. Then, an isolation tree is constructed based on each sub-sample set, and the isolation trees selected according to fitness form an isolation forest. Finally, the anomaly score of each instance is used in the evaluation stage to identify anomalies. As mentioned above, the traditional Isolation Forest algorithm has shortcomings such as strong randomness, poor stability, and weak performance when data lies in the intersection between positive sample path length interval and negative sample path length interval. Therefore, this paper proposes a box-plot-based Isolation Forest algorithm, known as BS-iForest. Figure 2 shows the process diagram of BS-iForest. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Algorithm** & **Data Set Partition** & **Detector Diversity** & **Stability** \\ \hline iForest & \begin{tabular}{c} Continuously divide \\ the data set, calculate \\ the abnormal score \\ according to the \\ number of divisions \\ \end{tabular} & \begin{tabular}{c} Single type \\ of detector \\ \end{tabular} & \begin{tabular}{c} Random feature selection, \\ poor stability \\ \end{tabular} \\ \begin{tabular}{c} Subsampling \\ according to the \\ \end{tabular} & \begin{tabular}{c} Increased \\ classification ability \\ \end{tabular} & Strong stability \\ \begin{tabular}{c} MRH-iForest \\ \end{tabular} & \begin{tabular}{c} Partitioning datasets \\ using Hyperplanes \\ \end{tabular} & \begin{tabular}{c} Compared with \\ iForest, the \\ classification ability \\ \end{tabular} & Strong stability \\ \begin{tabular}{c} BS-iForest \\ \end{tabular} & \begin{tabular}{c} Use the box plot to \\ divide the data set \\ and use the fitness to \\ select the data set \\ \end{tabular} & \
\begin{tabular}{c} Increased diversity \\ and classification \\ ability \\ \end{tabular} &
\begin{tabular}{c} Perform joint judgment of \\ similar samples in the \\ boundary fuzzy area, \\ strong stability \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of different variants of iForest algorithms. The pseudo-code of BS-iForest is shown in the following Algorithm 1:  
Figure 1: The process diagram of standard Isolation Forest algorithm. Figure 2: Process diagram of BS-iForest. As described in the pseudo-code above, the main idea of the BS-iForest algorithm is to use the statistical method to judge whether the currently randomly sub-sampled set is more likely to have outliers. If so, the subsample set is used to build an isolation tree; otherwise, the isolation tree would not be constructed. Then, the algorithm continues to resample, which reduces the randomness. Because the voting weight of each isolation tree is the same, BS-iForest selects an isolation tree with the highest accuracy in the training set to form the forest and effectively improves the anomaly detection ability of the isolation forest. Finally, for the intersection of positive and negative sample path lengths, BS-iForest uses the current sample path to jointly determine the maximum value of the positive sample path, the minimum value of the negative sample path, and the previous sample distance, which improves the accuracy of the isolation forest. The construction method of the isolation tree is to randomly select y samples from a given set with samples as the root node of the isolation tree and then randomly select a feature and separation value. Therefore, for such one-dimensional data, the abnormality of the data distribution can be detected through the box plot, and it can be judged whether the data on the feature is abnormal. First, the box plot graph is generated on the subsample set of the root node. If the outcome contains values distributed outside the upper and lower limits, it indicates that the subsample set contains exceptions, and an isolation tree will be built. If the outcome contains no outliers, then no isolation tree is created. Box diagrams, also known as box whisker diagrams, are a general method for detecting abnormal values.