# An Anomaly Detection Method for Wireless Sensor Networks Based on the Improved Isolation Forest
## 3 Improved Anomaly Detection Based on Isolation Forest
The structure is shown in Figure 3. The median of the sample data is at the center of the box plot, the length of the box represents the interquartile range, the lower edge is the lower quartile (\(Q3\)), the lower edge is the lower quartile (\(Q1\)), and both ends of the box are outlier cutoff points, which is called the inner limit. The outliers defined in the box chart are data points distributed outside the upper and lower limits. Being different from the traditional 3-sigma method and the Z-fraction method, the box graph method can not only be used as the sample set subject to a normal distribution but also has a good effect on the sample set not subject to a normal distribution and has strong universality. The fitness of each isolated tree is then calculated. The training set is divided into n disjoint subsets, n \(-\) 1 subsets are used for training each isolation tree, and the remaining subset is used for testing. Finally, the average accuracy of all subsets is calculated as the final accuracy of the isolation tree. The correlation between each isolation tree and all treesexcept itself is computed. In the case of a single sample, the correlation calculation formula between trees is as Equation (1):  
\[s_{e}\big{(}M_{x},M_{y}\big{)}=1-\delta_{e}\big{(}M_{x},M_{y}\big{)} \tag{1}\]  
where \(e\) represents the sample, and \(M_{x}\) and \(M_{y}\) are two different isolation trees. See the calculation formula of \(\delta_{e}\big{(}M_{x},M_{y}\big{)}\) in Formula (2):  
\[\delta_{e}\big{(}M_{x},M_{y}\big{)}=\frac{1}{|C|}\sum_{j=1}^{|C|}\frac{PD_{xj} (e)-PD_{yj}(e)}{R_{j}(e)} \tag{2}\]  
where \(|C|\) represents the number of categories, \(PD_{xj}(e)\) represents the posterior probability of classifier \(x\) on sample \(e\) on class \(j\), \(PD_{yj}(e)\) represents the posterior probability of classifier \(y\) on sample \(e\) on class \(j\), and \(R_{j}(e)\) represents the extreme difference in the posterior probability of sample \(e\) on class \(j\). This is calculated using Formula (3):  
\[R_{j}(e)=max\big{\{}PD_{1j}(e),\ldots\ldots,PD_{Nj}(e)\big{\}}-min\big{\{}PD_{ 1j}(e),\ldots\ldots,PD_{Nj}(e)\big{\}} \tag{3}\]  
Based on the single-sample correlation, it is easy to obtain the correlation between the classifiers, that is, the arithmetic mean of the sample similarity in the entire set. This is calculated using Formula (4):  
\[s_{E}\big{(}M_{x},M_{y}\big{)}=\frac{1}{|E|}\sum_{e\in E}s_{e}\big{(}M_{x},M_{ y}\big{)} \tag{4}\]  
where \(|E|\) is the number of samples in the verification set. Figure 3: Box diagram structure. After calculation of the correlations for every two isolation trees in the forest, the arithmetic average of each isolation tree and all the correlations except itself is considered as the final similarity of the isolation tree itself. The fitness of each isolation tree is calculated by similarity and accuracy. The calculation formula as Equation (5):  
\[fit(M_{x})=\frac{1}{sim(M_{x})}\times(\frac{1}{1-acc(M_{x})^{2}}-1) \tag{5}\]  
According to the fitness, the best \(K\) isolation trees are selected to form an isolation forest. The training process of BS-iForest is shown in Figure 1:0  
Finally, the path length interval of positive samples is calculated according to the original training set in [pMin, pMax], and the path length interval of negative samples is [nMin, nMax]. If there is no intersection between the path length intervals of positive and negative samples, that is, pMin > nMax, the median between [pMax, nMin] is taken as the judgment threshold \(\varphi\). If the path length is bigger than \(\varphi\), the sample is considered abnormal. If the path length interval of positive and negative samples has an intersection, that is, pMin <= nMax, the sample is judged as normal. Then, the Euclidean distance is computed from the previous sample to the current one. The mode of the classification result of this sample is used as the classification result of the current sample.