# An Anomaly Detection Ensemble for Protection Systems in Distribution Networks
## 3 Data Anomaly Detection Model Based on IF  
Isolation forest is a forest path technique used for detecting outlier data [37]. Its main method of anomaly detection is through the path distance between the root node and the leaf nodes in the forest architecture, meaning that it can assign a more significant root-node to leaf-node distance to outlier collection data that is farther away from the range of normal data and separate it (isolate) by a sparse data-split range [38]. By eventually calculating the average length of the root-leaf node set path for each group of data, the model can detect more conspicuous collection data in the dataset, i.e., outlier data. The overall construction approach of the isolation forest model can be displayed in Figure 3 below. We assume that \(S_{j}=\big{\{}z_{1}\dots,z_{j}\big{\}}\) is a training dataset containing \(j\) independent variables, and \(Z=\big{\{}Z^{(1)},\dots,Z^{(c)}\big{\}}\) represents the corresponding variable values \(\alpha\) in finite-dimensional Euclidean space. We suppose that an isolation tree (IT) \(\varepsilon\) in an IF can be viewed as a binary tree that characterizes a nested sequence of data point split sets in feature space by a data depth of \(M\geq 1\). Its root node corresponds to the entire detection space \(C_{0,0}\subset\alpha\). We assume that other IT nodes are identified in pairs \((m,n)\) of sets, where \(m\) (\((0\leq m<M)\)) denotes the data depth of that node, and \(n\) (\((0\leq m\leq 2^{m}-1)\)) denotes the corresponding detection space subset \(C_{m,n}\subset\alpha\) for the respective node. A node \((m,n)\) that is not a terminal has two child nodes, corresponding to two detection space subsets \(C_{m,n}=C_{m+1,2n}\cup C_{m+1,2n+1}\) that do not intersect. If a node does not have any child nodes, it is referred to as a terminal node. IF can be constructed by iteratively filtering subsets of the training data set [39]. First, we set the initial node \((m,n)\), then the corresponding data subset can be written as \(S_{m,n}\). During the growth stage of the IT in the \(m+2n\) iteration process, an arbitrary growth direction \(v\) is chosen, corresponding to a separation variable \(Z^{(v)}\); at the same time, a separation parameter \(u\) is set to correspond to the projection range of the data point in \(S_{m,n}\) on the coordinate axis in the \(v\) direction, which can be written as:  
\[u\in\left[Min_{z\in S_{m,n}}z^{(v)},Max_{z\in S_{m,n}}z^{(v)}\right] \tag{12}\]  
Figure 3: Illustration of outlier detection by the IF model. The generated subset can be written as:  
\[C_{m+1,2n}=C_{m,n}\cap\left\{z\in\alpha:z^{(v)}\leq u\right\} \tag{13}\]  
\[C_{m+1,2n+1}=C_{m,n}\cap\left\{z\in\alpha:z^{(v)}>u\right\} \tag{14}\]  
Then, the corresponding training data subset can be written as:  
\[S_{m+1,2n}=C_{m+1,2n}\cap S_{m,n} \tag{15}\]  
\[S_{m+1,2n+1}=C_{m+1,2n+1}\cap S_{m,n} \tag{16}\]  
In the above formula, \(S\) is the training dataset, and \(C\) is the subset generated by the separation parameter \(u\), which corresponds to the projection range of the data points in \(S\) on the coordinate axis in the \(v\) direction. We repeat the above iteration until all training data set points are separated, or the data depth \(M\) is reached. When the observed score is close to \(M\), the path length is very short, so the data point can easily be isolated, that is, in an abnormal state, and the growth of the IF node stops. Since the end nodes on the completed IT can correspond to a subset of the feature space, a piecewise constant function \(f_{\varepsilon}:\alpha\to N\) can be defined, based on the detection space. \[f_{\varepsilon}(z)=m \tag{17}\]  
In the above equation, \(z\in C_{m,n}\) and \((m,n)\) are end nodes. The random path length shown in Equation (17) represents the degree of anomaly for the corresponding variable; that is, the higher the degree of \(z\) anomaly, the greater the probability that the data \(f_{\varepsilon}(z)\) value is smaller.