## 3 Methodology
### Algorithmic Approach
#### 3.1.1 Isolation Forest  
In the field of ML, the isolation forest [43] algorithm belongs to the unsupervised machine learning group of algorithms. This method works a bit differently from the typical methods of clustering, which are consistently associated with unsupervised detection. Furthermore, IF was used in the past to handle anomaly detection problems that involve time series, similar to those evaluated herein (e.g., in [44; 45]).  
This method consists of a set of elements called isolation trees. Isolation trees are built by isolating the points of the given dataset, \(X=\{X_{1},X_{2},\ldots,X_{j}\}\), through a recursive division of the sample space. In this recursive division, a feature belonging to the elements of the sample space (\(X\)) is randomly chosen. Then, also randomly, a division value (\(p\)) is computed within the range of values of that same feature, as shown in the example depicted in Figure 2. Supported by the fact that theory tells us that anomalous observations  
Figure 1: Flow diagram of the adopted methodology.  
are usually different and exist in small numbers, it is expected that those anomalous observations would demand a smaller number of divisions to be isolated, because they should be more distant from the other ones. In the end, the process is equivalent to the logic of a collection of trees, i.e., a forest is obtained.  
The classification of samples as anomalies or normal is supported in a scoring system given by the equation  
\[s(x,n)=2^{-\frac{E(h(x))}{c(n)}},\]  
where for a given \(x\), \(h(x)\) corresponds to the length of the path from the root node to the outer node that isolates \(x\) in a given forest tree, \(E(h(x))\) is the average length of these paths in the forest, and \(c(n)\) is the average length of the isolation trees for \(n\) samples (\(n\) is the number of samples in the set \(X\)). This value is computed by equation  
\[c(n)=2H(n-1)-(2(n-1)/n),\]  
where \(H\) is a harmonic number [43].  
The rationale of the IF algorithm is to use multiple trees (as sketched in Figure 3) to increase the effectiveness of anomaly detection. As the splitting process is made independently in different trees, the randomness that results from multiple decision trees is lower than that obtained from a single tree.  
The algorithm has been used to solve several anomaly detection problems. For example, [PERSON] and [PERSON] [46] compared four methods for variable reduction and used the IF algorithm in anomaly detection, based on data from the semiconductor industry. To understand which approach was better for the study, they carried out two case studies, from which they concluded that there would be some advantages in using certain reduction methods over others. They also proposed an anomaly detection system based on the IF method. [PERSON] and [PERSON] [45] also presented a general architecture for anomaly detection in streaming data with the IF method, and suggest an approach where they associate the IF with a sliding window method, a well-known approach for time series. To evaluate the method, they performed several tests using four datasets, which allowed them to validate the effectiveness of the algorithm. Another interesting work, carried out by [PERSON] and [PERSON] [47], consisted in comparing different algorithms in the identification of faults in small hydroelectric power plants. From the results obtained, they concluded that the IF algorithm and its variant, the extended isolation forest, were the algorithms that stood out the most, having good characteristics to be adopted in an online detection system. The authors concluded that these are also solutions that require a low computational cost.  
Figure 2: An example of the process that occurs in an isolation tree building to isolate points in a two-dimensional sample space.