# An Anomaly Detection Method for Wireless Sensor Networks Based on the Improved Isolation Forest
## 2 Related Work  
As a significant field of data mining, the anomaly detection of perceptual data has attracted increasing attention. Currently, domestic and foreign research methods for perceptual data anomaly detection mainly include statistics-based, clustering-based, and proximity-based. Details are shown in Table 1.  
Statistics-based anomaly detection methods consider that when the difference between data and its statistical distribution or model exceeds a certain threshold, the data is judged as an outlier. Commonly used algorithms include the Kalman filtering, ARIMA, and Markov algorithms. Table 2 shows the advantages and disadvantages of several general anomaly detection algorithms based on statistics. This classification of methods often aims at a single attribute, the prediction period is short, and it is hard to estimate data distribution with high dimensions. To solve the problem of the low accuracy of the ARIMA method, [PERSON] et al. [20] first set a sliding window of a fixed size, then updated the model after each sliding window, and finally predicted the data points with the short-step exponential weighted average method. To overcome the difficulty of the PCA method while dealing with nonlinear scenes, [PERSON] et al. [21] introduced an anomaly detection method based on KPCA (kernel principal component analysis), which used the Mahalanobis distance to calculate the mapping of data points in feature space, and separated outliers from the normal distribution of data. However, most methods mentioned above only adapt to a single attribute. It is usually assumed that each dataset fits a certain distribution, but in practice, it is unknown whether a dataset fits a certain distribution. The clustering-based anomaly detection methods first attribute closely related data to the same cluster and classify data points that do not belong to any cluster as anomalies. Algorithms such as K-means, SOM, CURE, DBSCAN, etc., fall into this category. Table 3 shows the advantages and disadvantages of several general anomaly detection algorithms based on clustering. Such methods do not have efficient optimization methods for clustering, resulting in low efficiency and sensitivity to the number of clusters we choose. To solve the problem of low efficiency caused by this kind of method, [PERSON] et al. [28] proposed an anomaly detection method based on DBSCAN. This method uses the Euclidean distance \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Type** & **Classical Algorithms** & **Advantages** & **Disadvantages** \\ \hline Statistics-based methods & Gaussian model [6], regression model, histogram & Applicable to low dimensional data and high efficiency & Data distribution, probability model, and parameters are difficult to determine \\ Clustering-based methods & CURE [7], ROCK [8], DBSCAN [9; 10], K-means [11] & Low time complexity and can be applied to real-time monitoring & High cost for large datasets \\ Proximity-based methods & KNN [12; 13], LOF [14; 15], LOOP [16], RBF [17; 18] & No need to assume data distribution & Not applicable to high-dimensional data and requires manual parameter adjustment \\ Classification-based methods & OCSVM [19], C4.5, decision tree & High accuracy and short training time & Difficult model selection and parameter setting \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Advantages and disadvantages of common anomaly detection methods. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Method** & **Advantages** & **Disadvantages** \\ \hline Kalman filtering [22; 23] & Being widely applied and less computation consumption & Only being applied to linearly distributed data \\ ARIMA [24; 25] & extremely simple & The dataset is required to be stable or stable after differentiation \\ Markov [26; 27] & High accuracy & High computational cost of training and detection \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Statistics-based anomaly detection method. as the similarity measure between data points.