Isolation Forest Models API¶

Bases: BaseModel

Isolation Forest for streaming data using a sliding reference window.

iForestASD periodically discards the current batch Isolation Forest and trains a complete replacement forest on a recent reference window. This implementation keeps that window bounded, samples each isolation tree from it, and retrains after retrain_interval new observations.

The original paper does not provide an author-maintained public repository. The window/retraining structure is cross-checked against the open-source PySAD IForestASD reference implementation, which implements Algorithm 2 from the paper without its simulation-specific concept-drift step.

Parameters:

learn_one(x: dict[str, float]) -> None

score_one(x: dict[str, float]) -> float

Bases: BaseModel

Half-Space Trees for streaming anomaly detection.

Half-Space Trees (HST) is an ensemble method for detecting anomalies in streaming data. It builds multiple random trees that partition the feature space using half-space cuts (axis-aligned splits).

The algorithm tracks the "mass" (visit count) at each node during training. Anomalies are identified by having low mass - they fall into regions of feature space that are rarely visited.

Each tree first creates the randomly perturbed work space described in the paper. Every internal node then selects a random feature and bisects that feature's current interval at its midpoint. Reference and latest-window masses are recorded at every traversed node.

The random work spaces are constructed for inputs in [0, 1]. Scale other feature ranges before passing them to this detector.

Parameters:

Examples:

from aberrant.model.iforest import HalfSpaceTrees
from aberrant.transform.preprocessing import MinMaxScaler

stream = [
    {"x": 0.0, "y": 0.1},
    {"x": 0.2, "y": 0.1},
    {"x": 0.1, "y": 0.3},
]
pipeline = MinMaxScaler() | HalfSpaceTrees(n_trees=5, seed=42)
pipeline.learn_one(stream[0])
scores = []
for point in stream[1:]:
    score = pipeline.score_one(point)
    scores.append(score)
    pipeline.learn_one(point)
assert len(scores) == 2

learn_one(x: dict[str, float]) -> None

score_one(x: dict[str, float]) -> float

Bases: BaseModel

Online isolation forest built from Mondrian trees.

The tree update follows online Mondrian block-extension mechanics, while anomaly scoring uses Isolation Forest path-length normalization. The original Mondrian Forest is a supervised classification model and does not define this anomaly score, so this class is a custom hybrid.

Parameters:

learn_one(x: dict[str, float]) -> None

score_one(x: dict[str, float]) -> float

Bases: BaseModel

Incremental isolation forest with sliding-window unlearning.

Scores are path-length isolation scores in [0, 1]. Learned batches are retained until window_size is exceeded, then the oldest points are unlearned from the trees.

Parameters:

Initialize an Online Isolation Forest.

learn_one(x: dict[str, float]) -> None

score_one(x: dict[str, float]) -> float

learn_batch(data: ndarray) -> None

score_batch(data: ndarray) -> ndarray

Bases: BaseModel

Random Cut Forest for online anomaly detection.

This model keeps an ensemble of random cut trees over a bounded sample of recent shingled points. learn_one performs one-sample updates and forgetting, while score_one returns an anomaly score for one sample.

Tree insertion/removal and raw anomaly scoring follow Random Cut Tree mechanics. score_one temporarily inserts each query, computes its collusive displacement (CoDisp), removes it, and restores RNG state. Optional exponential scaling is a monotonic presentation transform over raw CoDisp.

Parameters:

reset() -> None

learn_one(x: dict[str, float]) -> None

score_one(x: dict[str, float]) -> float

Bases: BaseModel

STREamRHF tree-based unsupervised anomaly detector.

The forest follows the authors' implementation structure:

• split attributes are sampled proportionally to log(kurtosis + 1),
• every node keeps fixed random quantiles for attribute and split selection,
• an insertion rebuilds a subtree when its selected attribute changes,
• each completed current window replaces the reference forest,
• anomaly score is the sum of log(n / leaf_size) across trees after candidate insertion.

score_one previews insertion along the affected tree paths so it reproduces the candidate-inclusive score without mutating learned state.

Parameters:

learn_one(x: dict[str, float]) -> None

score_one(x: dict[str, float]) -> float

Bases: BaseModel

StreamHash and half-space-chain detector for evolving feature streams.

Scores remain zero until init_sample_size projected points initialize the chains and one complete reference window has been observed.

Parameters:

reset() -> None

learn_one(x: dict[str, float]) -> None

score_one(x: dict[str, float]) -> float