Anomaly detection¶

Unsupervised outlier detectors with PyOD's BaseDetector contract: after fit(X) they expose decision_scores_ (higher is more anomalous), threshold_ and labels_ (0 inlier, 1 outlier), and decision_function, predict and predict_proba score new data. With pip install "aspective[pyod]" they subclass PyOD's own base class and work inside PyOD's ensembles and thresholding.

RSHashDetector ¶

RSHashDetector(n_estimators=100, max_samples=1000, contamination=0.1, random_state=None)

Outlier detection by randomized subspace grids.

Each of n_estimators components draws a sample of the data, a random subspace and a random grid with random offsets, then counts how many sample points fall in each grid cell. A point whose cells are nearly empty across many subspaces is an outlier. The score of a component is log2(1 + count); scores are averaged over components. Training points that were part of a component's sample do not count themselves.

The paper keeps the counts in a count-min sketch to bound memory; this implementation counts cells exactly, which gives the same scores without hash collisions.

Follows PyOD's detector API: decision_function returns higher scores for more anomalous points, and predict returns 0 for inliers and 1 for outliers.

Parameters:

Name	Type	Description	Default
`n_estimators`	`int`	Number of ensemble components (`m` in the paper).	`100`
`max_samples`	`int`	Sample size per component (`s` in the paper), capped at n.	`1000`
`contamination`	`float in (0, 0.5]`		`0.1`
`random_state`	`int, RandomState instance or None`		`None`

Attributes:

Name	Type	Description
`decision_scores_`	`ndarray of shape (n_samples,)`
`threshold_`	`float`
`labels_`	`ndarray of shape (n_samples,)`

References

S. Sathe and C. C. Aggarwal. Subspace Outlier Detection in Linear Time with Randomized Hashing. In Proceedings of the 16th IEEE International Conference on Data Mining (ICDM), 2016.

LeSiNNDetector ¶

LeSiNNDetector(n_estimators=50, max_samples=8, contamination=0.1, random_state=None)

Outlier detection by nearest neighbours in tiny random subsamples.

The classic k-nearest-neighbour detector scores a point by its distance to its nearest neighbours in the whole data set: it needs all pairwise distances, and clusters of outliers mask each other because they are each other's neighbours. LeSiNN draws n_estimators random subsamples of only max_samples points (8 by default) and scores a point by its distance to the nearest point of each subsample, averaged over the subsamples. A tiny subsample rarely contains the outliers of a cluster, which removes the masking, and scoring is linear in the data size. Pang, Ting and Albrecht found it as accurate as or better than Isolation Forest and full k-NN on a broad benchmark, at a fraction of the cost; the idea extends the single-sample detector of Sugiyama and Borgwardt (NeurIPS 2013) to an ensemble.

Follows PyOD's detector API: decision_function returns higher scores for more anomalous points. A training point is not compared with itself when it is part of a subsample.

Parameters:

Name	Type	Description	Default
`n_estimators`	`int`	Number of subsamples (`t` in the paper).	`50`
`max_samples`	`int`	Subsample size (`psi` in the paper), capped at n.	`8`
`contamination`	`float in (0, 0.5]`		`0.1`
`random_state`	`int, RandomState instance or None`		`None`

Attributes:

Name	Type	Description
`decision_scores_`	`ndarray of shape (n_samples,)`
`threshold_`	`float`
`labels_`	`ndarray of shape (n_samples,)`
`subsamples_`	`ndarray of shape (n_estimators, max_samples, n_features)`

References

G. Pang, K. M. Ting and D. Albrecht. LeSiNN: Detecting Anomalies by Identifying Least Similar Nearest Neighbours. In Proceedings of the 2015 IEEE International Conference on Data Mining Workshop (ICDMW), pages 623-630, 2015.

M. Sugiyama and K. M. Borgwardt. Rapid Distance-Based Outlier Detection via Sampling. In Advances in Neural Information Processing Systems 26 (NeurIPS), 2013.

ExtendedIsolationForestDetector ¶

ExtendedIsolationForestDetector(n_estimators=100, max_samples=256, extension_level=None, contamination=0.1, random_state=None)

Isolation Forest with random oblique cuts (Extended Isolation Forest).

Isolation Forest isolates points with axis-parallel cuts. Its anomaly scores therefore carry artefacts: regions that line up with a dense cluster along one axis, but are far from all data, look normal, and score maps show rectangular "ghost" bands. Extended Isolation Forest cuts each node with a hyperplane of random orientation, a normal vector with standard-normal entries through a point drawn uniformly from the node's bounding box. extension_level sets how many coordinates of the normal are non-zero (0 is Isolation Forest, the default n_features - 1 is fully oblique). Hariri et al. showed the artefacts disappear and found equal or better ROC AUC than Isolation Forest on the ODDS benchmark data.

Follows PyOD's detector API: decision_function returns higher scores for more anomalous points (the usual 2 ** (-E[h(x)] / c(psi))).

Parameters:

Name	Type	Description	Default
`n_estimators`	`int`		`100`
`max_samples`	`int`	Subsample size `psi` per tree, capped at n.	`256`
`extension_level`	`int or None`	Non-zero coordinates of each normal minus one; None is `n_features - 1`.	`None`
`contamination`	`float in (0, 0.5]`		`0.1`
`random_state`	`int, RandomState instance or None`		`None`

Attributes:

Name	Type	Description
`decision_scores_`	`ndarray of shape (n_samples,)`
`threshold_`	`float`
`labels_`	`ndarray of shape (n_samples,)`
`estimators_`	`list of trees`

References

S. Hariri, M. Carrasco Kind and R. J. Brunner. Extended Isolation Forest. IEEE Transactions on Knowledge and Data Engineering, 33(4):1479-1489, 2021.

F. T. Liu, K. M. Ting and Z.-H. Zhou. Isolation Forest. In Proceedings of the 8th IEEE International Conference on Data Mining (ICDM), 2008.