Categories &

Functions List

Function Reference: iforest

statistics: Mdl = iforest (X)
statistics: [Mdl, tf] = iforest (X)
statistics: [Mdl, tf, scores] = iforest (X)
statistics: […] = iforest (…, name, value)

Detect anomalies with an isolation forest.

Mdl = iforest (X) fits an isolation forest to the N-by-P matrix X, whose rows are observations and columns are variables, and returns an IsolationForest object Mdl.

[Mdl, tf, scores] = iforest (X) also returns the N-by-1 logical vector tf flagging the anomalous observations and the N-by-1 vector scores of anomaly scores in the range [0, 1]. A higher score indicates an observation that is more easily isolated, and therefore more likely to be an anomaly.

The score of an observation is 2^(-E[h] / c), where E[h] is its average path length over the isolation trees and c is the expected path length of an unsuccessful search in a binary tree of NumObservationsPerLearner nodes. Each tree is grown from a random subsample of the data by recursively splitting on a random variable at a random value, so anomalies, being easier to isolate, obtain shorter paths.

Additional parameters can be specified by Name-Value pair arguments.

NameValue
'NumLearners'the number of isolation trees, a positive integer (default 100).
'NumObservationsPerLearner'the subsample size used to grow each tree, an integer in [3, N] (default min (N, 256)).
'ContaminationFraction'the assumed fraction of anomalies in X, a scalar in [0, 1] (default 0). It sets Mdl.ScoreThreshold to quantile (scores, 1 - ContaminationFraction); when it is 0 the threshold is the maximum score and no training observation is flagged.

Source Code: iforest

Because the trees are grown from random subsamples and random splits, the scores depend on the state of the random number generator and are not reproducible across runs unless the generator is seeded.

Use the isanomaly method of Mdl to detect anomalies in new data.

See also: IsolationForest, isanomaly, lof, robustcov

Source Code: iforest

Flag a handful of outliers around a Gaussian cluster.

 X = [randn(200,2); 6 + randn(10,2)];
 [Mdl, tf, scores] = iforest (X, "ContaminationFraction", 0.05);
plotted figure

 gscatter (X(:,1), X(:,2), tf);
error: Invalid call to legend.  Correct usage is:

 -- legend ()
 -- legend COMMAND
 -- legend (STR1, STR2, ...)
 -- legend (CHARMAT)
 -- legend ({CELLSTR})
 -- legend (..., PROPERTY, VALUE, ...)
 -- legend (HOBJS, ...)
 -- legend ("COMMAND")
 -- legend (HAX, ...)
 -- legend (HLEG, ...)
 -- HLEG = legend (...)
 title ("iforest: inliers vs. flagged anomalies");