Incremental Isolation Forest to Handle Concept Drift in Anomaly Detection

Isolation Forest (iForest) is a well-known model for anomaly detection task. It works by identifying regions corresponding to existing anomalies in the data. With the arrival of new data, concept drift can occur in two ways. First, anomalies can occur in the new regions of the feature space. Second, existing anomalies can become normal with the addition of new data. We observe that the performance of Isolation Forest severely degrades in both these scenarios. Current works fail to tune the existing Isolation Forest to adapt to the concept drift. We propose Incremental Isolation Forest to quickly update the existing Isolation Forest in response to the arrival of new data. Initial experimental results using three real-world datasets indicate that our approach achieves significant time savings with minimal loss in anomaly detection performance.