IFAD: Privacy-Preserving Isolation Forest Based Anomaly Detection in Public Cloud Environments

Anomaly detection plays a vital role in processing multi-source data through public cloud servers, yet existing privacy-preserving schemes fail to efficiently detect anomalies while protecting data source privacy. Although isolation forest offer advantages for unsupervised high-dimensional data analysis, implementing its tree-based privacy-preserving mechanisms remains challenging. In this paper, we propose IFAD, a novel isolation forest-based scheme for detecting anomalies in private data. IFAD guarantees end-to-end privacy protection by safeguarding original data, tree structures, and intermediate information throughout detection workflows. Our design achieves efficiency through three key contributions: 1) Cryptographic building blocks combining function secret sharing (FSS) and secret sharing (SS) to enable secure computations; 2) A split index protocol and layer update protocol to facilitate efficient, layer-by-layer isolation forest construction; 3) A detection phase optimization converting the anomaly score calculations into lookup table operations. Experimental evaluations demonstrate that IFAD achieves superior performance, outperforming prior schemes by 2.4×-3.1× in runtime under LAN and WAN environments, and by 1.8×-7.8× in online communication overhead, while maintaining comparable detection accuracy. Our solution establishes an effective balance between privacy preservation and operational efficiency for cloud-based anomaly detection.