Isolation Forest

Unlike density or distance-based methods, Isolation Forest does not model normality. It builds an ensemble of random binary trees by recursively partitioning the feature space on randomly selected split values. Anomalies are isolated closer to the root of the tree because they are few and different, requiring fewer random splits to be separated from the rest of the data. Normal points, being dense and consistent, require deeper partitioning.

The algorithm operates with a linear time complexity of O(n) and a low memory footprint. This efficiency is achieved because:

• Trees do not need to be fully grown; anomaly detection relies on shallow splits.
• Sub-sampling is used to build each tree, reducing the data size per estimator.
• No pairwise distance calculations are required, unlike k-Nearest Neighbors or Local Outlier Factor. This makes it suitable for high-volume streaming data and real-time spectrum monitoring.

The anomaly score for a data point is derived from the average path length across all trees in the ensemble, normalized by the expected path length of a failed search in a Binary Search Tree.

• Score near 1: Indicates a definite anomaly (very short path length).
• Score near 0.5: Indicates a normal instance (path length close to average).
• Score below 0.5: Suggests a point in a very dense region, potentially safe. This bounded score provides an intuitive and directly interpretable metric for spectrum enforcement.

Isolation Forest employs random sub-sampling to build each iTree. This technique provides two critical benefits:

• Reduces swamping: By not using the full dataset, the model is less likely to group normal points with anomalies, a common failure mode in distance-based methods.
• Reduces masking: The presence of too many anomalies in a sample can mask their own signal. Sub-sampling limits the number of anomalies per tree, making their isolation more pronounced and detectable.

The algorithm is robust to the curse of dimensionality because it does not rely on distance measures that become meaningless in high-dimensional spaces. Each split randomly selects a single feature, making the model effective for wideband spectrum data with thousands of frequency bins. Feature bagging can be further applied to select a random subset of features for each tree, improving diversity and performance on high-dimensional I/Q sample vectors.

Isolation Forest is a non-parametric and assumption-free algorithm. It does not require the data to conform to a Gaussian distribution or any specific statistical model. This is critical for spectrum anomaly detection, where the electromagnetic environment is a complex mixture of unknown signal types, noise floors, and interference patterns that cannot be easily parameterized. The model adapts purely to the structural properties of the data.

A multivariate distance metric that measures how many standard deviations a point is from the mean of a distribution, accounting for the covariance structure of the data. Unlike Euclidean distance, Mahalanobis distance corrects for feature correlations inherent in spectrum data, such as the relationship between adjacent FFT bins. An anomaly score is computed as the squared Mahalanobis distance, which follows a chi-squared distribution under normality assumptions. This statistical grounding allows operators to set anomaly thresholds with known false-alarm probabilities, critical for spectrum enforcement applications.

A neural network approach where a model is trained to compress and reconstruct normal spectrum data. The core principle: an autoencoder learns the latent manifold of legitimate signals and will produce high reconstruction error when attempting to reconstruct anomalous inputs it has never seen. The anomaly score is typically the mean squared error between the input spectrogram and its reconstruction. Variants include LSTM autoencoders for temporal spectrum sequences and convolutional autoencoders for time-frequency representations, enabling detection of subtle deviations in signal structure.

A higher-order statistical measure that quantifies the peakedness of a signal's power spectral density relative to a Gaussian distribution. Spectral kurtosis is computed as the normalized fourth-order cumulant of the frequency-domain representation. A value of zero indicates Gaussian noise, while significant positive values indicate impulsive or structured interference. This technique is computationally lightweight and can operate on raw FFT outputs without training, making it ideal for real-time front-end screening before more computationally intensive anomaly detectors like Isolation Forest are invoked.