Extended Isolation Forest

The foundational algorithm upon which Extended Isolation Forest is built. It isolates observations by randomly selecting a feature and then randomly selecting a split value between the maximum and minimum values of that feature.

• Core Insight: Anomalies are 'few and different,' requiring fewer random splits to be isolated.
• Key Limitation: Uses axis-parallel splits only, creating a bias that produces ghost-like regions of low anomaly scores in high-dimensional space.
• Path Length: The average number of splits required to isolate a point across an ensemble of trees serves as the anomaly score.

A streaming anomaly detection algorithm closely related to Isolation Forest, designed for dynamic, evolving data streams rather than static batch processing.

• Dynamic Insertion/Deletion: Anomaly scores are derived from the expected change in model complexity caused by inserting or deleting a point.
• Collusive Anomalies: RRCF is particularly adept at detecting collusive groups—multiple points that are anomalous only when considered together, a common pattern in coordinated fraud rings.
• Streaming First: Unlike batch algorithms, RRCF naturally handles concept drift and seasonality in real-time transaction flows.

A density-based anomaly detection algorithm that computes the local density deviation of a given data point with respect to its k-nearest neighbors.

• Local vs. Global: Unlike Isolation Forest which identifies global outliers, LOF identifies points that are anomalous relative to their local neighborhood.
• Reachability Distance: The core metric that measures how far a point is from its neighbors, normalized by the density of the neighborhood itself.
• Fraud Application: Effective for detecting micro-clusters of fraud where fraudulent transactions mimic local patterns but deviate from broader regional behavior.

A neural network trained to copy its input to its output through a bottleneck layer, learning a compressed representation of normal data.

• Reconstruction Error: Anomalies are identified by a high reconstruction error—the model fails to accurately reconstruct inputs that deviate from learned normal patterns.
• Non-Linear Manifolds: Unlike tree-based methods, autoencoders can learn complex non-linear manifolds of normal behavior, making them powerful for high-dimensional transactional data.
• Variants: Variational Autoencoders (VAEs) provide a reconstruction probability rather than raw error, offering a more principled anomaly score with uncertainty quantification.

An unsupervised extension of Support Vector Machines that learns a decision boundary around the majority of normal data in a high-dimensional kernel space.

• Kernel Trick: Uses Radial Basis Function (RBF) or other kernels to map data into a space where normal instances can be cleanly separated from the origin.
• ν (nu) Parameter: Controls the upper bound on the fraction of training errors and the lower bound on the fraction of support vectors, effectively tuning the false positive rate.
• Comparison to EIF: One-Class SVM is computationally heavier than Extended Isolation Forest for large datasets but can capture complex, non-axis-aligned boundaries with appropriate kernel selection.

A technique for setting anomaly detection thresholds adaptively based on the statistical properties of a rolling window of historical anomaly scores.

• Static vs. Dynamic: Static thresholds fail in the presence of seasonality, trend, and concept drift—all common in financial transaction volumes.
• Rolling Statistics: Thresholds are computed using moving averages and standard deviations over configurable windows, automatically adjusting to cyclical patterns like hourly or weekly transaction spikes.
• Integration with EIF: Extended Isolation Forest scores can be fed into a dynamic thresholding layer to reduce false positives during legitimate high-volume periods like Black Friday or salary disbursement days.