Multivariate Automatic Tuning of Isolation Forest for Anomaly Detection in Critical Infrastructures: A Solution for Intelligent Information Systems

David Saavedra Pastor, José Vicente Berná Martínez, Lucia Arnau Muñoz, Carlos Calatayud Asensi

2025

Abstract

The Isolation Forest (IF) algorithm is effective in detecting anomalies in critical infrastructure, but its performance depends on the proper setting of five hyperparameters: sample size, number of trees, maximum tree depth, maximum number of features and detection threshold. Static tuning of these parameters is inefficient and poorly adaptable to dynamic environments. This paper proposes a multivariate autotuning method that automatically optimises these hyperparameters by: (1) adaptive adjustment of the sample size based on the standard deviation of the anomaly scores, (2) selection of the number of trees according to F1-score stabilisation, (3) control of the maximum depth based on the average isolation rate, (4) adjustment of the maximum number of features according to the variance of the data, and (5) optimisation of the detection threshold by minimisation of a cost function. The auto-tuning procedure has been validated in the detection of anomalies in drinking water networks, showing an F1-score improvement of 7.5% and a reduction of the execution time by 22.55% compared to static configurations, demonstrating its feasibility for real-time systems.

Paper Citation

in Harvard Style

Pastor D., Martínez J., Muñoz L. and Asensi C. (2025). Multivariate Automatic Tuning of Isolation Forest for Anomaly Detection in Critical Infrastructures: A Solution for Intelligent Information Systems. In Proceedings of the 17th International Joint Conference on Knowledge Discovery, Knowledge Engineering and Knowledge Management - Volume 2: KMIS; ISBN 978-989-758-769-6, SciTePress, pages 393-400. DOI: 10.5220/0013710700004000

in Bibtex Style

@conference{kmis25,
author={David Pastor and José Martínez and Lucia Muñoz and Carlos Asensi},
title={Multivariate Automatic Tuning of Isolation Forest for Anomaly Detection in Critical Infrastructures: A Solution for Intelligent Information Systems},
booktitle={Proceedings of the 17th International Joint Conference on Knowledge Discovery, Knowledge Engineering and Knowledge Management - Volume 2: KMIS},
year={2025},
pages={393-400},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0013710700004000},
isbn={978-989-758-769-6},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 17th International Joint Conference on Knowledge Discovery, Knowledge Engineering and Knowledge Management - Volume 2: KMIS
TI - Multivariate Automatic Tuning of Isolation Forest for Anomaly Detection in Critical Infrastructures: A Solution for Intelligent Information Systems
SN - 978-989-758-769-6
AU - Pastor D.
AU - Martínez J.
AU - Muñoz L.
AU - Asensi C.
PY - 2025
SP - 393
EP - 400
DO - 10.5220/0013710700004000
PB - SciTePress