# Detecting Anomalous User Behavior Using an Extended Isolation Forest Algorithm: An Enterprise Case Study

arXiv: https://arxiv.org/abs/1609.06676 · HTML: https://mlsanity.com/paper/1609.06676/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Sep 2016.

## Built on by (most cited first, 5 of 5)

- [Multi-Perspective Content Delivery Networks Security Framework Using Optimized Unsupervised Anomaly Detection](https://mlsanity.com/paper/2107.11514/) (2021)
- [Unsupervised Ensemble Methods for Anomaly Detection in PLC-based Process Control](https://mlsanity.com/paper/2302.02097/) (2023)
- [Semi-Supervised Anomaly Detection Based on Quadratic Multiform Separation](https://mlsanity.com/paper/2208.08265/) (2022)
- [Two-phase Dual COPOD Method for Anomaly Detection in Industrial Control System](https://mlsanity.com/paper/2305.00982/) (2023)
- [Forensic Data Analytics for Anomaly Detection in Evolving Networks](https://mlsanity.com/paper/2308.09171/) (2023)

## Abstract (arXiv)

Anomalous user behavior detection is the core component of many information security systems, such as intrusion detection, insider threat detection and authentication systems. Anomalous behavior will raise an alarm to the system administrator and can be further combined with other information to determine whether it constitutes an unauthorised or malicious use of a resource. This paper presents an anomalous user behaviour detection framework that applies an extended version of Isolation Forest algorithm. Our method is fast and scalable and does not require example anomalies in the training data set. We apply our method to an enterprise dataset. The experimental results show that the system is able to isolate anomalous instances from the baseline user model using a single feature or combined features.