# Effectiveness of Tree-based Ensembles for Anomaly Discovery: Insights, Batch and Streaming Active Learning

arXiv: https://arxiv.org/abs/1901.08930 · HTML: https://mlsanity.com/paper/1901.08930/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Jan 2019.

## Built on by (most cited first, 9 of 9)

- [A Survey on Explainable Anomaly Detection](https://mlsanity.com/paper/2210.06959/) (2022)
- [Deep Anomaly Detection under Labeling Budget Constraints](https://mlsanity.com/paper/2302.07832/) (2023)
- [Multitask Active Learning for Graph Anomaly Detection](https://mlsanity.com/paper/2401.13210/) (2024)
- [Wisdom of the Contexts: Active Ensemble Learning for Contextual Anomaly Detection](https://mlsanity.com/paper/2101.11560/) (2021)
- [Little Help Makes a Big Difference: Leveraging Active Learning to Improve Unsupervised Time Series Anomaly Detection](https://mlsanity.com/paper/2201.10323/) (2022)
- [Out-of-Distribution Detection in Time-Series Domain: A Novel Seasonal Ratio Scoring Approach](https://mlsanity.com/paper/2207.04306/) (2022)
- [ProtoAL: Interpretable Deep Active Learning with prototypes for medical imaging](https://mlsanity.com/paper/2404.04736/) (2024)
- [Coniferest: a complete active anomaly detection framework](https://mlsanity.com/paper/2410.17142/) (2024)
- [Training-Free Human-in-the-Loop Anomaly Detection via Memory Bank Correction](https://mlsanity.com/paper/2608.17775/) (2026)

## Abstract (arXiv)

In many real-world AD applications including computer security and fraud prevention, the anomaly detector must be configurable by the human analyst to minimize the effort on false positives. One important way to configure the detector is by providing true labels (nominal or anomaly) for a few instances. Recent work on active anomaly discovery has shown that greedily querying the top-scoring instance and tuning the weights of ensemble detectors based on label feedback allows us to quickly discover true anomalies. This paper makes four main contributions to improve the state-of-the-art in anomaly discovery using tree-based ensembles. First, we provide an important insight that explains the practical successes of unsupervised tree-based ensembles and active learning based on greedy query selection strategy. We also present empirical results on real-world data to support our insights and theoretical analysis to support active learning. Second, we develop a novel batch active learning algorithm to improve the diversity of discovered anomalies based on a formalism called compact description to describe the discovered anomalies. Third, we develop a novel active learning algorithm to handle streaming data setting. We present a data drift detection algorithm that not only detects the drift robustly, but also allows us to take corrective actions to adapt the anomaly detector in a principled manner. Fourth, we present extensive experiments to evaluate our insights and our tree-based active anomaly discovery algorithms in both batch and streaming data settings. Our results show that active learning allows us to discover significantly more anomalies than state-of-the-art unsupervised baselines, our batch active learning algorithm discovers diverse anomalies, and our algorithms under the streaming-data setup are competitive with the batch setup.