# Random Partitioning Forest for Point-Wise and Collective Anomaly Detection -- Application to Intrusion Detection

arXiv: https://arxiv.org/abs/2006.16801 · HTML: https://mlsanity.com/paper/2006.16801/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Jun 2020.

## Built on by (most cited first, 10 of 10)

- [SoK: The Impact of Unlabelled Data in Cyberthreat Detection](https://mlsanity.com/paper/2205.08944/) (2022)
- [Anomaly Detection Based on Isolation Mechanisms: A Survey](https://mlsanity.com/paper/2403.10802/) (2024)
- [Semi-WTC: A Practical Semi-supervised Framework for Attack Categorization through Weight-Task Consistency](https://mlsanity.com/paper/2205.09669/) (2022)
- [An Iterative Method for Unsupervised Robust Anomaly Detection Under Data Contamination](https://mlsanity.com/paper/2309.09436/) (2023)
- [Edge Conditional Node Update Graph Neural Network for Multi-variate Time Series Anomaly Detection](https://mlsanity.com/paper/2401.13872/) (2024)
- [Multidomain transformer-based deep learning for early detection of network intrusion](https://mlsanity.com/paper/2309.01070/) (2023)
- [CARE: Ensemble Adversarial Robustness Evaluation Against Adaptive Attackers for Security Applications](https://mlsanity.com/paper/2401.11126/) (2024)
- [Investigating Mask-aware Prototype Learning for Tabular Anomaly Detection](https://mlsanity.com/paper/2506.02757/) (2025)
- [Unsupervised Online Detection of Pipe Blockages and Leakages in Water Distribution Networks](https://mlsanity.com/paper/2508.16336/) (2025)
- [Targeted Adversarial Traffic Generation : Black-box Approach to Evade Intrusion Detection Systems in IoT Networks](https://mlsanity.com/paper/2603.23438/) (2026)

## Abstract (arXiv)

In this paper, we propose DiFF-RF, an ensemble approach composed of random partitioning binary trees to detect point-wise and collective (as well as contextual) anomalies. Thanks to a distance-based paradigm used at the leaves of the trees, this semi-supervised approach solves a drawback that has been identified in the isolation forest (IF) algorithm. Moreover, taking into account the frequencies of visits in the leaves of the random trees allows to significantly improve the performance of DiFF-RF when considering the presence of collective anomalies. DiFF-RF is fairly easy to train, and excellent performance can be obtained by using a simple semi-supervised procedure to setup the extra hyper-parameter that is introduced. We first evaluate DiFF-RF on a synthetic data set to i) verify that the limitation of the IF algorithm is overcome, ii) demonstrate how collective anomalies are actually detected and iii) to analyze the effect of the meta-parameters it involves. We assess the DiFF-RF algorithm on a large set of datasets from the UCI repository, as well as two benchmarks related to intrusion detection applications. Our experiments show that DiFF-RF almost systematically outperforms the IF algorithm, but also challenges the one-class SVM baseline and a deep learning variational auto-encoder architecture. Furthermore, our experience shows that DiFF-RF can work well in the presence of small-scale learning data, which is conversely difficult for deep neural architectures. Finally, DiFF-RF is computationally efficient and can be easily parallelized on multi-core architectures.