[Paper Review] Interpretable Anomaly Detection with DIFFI: Depth-based Isolation Forest Feature Importance

Mattia Carletti, Matteo Terzi+1 more|arXiv (Cornell University)|Jul 21, 2020

Anomaly Detection Techniques and Applications53 references13 citations

TL;DR

This paper proposes DIFFI, a computationally efficient method for computing global and local feature importance in Isolation Forests, enhancing interpretability in unsupervised anomaly detection. DIFFI enables interpretable anomaly detection and unsupervised feature selection with performance comparable to state-of-the-art methods like SHAP, but at significantly lower computational cost.

ABSTRACT

Anomaly Detection is an unsupervised learning task aimed at detecting anomalous behaviours with respect to historical data. In particular, multivariate Anomaly Detection has an important role in many applications thanks to the capability of summarizing the status of a complex system or observed phenomenon with a single indicator (typically called `Anomaly Score') and thanks to the unsupervised nature of the task that does not require human tagging. The Isolation Forest is one of the most commonly adopted algorithms in the field of Anomaly Detection, due to its proven effectiveness and low computational complexity. A major problem affecting Isolation Forest is represented by the lack of interpretability, an effect of the inherent randomness governing the splits performed by the Isolation Trees, the building blocks of the Isolation Forest. In this paper we propose effective, yet computationally inexpensive, methods to define feature importance scores at both global and local level for the Isolation Forest. Moreover, we define a procedure to perform unsupervised feature selection for Anomaly Detection problems based on our interpretability method; such procedure also serves the purpose of tackling the challenging task of feature importance evaluation in unsupervised anomaly detection. We assess the performance on several synthetic and real-world datasets, including comparisons against state-of-the-art interpretability techniques, and make the code publicly available to enhance reproducibility and foster research in the field.

Motivation & Objective

• To address the lack of interpretability in Isolation Forests, a widely used but inherently opaque anomaly detection algorithm.
• To provide both global and local feature importance scores that explain which features contribute most to anomaly detection decisions.
• To enable unsupervised feature selection for anomaly detection using interpretability-driven criteria, reducing model complexity and improving performance.
• To develop a method that is computationally efficient and suitable for real-time or resource-constrained applications.
• To enhance user trust and facilitate root cause analysis in industrial and real-world anomaly detection deployments.

Proposed method

• DIFFI computes feature importance based on the average depth of splits in Isolation Trees, leveraging the fact that features causing earlier splits are more relevant to anomaly detection.
• Global feature importance is derived from the average depth reduction across all trees, weighted by feature usage frequency.
• Local feature importance is computed per sample by aggregating depth contributions of features along the path to the anomaly score.
• The method uses the underlying Isolation Forest model’s structure and hyperparameters without requiring additional training or retraining.
• Unsupervised feature selection is performed by ranking features via global DIFFI scores and selecting top-k features to retrain the IF model.
• The approach is designed to be lightweight, requiring minimal hyperparameter tuning, and inherits the default IF hyperparameters for robustness.

Experimental results

Research questions

• RQ1 Can depth-based statistics from Isolation Trees be used to derive meaningful global and local feature importance scores in anomaly detection?
• RQ2 How does the proposed DIFFI method compare in performance and efficiency to existing interpretability techniques like SHAP in unsupervised anomaly detection?
• RQ3 Can DIFFI-based feature selection improve the accuracy and efficiency of Isolation Forests in real-world anomaly detection tasks?
• RQ4 To what extent does DIFFI reduce the need for hyperparameter tuning compared to other unsupervised feature selection methods?
• RQ5 Can DIFFI be effectively applied in real-time or streaming anomaly detection scenarios due to its low computational cost?

Key findings

• DIFFI achieves performance comparable to state-of-the-art interpretability methods like SHAP, particularly in global feature importance estimation, but with significantly lower computational overhead.
• On multiple real-world datasets—including cardio, ionosphere, and musk—DIFFI consistently outperforms Laplacian Score and SPEC in unsupervised feature selection, especially across a wide range of k values (number of selected features).
• DIFFI successfully identifies the optimal feature subset (i.e., the one yielding the highest median F1-score) in most evaluated datasets, demonstrating strong alignment with detection performance.
• The method requires minimal or no hyperparameter tuning, inheriting default Isolation Forest settings, which enhances usability and reproducibility in real-world applications.
• DIFFI enables interpretable anomaly detection with actionable insights, supporting root cause analysis and increasing user trust in model outputs.
• The low computational cost of DIFFI makes it suitable for deployment in real-time or streaming anomaly detection systems, where efficiency is critical.