{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T00:18:35Z","timestamp":1777508315589,"version":"3.51.4"},"reference-count":48,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2021,1,19]],"date-time":"2021-01-19T00:00:00Z","timestamp":1611014400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>Detecting anomalies in streaming data is an important issue for many application domains, such as cybersecurity, natural disasters, or bank frauds. Different approaches have been designed in order to detect anomalies: statistics-based, isolation-based, clustering-based, etc. In this paper, we present a structured survey of the existing anomaly detection methods for data streams with a deep view on Isolation Forest (iForest). We first provide an implementation of Isolation Forest Anomalies detection in Stream Data (IForestASD), a variant of iForest for data streams. This implementation is built on top of scikit-multiflow (River), which is an open source machine learning framework for data streams containing a single anomaly detection algorithm in data streams, called Streaming half-space trees. We performed experiments on different real and well known data sets in order to compare the performance of our implementation of IForestASD and half-space trees. Moreover, we extended the IForestASD algorithm to handle drifting data by proposing three algorithms that involve two main well known drift detection methods: ADWIN and KSWIN. ADWIN is an adaptive sliding window algorithm for detecting change in a data stream. KSWIN is a more recent method and it refers to the Kolmogorov\u2013Smirnov Windowing method for concept drift detection. More precisely, we extended KSWIN to be able to deal with n-dimensional data streams. We validated and compared all of the proposed methods on both real and synthetic data sets. In particular, we evaluated the F1-score, the execution time, and the memory consumption. The experiments show that our extensions have lower resource consumption than the original version of IForestASD with a similar or better detection efficiency.<\/jats:p>","DOI":"10.3390\/computers10010013","type":"journal-article","created":{"date-parts":[[2021,1,19]],"date-time":"2021-01-19T11:39:55Z","timestamp":1611056395000},"page":"13","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":51,"title":["Anomalies Detection Using Isolation in Concept-Drifting Data Streams"],"prefix":"10.3390","volume":"10","author":[{"given":"Maurras Ulbricht","family":"Togbe","sequence":"first","affiliation":[{"name":"ISEP, LISITE, 75006 Paris, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yousra","family":"Chabchoub","sequence":"additional","affiliation":[{"name":"ISEP, LISITE, 75006 Paris, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4810-5728","authenticated-orcid":false,"given":"Aliou","family":"Boly","sequence":"additional","affiliation":[{"name":"Facult\u00e9 des Sciences et Techniques (FST)\/D\u00e9partement Math\u00e9matiques et Informatique, Universit\u00e9 Cheikh Anta Diop de Dakar, Dakar-Fann BP 5005, Senegal"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mariam","family":"Barry","sequence":"additional","affiliation":[{"name":"T\u00e9l\u00e9com Paris, LTCI, Institut Polytechnique de Paris, 91120 Palaiseau, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Raja","family":"Chiky","sequence":"additional","affiliation":[{"name":"ISEP, LISITE, 75006 Paris, France"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Maroua","family":"Bahri","sequence":"additional","affiliation":[{"name":"T\u00e9l\u00e9com Paris, LTCI, Institut Polytechnique de Paris, 91120 Palaiseau, France"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2021,1,19]]},"reference":[{"key":"ref_1","first-page":"1","article-title":"Scikit-Multiflow: A Multi-output Streaming Framework","volume":"19","author":"Montiel","year":"2018","journal-title":"J. Mach. Learn. Res."},{"key":"ref_2","unstructured":"Tan, S.C., Ting, K.M., and Liu, F.T. (2011, January 16\u201322). Fast Anomaly Detection for Streaming Data. Proceedings of the Twenty-Second international joint conference on Artificial Intelligence, Catalonia, Spain."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"12","DOI":"10.3182\/20130902-3-CN-3020.00044","article-title":"An anomaly detection approach based on isolation forest algorithm for streaming data using sliding window","volume":"46","author":"Ding","year":"2013","journal-title":"IFAC Proc. Vol."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Bifet, A., and Gavald\u00e0, R. (2009, January 31August\u20132). Adaptive learning from evolving data streams. Proceedings of the Intelligent Data Analysis (IDA), Lyon, France.","DOI":"10.1007\/978-3-642-03915-7_22"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Raab, C., Heusinger, M., and Schleif, F.M. (2020). Reactive Soft Prototype Computing for Concept Drift Streams. arXiv.","DOI":"10.1016\/j.neucom.2019.11.111"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Aggarwal, C.C., and Philip, S.Y. (2007). Aggarwal, C.C.; Philip, S.Y. A survey of synopsis construction in data streams. Data Streams, Springer.","DOI":"10.1007\/978-0-387-47534-9"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Gama, J., and Gaber, M.M. (2007). Learning from Data Streams: Processing Techniques in Sensor Networks, Springer.","DOI":"10.1007\/3-540-73679-4"},{"key":"ref_8","first-page":"44","article-title":"A survey on concept drift adaptation","volume":"46","author":"Gama","year":"2014","journal-title":"Comput. Surv. (CSUR)"},{"key":"ref_9","unstructured":"Ikonomovska, E., Loskovska, S., and Gjorgjevik, D. (2007, January 20\u201323). A survey of stream data mining. Proceedings of the 8th National Conference with International Participation, Philadelphia, PA, USA."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Ng, W., and Dash, M. (2010). Discovery of frequent patterns in transactional data streams. Transactions on Large-Scale Data-and Knowledge-Centered Systems II, Springer.","DOI":"10.1007\/978-3-642-16175-9_1"},{"key":"ref_11","unstructured":"Aggarwal, C.C. (2007). Data Streams: Models and Algorithms, Springer Science & Business Media."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1145\/3373464.3373470","article-title":"Machine learning for streaming data: State of the art, challenges, and opportunities","volume":"21","author":"Gomes","year":"2019","journal-title":"ACM SIGKDD Explor. Newsl."},{"key":"ref_13","first-page":"1601","article-title":"MOA: Massive Online Analysis","volume":"11","author":"Bifet","year":"2010","journal-title":"J. Mach. Learn. Res."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Bifet, A., Gavald\u00e0, R., Holmes, G., and Pfahringer, B. (2018). Machine Learning for Data Streams with Practical Examples in MOA, MIT Press. Available online: https:\/\/moa.cms.waikato.ac.nz\/book\/.","DOI":"10.7551\/mitpress\/10654.001.0001"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Bifet, A., and Morales, G.D.F. (2014, January 14). Big Data Stream Learning with SAMOA. Proceedings of the 2014 IEEE International Conference on Data Mining Workshop, Shenzhen, China.","DOI":"10.1109\/ICDMW.2014.24"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Bifet, A., Maniu, S., Qian, J., Tian, G., He, C., and Fan, W. (2015, January 14\u201317). StreamDM: Advanced Data Mining in Spark Streaming. Proceedings of the International Conference on Data Mining Workshops (ICDMW), Atlantic City, NJ, USA.","DOI":"10.1109\/ICDMW.2015.140"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Behera, R.K., Das, S., Jena, M., Rath, S.K., and Sahoo, B. (2017, January 27\u201329). A Comparative Study of Distributed Tools for Analyzing Streaming Data. Proceedings of the International Conference on Information Technology (ICIT), Singapore.","DOI":"10.1109\/ICIT.2017.32"},{"key":"ref_18","unstructured":"Inoubli, W., Aridhi, S., Mezni, H., Maddouri, M., and Nguifo, E. (2018, January 27\u201331). A comparative study on streaming frameworks for big data. Proceedings of the Very Large Data Bases (VLDB), Rio de Janeiro, Brazil."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1023\/B:AIRE.0000045502.10941.a9","article-title":"A survey of outlier detection methodologies","volume":"22","author":"Hodge","year":"2004","journal-title":"Artif. Intell. Rev."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly detection: A survey","volume":"41","author":"Chandola","year":"2009","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Aggarwal, C.C. (2017). Outlier Analysis, Springer International Publishing AG. [2nd ed.].","DOI":"10.1007\/978-3-319-47578-3"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"2250","DOI":"10.1109\/TKDE.2013.184","article-title":"Outlier detection for temporal data: A survey","volume":"26","author":"Gupta","year":"2014","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_23","first-page":"13","article-title":"Survey on outlier detection in data stream","volume":"136","author":"Thakkar","year":"2016","journal-title":"Int. J. Comput. Appl."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Tellis, V.M., and D\u2019Souza, D.J. (2018, January 23\u201324). Detecting Anomalies in Data Stream Using Efficient Techniques: A Review. Proceedings of the 2018 International Conference ICCPCCT, Kerala, India.","DOI":"10.1109\/ICCPCCT.2018.8574310"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1145\/3229329.3229332","article-title":"A survey on anomaly detection in evolving data: [with application to forest fire risk prediction]","volume":"20","author":"Salehi","year":"2018","journal-title":"ACM SIGKDD Explor. Newsl."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Liu, F.T., Ting, K.M., and Zhou, Z.H. (2008, January 15\u201319). Isolation forest. Proceedings of the 2008 Eighth IEEE International Conference on Data Mining, Pisa, Italy.","DOI":"10.1109\/ICDM.2008.17"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"275","DOI":"10.1023\/B:DAMI.0000023676.72185.7c","article-title":"On-line unsupervised outlier detection using finite mixtures with discounting learning algorithms","volume":"8","author":"Yamanishi","year":"2004","journal-title":"Data Min. Knowl. Discov."},{"key":"ref_28","unstructured":"Aggarwal, C.C., Han, J., Wang, J., and Yu, P.S. (2003, January 9\u201312). A framework for clustering evolving data streams. Proceedings of the 29th International Conference on Very Large Data Bases-Volume 29, VLDB Endowment, Berlin, Germany."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Assent, I., Kranen, P., Baldauf, C., and Seidl, T. (2012). Anyout: Anytime outlier detection on streaming data. International Conference on Database Systems for Advanced Applications, Springer.","DOI":"10.1007\/978-3-642-29038-1_18"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Angiulli, F., and Fassetti, F. (2007, January 6\u201310). Detecting distance-based outliers in streams of data. Proceedings of the Sixteenth ACM Conference on Conference on Information and Knowledge Management, ACM, Lisbon, Portugal.","DOI":"10.1145\/1321440.1321552"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Pokrajac, D., Lazarevic, A., and Latecki, L.J. (2007, January 1\u20135). Incremental local outlier detection for data streams. Proceedings of the 2007 IEEE Symposium on Computational Intelligence and Data Mining, Honolulu, HI, USA.","DOI":"10.1109\/CIDM.2007.368917"},{"key":"ref_32","first-page":"109","article-title":"Etude comparative des m\u00e9thodes de d\u00e9tection d\u2019anomalies","volume":"RNTI-E-36","author":"Togbe","year":"2020","journal-title":"Rev. Des. Nouv. Technol. L\u2019Inf."},{"key":"ref_33","first-page":"3","article-title":"Isolation-based anomaly detection","volume":"6","author":"Liu","year":"2012","journal-title":"ACM Trans. Knowl. Discov. Data (TKDD)"},{"key":"ref_34","unstructured":"Hariri, S., Kind, M.C., and Brunner, R.J. (2018). Extended Isolation Forest. arXiv."},{"key":"ref_35","unstructured":"Staerman, G., Mozharovskyi, P., Cl\u00e9men\u00e7on, S., and d\u2019Alch\u00e9 Buc, F. (2019). Functional Isolation Forest. arXiv."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Liu, F.T., Ting, K.M., and Zhou, Z.H. (2010, January 20\u201324). On detecting clustered anomalies using SCiForest. Proceedings of the Joint European Conference on Machine Learning and Knowledge Discovery in Databases, Barcelona, Spain.","DOI":"10.1007\/978-3-642-15883-4_18"},{"key":"ref_37","unstructured":"Marteau, P.F., Soheily-Khah, S., and B\u00e9chet, N. (2017). Hybrid Isolation Forest-Application to Intrusion Detection. arXiv."},{"key":"ref_38","unstructured":"Cortes, D. (2019). Distance approximation using isolation forests. arXiv."},{"key":"ref_39","unstructured":"Liao, L., and Luo, B. (2018, January 16\u201317). Entropy isolation forest based on dimension entropy for anomaly detection. Proceedings of the International Symposium on Intelligence Computation and Applications, Guangzhou, China."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Zhang, X., Dou, W., He, Q., Zhou, R., Leckie, C., Kotagiri, R., and Salcic, Z. (2017, January 19\u201322). LSHiForest: A generic framework for fast tree isolation based ensemble anomaly analysis. Proceedings of the 2017 IEEE 33rd International Conference on Data Engineering (ICDE), San Diego, CA, USA.","DOI":"10.1109\/ICDE.2017.145"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Xu, D., Wang, Y., Meng, Y., and Zhang, Z. (2017, January 9\u201310). An Improved Data Anomaly Detection Method Based on Isolation Forest. Proceedings of the2017 10th International Symposium on Computational Intelligence and Design (ISCID), Hangzhou, China.","DOI":"10.1109\/ISCID.2017.202"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"968","DOI":"10.1111\/coin.12156","article-title":"Isolation-based anomaly detection using nearest-neighbor ensembles","volume":"34","author":"Bandaragoda","year":"2018","journal-title":"Comput. Intell."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Bifet, A., and Gavalda, R. (2007, January 26\u201328). Learning from time-changing data with adaptive windowing. Proceedings of the 2007 SIAM International Conference on Data Mining, SIAM, Minneapolis, MN, USA.","DOI":"10.1137\/1.9781611972771.42"},{"key":"ref_44","first-page":"23","article-title":"A survey on ensemble learning for data stream classification","volume":"50","author":"Gomes","year":"2017","journal-title":"Comput. Surv. (CSUR)"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"68","DOI":"10.1080\/01621459.1951.10500769","article-title":"The Kolmogorov-Smirnov test for goodness of fit","volume":"46","author":"Massey","year":"1951","journal-title":"J. Am. Stat. Assoc."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Lovric, M. (2011). Kolmogorov-Smirnov Test. International Encyclopedia of Statistical Science, Springer.","DOI":"10.1007\/978-3-642-04898-2"},{"key":"ref_47","unstructured":"Dua, D., and Graff, C. (2017). UCI Machine Learning Repository, UCI."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Street, W.N., and Kim, Y. (2001, January 26\u201329). A streaming ensemble algorithm (SEA) for large-scale classification. Proceedings of the Seventh ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA.","DOI":"10.1145\/502512.502568"}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/10\/1\/13\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T05:12:48Z","timestamp":1760159568000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/10\/1\/13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,1,19]]},"references-count":48,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2021,1]]}},"alternative-id":["computers10010013"],"URL":"https:\/\/doi.org\/10.3390\/computers10010013","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,1,19]]}}}