siForest: Detecting Network Anomalies with Set-Structured Isolation Forest

Modern cybersecurity systems face the overwhelming challenge of analyzing billions of daily network interactions to identify potential threats, driving the demand for reliable and high-performance anomaly detection algorithms for network defense. This paper investigates the use of the Isolation Forest (iForest) machine learning algorithm and its modification for detecting anomalies in internet scan data. In particular, it presents the Set-Partitioned Isolation Forest (siForest), a novel extension of the iForest method designed to detect anomalies in set-structured data. By treating instances such as sets of multiple network scans with the same IP address as cohesive units, siForest effectively addresses some challenges of analyzing complex, multidimensional datasets. Experiments on synthetic datasets simulating different anomaly scenarios in network traffic demonstrate that siForest has the potential to outperform traditional approaches on some types of internet scan data.