R: Multivariate Outlier Detection and Replacement

outForest {outForest}

R Documentation

Multivariate Outlier Detection and Replacement

Description

This function provides a random forest based implementation of the method described in Chapter 7.1.2 ("Regression Model Based Anomaly detection") of Chandola et al. Each numeric variable to be checked for outliers is regressed onto all other variables using a random forest. If the scaled absolute difference between observed value and out-of-bag prediction is larger than some predefined threshold (default is 3), then a value is considered an outlier, see Details below. After identification of outliers, they can be replaced, e.g., by predictive mean matching from the non-outliers.

Usage

outForest(
  data,
  formula = . ~ .,
  replace = c("pmm", "predictions", "NA", "no"),
  pmm.k = 3L,
  threshold = 3,
  max_n_outliers = Inf,
  max_prop_outliers = 1,
  min.node.size = 40L,
  allow_predictions = FALSE,
  impute_multivariate = TRUE,
  impute_multivariate_control = list(pmm.k = 3L, num.trees = 50L, maxiter = 3L),
  seed = NULL,
  verbose = 1,
  ...
)

Arguments

`data`	A `data.frame` to be assessed for numeric outliers.
`formula`	A two-sided formula specifying variables to be checked (left hand side) and variables used to check (right hand side). Defaults to `. ~ .`, i.e., use all variables to check all (numeric) variables.
`replace`	Should outliers be replaced via predictive mean matching "pmm" (default), by "predictions", or by `NA` ("NA"). Use "no" to keep outliers as they are.
`pmm.k`	For `replace = "pmm"`, from how many nearest OOB prediction neighbours (from the original non-outliers) to sample?
`threshold`	Threshold above which an outlier score is considered an outlier. The default is 3.
`max_n_outliers`	Maximal number of outliers to identify. Will be used in combination with `threshold` and `max_prop_outliers`.
`max_prop_outliers`	Maximal relative count of outliers. Will be used in combination with `threshold` and `max_n_outliers`.
`min.node.size`	Minimal node size of the random forests. With 40, the value is relatively high. This reduces the impact of outliers.
`allow_predictions`	Should the resulting "outForest" object be applied to new data? Default is `FALSE`.
`impute_multivariate`	If `TRUE` (default), missing values are imputed by `missRanger::missRanger()`. Otherwise, by univariate sampling.
`impute_multivariate_control`	Parameters passed to `missRanger::missRanger()` (only if data contains missing values).
`seed`	Integer random seed.
`verbose`	Controls how much outliers is printed to screen. 0 to print nothing, 1 prints information.
`...`	Arguments passed to `ranger::ranger()`. If the data set is large, use less trees (e.g. `num.trees = 20`) and/or a low value of `mtry`.

Details

The method can be viewed as a multivariate extension of a basic univariate outlier detection method where a value is considered an outlier if it is more than, e.g., three times the standard deviation away from its mean. In the multivariate case, instead of comparing a value with the overall mean, rather the difference to the conditional mean is considered. outForest() estimates this conditional mean by a random forest. If the method is trained on a reference data with option allow_predictions = TRUE, it can even be applied to new data.

The outlier score of the ith value x_{ij} of the jth variable is defined as s_{ij} = (x_{ij} - p_{ij}) / \textrm{rmse}_j, where p_{ij} is the corresponding out-of-bag prediction of the jth random forest and \textrm{rmse}_j its RMSE. If |s_{ij}| > L with threshold L, then x_{ij} is considered an outlier.

For large data sets, just by chance, many values can surpass the default threshold of 3. To reduce the number of outliers, the threshold can be increased. Alternatively, the number of outliers can be limited by the two arguments max_n_outliers and max_prop_outliers. For instance, if at most ten outliers are to be identified, set max_n_outliers = 10.

Since the random forest algorithm "ranger" does not allow for missing values, any missing value is first being imputed by chained random forests.

Value

An object of class "outForest" and a list with the following elements.

Data: Original data set in unchanged row order but optionally with outliers replaced. Can be extracted with the Data() function.
outliers: Compact representation of outliers, for details see the outliers() function used to extract them.
n_outliers: Number of outliers per v.
is_outlier: Logical matrix with outlier status. NULL if allow_predictions = FALSE.
predData: data.frame with OOB predictions. NULL if allow_predictions = FALSE.
allow_predictions: Same as allow_predictions.
v: Variables checked.
threshold: The threshold used.
rmse: Named vector of RMSEs of the random forests. Used for scaling the difference between observed values and predicted.
forests: Named list of fitted random forests. NULL if allow_predictions = FALSE.
used_to_check: Variables used for checking v.
mu: Named vector of sample means of the original v (incl. outliers).

References

Chandola V., Banerjee A., and Kumar V. (2009). Anomaly detection: A survey. ACM Comput. Surv. 41, 3, Article 15 <dx.doi.org/10.1145/1541880.1541882>.
Wright, M. N. & Ziegler, A. (2016). ranger: A Fast Implementation of Random Forests for High Dimensional Data in C++ and R. Journal of Statistical Software, in press. <arxiv.org/abs/1508.04409>.

Examples

head(irisWithOut <- generateOutliers(iris, seed = 345))
(out <- outForest(irisWithOut))
outliers(out)
head(Data(out))
plot(out)
plot(out, what = "scores")

[Package outForest version 1.0.1 Index]