Abstract: Extended Isolation Forest （EIF） effectively solves the problem that Isolation Forest（iForest） is not sensitive to local abnormal points， but EIF replaces the isolated condition of axis-parallel with a hyperplane with random slope， which causes the algorithm model to lose part of the generalization ability， and increases time cost due to a large number of vector dot multiplication operations. In response to the above situation， an Extended Isolation Forest based on Simulated Annealing （SA-EIF） is proposed. The algorithm calculates the accuracy value and the difference value of each iTree （Isolation Tree） according to the prediction result of each iTree for the data set， then builds fitness function based on this. Finally， the iTree with better detection performance is selected by the simulated annealing algorithm to construct integrative learning model. The experimental results of K-fold cross-validation in the ODDS anomaly detection dataset indicate that the SA-EIF algorithm is sensitive to local anomalies， reducing the time cost by 20%~40% compared with EIF， and the recognition accuracy is about 5%~10% higher than EIF.

Key words: extended isolation forest, isolation forest, simulated annealing, anomaly detection