InfiniSynapse
On this page本页目录
What is Local Outlier Factor?什么是 Local Outlier Factor？
Place this specific workflow in context with the complete statistical outlier guide, which connects the definitions, alternatives, validation steps, and related implementation guides.
可通过完整的统计异常值指南理解本专题在整体流程中的位置；该指南串联了定义、替代方案、验证步骤与相关实施文章。
Local Outlier Factor (LOF) is an unsupervised, density-based anomaly detection algorithm that compares a point's estimated local density with the densities of its k-nearest neighbors. A point is suspicious when it occupies a much sparser pocket than nearby points. Unlike one global cutoff, LOF can find anomalies when valid clusters have different densities.
Local Outlier Factor（LOF）是一种无监督、基于密度的异常检测算法，它把某点的估计局部密度与其 k 个最近邻密度进行比较。当该点所在区域明显更稀疏时，它更可疑。与单一全局阈值不同，LOF 能在合法簇密度不同的数据中发现局部异常。
LOF produces a ranking, not proof that a row is wrong. A high score means unusual relative to this neighborhood. Domain review, provenance checks, and sensitivity analysis are required before deletion or operational action.
LOF 给出排序信号，而不是某行错误的证明。高分表示相对该邻域不寻常。在删除或采取业务行动前，仍需领域复核、来源检查与敏感性分析。
When LOF is useful—and when it is notLOF 适用与不适用的场景
Groups form legitimate clusters of different densities, so observations should be judged against comparable neighbors.
不同群体形成密度不同的合法簇，观测应与可比邻居判断。
Reliable labels are scarce, but a continuous score can prioritize investigation.
可靠标签稀缺，但连续分数可确定调查优先级。
Distance becomes less informative as dimensions grow; feature selection or another detector may be better.
维度增加时距离可能失去区分力，应考虑特征选择或其他检测器。
New-sample scoring needs an explicit novelty reference and drift monitoring.
新样本评分需要明确的新颖性参照与漂移监控。
LOF is distance-sensitive. Mixed data, coordinates, sparse vectors, and time series require a meaningful representation before nearest-neighbor calculations are trustworthy. It does not replace a temporal model when order, trend, or seasonality defines normal behavior.
LOF 对距离敏感。混合数据、坐标、稀疏向量与时间序列必须先构造有意义的表示。若正常行为由顺序、趋势或季节性定义，LOF 不能替代时间模型。
How the LOF algorithm works step by stepLOF 算法的逐步计算原理
- Find the k-neighborhood.找到 k 邻域。Identify k-nearest neighbors under the chosen metric. Ties may enlarge the effective neighborhood.按所选度量找到 k 个最近邻；并列距离可能扩大实际邻域。
- Compute reachability distance.计算可达距离。For neighbor o, take the larger of actual distance d(p,o) and o's k-distance, reducing instability from extremely close points.对邻居 o，取实际距离与 o 的第 k 近邻距离中的较大值，降低极近点造成的不稳定。
- Estimate local reachability density.估计局部可达密度。Average reachability distances and take the inverse. Smaller average distance means higher local density.对可达距离求平均并取倒数；平均距离越小，局部密度越高。
- Average density ratios.平均密度比。Divide each neighbor's density by p's density and average the ratios to obtain LOFk(p).用每个邻居密度除以 p 的密度，再平均得到 LOFk(p)。
Interpretation: around 1 means density similar to neighbors; below 1 can mean denser; increasingly above 1 signals lower local density. No universal threshold exists.
解释：接近 1 表示与邻居密度相似；低于 1 可能更密集；明显高于 1 表示局部密度更低。不存在通用阈值。
Prepare data before LOF anomaly detection运行 LOF 异常检测前的数据准备
- Define rows and peers: state what a row represents and which records are legitimate neighbors.定义行与可比对象：明确一行代表什么，以及哪些记录是合理邻居。
- Audit quality: resolve impossible units, duplicate keys, join explosions, sentinel values, and missingness; otherwise LOF may rank pipeline defects.审计质量：处理不可能单位、重复键、连接膨胀、哨兵值与缺失值，否则 LOF 可能只排列管道缺陷。
- Scale features: use standard or robust scaling when units differ, without leaking future or evaluation data.缩放特征：单位不同时使用标准化或稳健缩放，并避免未来或评估数据泄漏。
- Select meaningful dimensions: keep IDs for traceability but exclude identifiers from distance calculations.选择有意义维度：保留 ID 便于追溯，但不把标识符用于距离计算。
- Separate detection from novelty: decide whether to flag fitted data or score unseen observations against a clean reference set.区分离群与新颖性检测：确定是在拟合数据内标记，还是对未见样本评分。
Choose n_neighbors, metric, and contamination选择 n_neighbors、距离度量与 contamination
| Parameter参数 | Effect作用 | Validation验证 |
|---|---|---|
n_neighbors | Small k reacts to noise; large k smooths neighborhoods and becomes global.小 k 对噪声敏感；大 k 平滑邻域并更接近全局。 | Test around the smallest normal group size and compare rank stability.围绕最小正常群体规模测试，并比较排序稳定性。 |
metric | Defines similarity; Euclidean distance is common for scaled continuous features, not automatically correct.定义相似性；欧氏距离常用于已缩放连续特征，但并非自动正确。 | Inspect whether returned neighbors are semantically plausible.检查返回邻居在业务上是否合理。 |
contamination | Turns scores into labels using an expected share or automatic rule.按预期比例或自动规则把分数转为标签。 | Use review capacity, known prevalence, or validated costs.依据复核能力、已知比例或验证成本。 |
novelty | Enables scoring unseen samples after fitting a reference.允许参照拟合后对未见样本评分。 | Predict only on new data and monitor reference drift.只对新数据预测，并监控参照漂移。 |
Local Outlier Factor in Python with scikit-learn使用 scikit-learn 在 Python 中运行 LOF
This hypothetical example fits an already prepared matrix and preserves a continuous score rather than treating the binary label as unquestionable truth.
以下假设示例对已准备矩阵拟合，并保留连续分数，而不是把二元标签当成不可质疑事实。
from sklearn.neighbors import LocalOutlierFactor
lof = LocalOutlierFactor(n_neighbors=20, contamination="auto")
labels = lof.fit_predict(X_scaled)
lof_score = -lof.negative_outlier_factor_scikit-learn's negative_outlier_factor_ becomes more negative for more abnormal training samples. Negating it makes larger values appear more unusual, but document that transformation. With novelty=True, fit a reference set and call prediction methods only on unseen data.
scikit-learn 的 negative_outlier_factor_ 对更异常训练样本更负。取负后较大值更异常，但必须记录变换。设置 novelty=True 时，应在参照集拟合，并只对未见数据调用预测方法。
Example: detecting a local device anomaly示例：检测设备的局部异常
Assume a hypothetical fleet has two valid regimes: high-load devices form a wide, sparse cluster and low-load devices form a compact cluster. A global rule may overflag valid high-load records. After scaling temperature, vibration, and power, one point has an illustrative LOF of 2.4 while nearby peers are around 1.0. Review calibration, maintenance, mode, timestamps, and transformations. The number 2.4 is an example, not a universal cutoff or product benchmark.
假设设备群有两种合法工况：高负载形成宽松稀疏簇，低负载形成紧凑簇。全局规则可能误报有效高负载记录。缩放温度、振动与功率后，某点示例 LOF 为 2.4，而邻居约为 1.0。应复核校准、维护、模式、时间戳与变换。2.4 仅为示例，不是通用阈值或产品基准。
Local Outlier Factor vs Isolation Forest and global rulesLOF、Isolation Forest 与全局规则对比
| Method方法 | Best signal擅长信号 | Caution注意点 |
|---|---|---|
| LOF | Locally sparse point; unequal cluster densities.局部稀疏点；簇密度不等。 | Sensitive to scaling, metric, k, and dimensionality.对缩放、度量、k 与维度敏感。 |
| Isolation Forest | Points easily isolated through random partitioning; scalable global baseline.随机切分下易隔离的点；可扩展全局基线。 | Does not express local-density contrast as directly.不如 LOF 直接表达局部密度差异。 |
| IQR / z-score | Transparent univariate tail rules.透明单变量尾部规则。 | Cannot represent multivariate local neighborhoods.无法表达多变量局部邻域。 |
Interpret Local Outlier Factor scores and choose a threshold解释 Local Outlier Factor 分数并选择阈值
An LOF value is a relative density ratio, not a probability that a record is wrong. In the original formulation, a value near 1 means the observation has density similar to its neighbors. Values materially above 1 indicate that the observation is locally sparser, with larger values representing stronger evidence of local isolation. The scale depends on the data, features, metric, and neighborhood size, so a score such as 1.8 cannot be interpreted with a universal severity label across models or data sets.
LOF 值是相对密度比，不是记录出错的概率。在原始定义中，接近 1 表示该观测与其邻居密度相似；明显大于 1 表示该观测在局部更稀疏，数值越大通常代表局部孤立证据越强。分数尺度取决于数据、特征、距离度量和邻居数量，因此不能把 1.8 等分数跨模型或跨数据集套用统一的严重程度标签。
| Output输出 | Meaning含义 | Practical check实践检查 |
|---|---|---|
| Original LOF value原始 LOF 值 | About 1 is neighbor-like; higher values indicate lower local density.约等于 1 表示与邻居相似；更高值表示局部密度更低。 | Inspect the actual neighbors and distances before assigning meaning.赋予业务含义前，检查实际邻居与距离。 |
| scikit-learn negative_outlier_factor_scikit-learn negative_outlier_factor_ | The sign is reversed: values around −1 are more typical, while more negative values are more abnormal.符号被反转：约 −1 更典型，数值越负通常越异常。 | Do not mix this attribute with the positive LOF convention in reports.报告中不要把该属性与正向 LOF 定义混用。 |
| Binary prediction二元预测 | A thresholded label derived from the score and contamination setting.由分数和 contamination 设置得到的阈值标签。 | Treat it as a review queue, not proof of fraud, failure, or bad data.把它视为复核队列，而不是欺诈、故障或坏数据的证明。 |
Choose a threshold from the decision, not from convenience. With labeled incidents, evaluate precision, recall, false-positive cost, and detection delay on data excluded from fitting. Without labels, rank candidates and select a review volume that the team can investigate, then record reviewer outcomes to build evidence for later calibration. The contamination parameter can set an expected flag proportion, but it does not discover the true anomaly rate. If that proportion is unknown, report ranked scores and the operational cutoff separately.
阈值应由决策需求决定，而不是为了方便。若有已标注事件，应在未参与拟合的数据上评估精确率、召回率、误报成本与发现时延；若无标签，可对候选项排序，依据团队能够调查的数量设定复核范围，并记录复核结果，为后续校准积累证据。contamination 参数可以设定预期标记比例，但不会自动发现真实异常率。若该比例未知，应分别报告排序分数和运营阈值。
Test stability before deployment. Repeat the analysis across defensible scaling choices, nearby values of k, plausible metrics, feature subsets, and time windows. A reliable candidate should remain highly ranked and retain a sensible peer group; a point that appears only under one fragile configuration needs cautious interpretation. For new observations, fit with novelty=True on a representative reference set and score only unseen data with the novelty API. Freeze the preprocessing pipeline, model version, features, metric, and threshold, then monitor score distributions, alert volume, neighbor distances, review outcomes, and population drift.
部署前还应测试稳定性。应在可辩护的缩放方案、相邻的 k 值、合理距离度量、特征子集与时间窗口之间重复分析。可靠候选点应持续位于高排名并拥有合理的同类邻居；只有在某个脆弱配置下才出现的点需要谨慎解释。对新观测进行评分时，应在有代表性的参考集上以 novelty=True 拟合，并仅通过新颖性检测接口评分未见数据。随后固定预处理流程、模型版本、特征、度量和阈值，并监控分数分布、告警量、邻居距离、复核结果与总体漂移。
High-dimensional data needs an additional check because distances can become similar as irrelevant or correlated features accumulate. Begin with features that have a defensible relationship to the anomaly definition, remove leakage and near-constant fields, and compare results before and after redundant variables are removed. Dimensionality reduction can improve neighborhood structure, but it may also hide a rare signal, so validate retained information and explain alerts in the original features. Fit every scaler, encoder, feature selector, or projection on the reference training data only; applying preprocessing to the full data set before evaluation leaks information and makes stability estimates optimistic.
高维数据还需要额外检查，因为无关或高度相关特征不断增加时，不同点之间的距离可能趋于相似。应从与异常定义有可辩护关系的特征开始，移除数据泄漏字段与近似常量字段，并比较删除冗余变量前后的结果。降维可能改善邻域结构，但也可能掩盖罕见信号，因此必须验证保留的信息，并用原始特征解释告警。所有缩放器、编码器、特征选择器或投影都只能在参考训练数据上拟合；若在评估前用完整数据进行预处理，会造成信息泄漏，使稳定性估计过于乐观。
Validate LOF scores before taking action采取行动前验证 LOF 分数
- Inspect neighbors.检查邻居。Show nearest records, distances, groups, and source IDs; verify the peers are comparable.展示最近记录、距离、分组与来源 ID，确认可比性。
- Run sensitivity analysis.执行敏感性分析。Vary k, scaling, feature subsets, and defensible metrics. Prefer flags stable under reasonable changes.改变 k、缩放、特征子集与合理度量，优先复核稳定标记。
- Use labels or expert review.使用标签或专家复核。With labels, assess precision-recall and cost. Without labels, sample across score bands and record decisions.有标签时评估精确率、召回率与成本；无标签时跨分数抽样并记录决定。
- Monitor drift.监控漂移。Track score distribution, flag rate, missingness, neighbor distance, and feature drift. Version models and transformations.跟踪分数分布、标记率、缺失、邻居距离与特征漂移，并进行版本管理。
Common mistakes include treating LOF as probability, choosing k after seeing preferred results, using IDs as features, ignoring duplicates, and claiming causal explanations. Neighborhood search can also be expensive; benchmark alternatives for large or high-dimensional datasets.
常见错误包括把 LOF 当概率、看到偏好结果后选 k、把 ID 当特征、忽略重复点以及宣称因果解释。邻居搜索也可能昂贵；大型或高维数据应比较替代方法。
Investigate reviewed LOF flags with connected evidence结合关联证据调查已复核的 LOF 标记
Prepare stable record IDs, raw and scaled values, LOF score, k, metric, model version, timestamps, groups, review status, and related database or document context. InfiniSynapse supports AI-assisted analysis across connected databases, files, and documents; it is not described here as a built-in LOF implementation. Use it to explore already computed flags alongside evidence, then verify conclusions before operational use.
请准备稳定 ID、原始与缩放值、LOF 分数、k、度量、模型版本、时间戳、分组、复核状态及相关数据库或文档上下文。InfiniSynapse 支持跨已连接数据库、文件与文档的 AI 辅助分析；本页不把它描述成内置 LOF 实现。可用它把已计算标记与证据一起探索，并在业务使用前验证结论。
Open InfiniSynapse for connected data analysis打开 InfiniSynapse 进行关联数据分析Frequently asked questions about Local Outlier Factor关于 Local Outlier Factor 的常见问题
What does a Local Outlier Factor score mean?LOF 分数表示什么？
A score near 1 means density similar to neighbors. A score materially above 1 indicates lower local density and stronger outlier evidence, but the threshold requires dataset-specific validation.
接近 1 表示与邻居密度相似；明显高于 1 表示局部密度更低，但阈值必须针对数据验证。
How should I choose n_neighbors for LOF?如何选择 n_neighbors？
Test a defensible range around the smallest normal group size, then review score stability and labeled or expert-validated cases.
围绕最小正常群体规模测试有依据的取值，再检查稳定性与已验证案例。
Does LOF require feature scaling?LOF 是否需要特征缩放？
Usually yes when numeric features use different units, because LOF depends on distances. Preserve the fitted transformation for later scoring.
数值特征单位不同时通常需要，因为 LOF 依赖距离；后续评分应保持同一变换。
When is Isolation Forest better than LOF?何时 Isolation Forest 更合适？
Isolation Forest is often a stronger baseline for very large or higher-dimensional data and mainly global anomalies.
对于超大规模、较高维数据或主要为全局异常的场景，Isolation Forest 往往是更强基线。
Authoritative sources and next steps权威来源与下一步
Definitions, parameters, score direction, and novelty behavior were checked against the official scikit-learn LocalOutlierFactor documentation. The original formulation is in LOF: Identifying Density-Based Local Outliers. For prerequisites, read the InfiniSynapse guides to outlier meaning and repeatable outlier checks. This LOF page is not live until deployed.
定义、参数、分数方向与新颖性行为依据 scikit-learn 官方文档核验，原始形式来自论文 LOF: Identifying Density-Based Local Outliers。基础内容可阅读 InfiniSynapse 的异常值含义与可重复异常检查指南。本页部署前尚未上线。