Isolation Forest
Spots anomalies by cutting the data with random splits: odd points get isolated after only a few cuts, normal points need many.
Also iForest · isolation trees
Liu, Ting and Zhou, 2008
Play 'guess who' with random questions. The one person with green hair and a top hat is singled out in two questions; finding one ordinary person in the crowd takes many more.
Where it fits
+All relationships as a list
Is a kind of / part of
Siblings
Uses / built on
Applies to
How it works
Most anomaly detection methods first learn what normal looks like, then measure how far a point is from it. An isolation forest flips this around: anomalies are few and different, so they are easy to separate.
- Take a random subsample of the data.
- Build a tree by picking a random feature and a random cut point, again and again, until every point sits alone.
- Note how many cuts each point needed. An outlier far from the crowd is cut off in a few steps; a point in the dense middle needs many.
- Average over many such random trees. A short average path means a likely anomaly.
Unlike a decision tree for classification, nothing is learned about labels: the cuts are random, and only the path lengths matter. That makes it fast and simple, which is why it is a common default, with the one-class SVM as the classic kernel-based alternative.
Everyday use cases
- Case 01
Card fraud screening
Flags transactions that are unusual for their amount, place and time, before any fraud labels exist.
- Case 02
Server monitoring
Spots a machine whose CPU, memory and network pattern suddenly looks unlike the rest of the fleet.
Famous examples
Strengths, weaknesses and when to use it
Strengths
- Fast and memory-light, even on large, high-dimensional data.
- No distance or density estimates, and little tuning.
Weaknesses
- Axis-aligned random cuts can miss anomalies that are only unusual in combinations of features.
- Needs a guess of the contamination rate to turn scores into yes/no flags.
When to use itThe first thing to try for unsupervised anomaly detection on tabular data.
Compare with
Check yourself
- Q01
Why are anomalies isolated quickly?
Show answer
B: They are few and different, so random cuts separate them from the rest early
- Q02
Does an isolation forest need labeled anomalies?
Show answer
A: No, it is unsupervised