Isolation Forest
Finding outliers by how quickly they can be isolated
๐กCore Concept
Anomalies are few and different. Isolation Forest builds an ensemble of
random binary trees that split data on random features at random thresholds.
Because outliers sit apart from the crowd, a few random cuts isolate them โ
so they land at shallow leaves with short path lengths. Normal points,
buried in dense regions, need many splits to isolate. Short average path = anomaly.
๐งฉKey Components
Random SplittingPick a random feature & a random split value between its min and max โ no distance metric needed.
Path Length h(x)Number of edges from root to the leaf that isolates a point. The core anomaly signal.
Ensemble of iTreesMany trees on random subsamples; average path length across trees stabilizes the score.
Distribution-FreeNo assumption of Gaussian/clusters. Works on high-dim, mixed data out of the box.
โ๏ธHow It Works
- Draw a random subsample; build an isolation tree by recursively picking a random feature and random split until points are isolated or max depth is hit.
- Repeat to grow a forest of many independent iTrees.
- For each point, measure its path length in every tree and average it: E(h(x)).
- Convert to an anomaly score โ shorter average path โ score closer to 1.
s(x, n) = 2โE(h(x)) / c(n)
s โ 1 : likely anomaly ยท s โ 0.5 : normal ยท c(n) normalizes for sample size
๐Real-World Applications
- ๐ณ Credit-card & payment fraud detection
- ๐ง Network intrusion & cybersecurity monitoring
- ๐ญ Predictive maintenance โ sensor / equipment fault alerts
- ๐ฉบ Medical outlier screening & lab-result anomalies
๐ฏCheckpoint
Why are anomalies easier to isolate than normal points?
How does path length translate into an anomaly score โ and why average it over many trees?
Contrast Isolation Forest with DBSCAN: when would you reach for each on the same outlier task?