Isolation Forest
Isolation forest detects anomalies by how quickly random partitioning isolates a point from the rest.
Anomalies are easy to isolate
Isolation forest turns the usual anomaly logic around. Instead of modeling what normal data looks like and flagging deviations, it directly exploits the fact that anomalies are few and different, which makes them easy to separate. If you repeatedly split the data on random features at random thresholds, an outlier tends to fall into its own region after only a few cuts, while a normal point needs many.
How the trees are built
The algorithm builds many isolation trees, each on a small random subsample. At every node it picks a random feature and a random split value between that feature range, recursing until points are isolated or a depth limit is reached. The path length from the root to a point is its isolation depth. Averaging path lengths across trees gives a robust estimate.
The anomaly score
Short average path lengths mean easy isolation and thus high anomaly scores. The raw path length is normalized against the expected path length of an unsuccessful binary-search-tree lookup so scores are comparable across dataset sizes, yielding a value between zero and one where values near one indicate anomalies.
- Linear time and low memory: no distance or density computation
- Subsampling improves accuracy by reducing masking and swamping
- Few hyperparameters: tree count and subsample size
- Works well in moderate dimensions; very high dimensions dilute random splits
Strengths and limits
Isolation forest scales to large datasets far better than distance-based methods like the local outlier factor, because it never computes pairwise distances. Its weaknesses appear with many irrelevant features, where random axis-aligned splits rarely target the informative dimensions, and with anomalies that are only anomalous in feature combinations. It is a strong default for tabular anomaly detection.