Isolation Forest Anomaly Detection

Isolation Forest is an unsupervised anomaly detection algorithm that isolates observations with random splits in an ensemble of trees and flags points that are isolated in fewer splits as anomalies.

Isolation Forest는 트리 앙상블에서 무작위 분할로 관측치를 고립시키고, 적은 분할만으로 고립되는 관측치를 이상치로 판별하는 비지도 이상탐지 알고리즘이다.

How do I detect outliers or anomalies in multivariate data without labels?

레이블 없이 다변량 데이터에서 이상치를 어떻게 탐지하나요?

Isolation Forest builds many random trees and scores each observation by its average path length, since unusual points are separated from the rest after fewer random splits. It fits unlabeled multivariate data such as transactions, sensor readings, or logs where anomalies are rare and different.

When to use Isolation Forest Anomaly Detection

• Unlabeled data with many numeric features
• Fraud, fault, or intrusion screening where anomalies are rare
• Large datasets where distance-based methods are too slow

When to use something else

• Labelled examples of anomalies are available: use a supervised classifier
• Anomalies are defined by local density differences between clusters: use the Local Outlier Factor

Assumptions and requirements

• Anomalies are few and different from normal observations
• A contamination rate or score threshold is chosen
• Results vary with the random seed and number of trees
• Categorical features need numeric encoding

What the analysis reports

• Anomaly score for each observation
• Binary anomaly flag at the chosen threshold
• Distribution of anomaly scores
• Profiles of flagged observations compared with the rest

How to report it

Isolation Forest ([number] trees, contamination = [value]) flagged [n] of [N] observations ([value]%) as anomalies.

Related methods

• Local Outlier Factor
• One-Class SVM
• Mahalanobis Distance

Run Isolation Forest Anomaly Detection on Quorant