7 · Isolation Forest: anomalies by path length
Random trees exploit sparsity — outliers are isolated in fewer splits, giving them a shorter average path length and a high anomaly score.
Anomalies are easier to ISOLATE than normal points — Isolation Forest builds random trees and uses average path length to score outliers.
Without this:
Without Isolation Forest you'd default to z-scores per feature and miss multi-dimensional anomalies.
Anomaly detection (also called outlier detection) is the task of finding points that don't fit the distribution of the rest of the data. Unlike clustering, the goal is not to group points — it is to flag the few that are unusual.
Classical approaches (z-scores, IQR fences) treat each feature independently. They miss multi-dimensional anomalies: a point may be perfectly normal in feature A and in feature B, yet the combination (A, B) is rare. Enter Isolation Forest.
Core idea: anomalies are easier to isolate than normal points. A random tree partitions space with axis-aligned splits chosen at random. To isolate a normal point, many splits are needed — it sits in a dense region, so splitting it away from its neighbours takes many cuts. To isolate an outlier, very few splits suffice — it sits alone in a sparse corner of the space.
Algorithm:
-
Build a forest of iTree isolation trees. Each tree: randomly subsample n_samples points, then recursively pick a random feature and a random threshold within the feature's range, splitting until each leaf holds a single point or a maximum depth is reached.
-
For each point, compute the average path length
h(x)across all trees — how many splits it takes to isolate x on average. -
The anomaly score is defined as:
score(x) = 2^(−h(x) / c(n))
where c(n) is the expected path length in a binary search tree of n nodes (normalisation factor). Score near 1 → anomaly (isolated quickly); score near 0.5 → normal (takes many splits).
Why Isolation Forest is useful:
- Works on raw multi-dimensional data — no distance metric required.
- Scales linearly: O(n log n) training.
- Handles high-dimensional datasets where distance-based methods fail.
- The single
contaminationparameter sets the expected fraction of outliers.
Python (in browser)
Isolation Forest on 200 normal points + 10 injected outliers — red X marks are predicted anomalies. With contamination=0.05 the model flags roughly 5% of points.
Python runs entirely in your browser via Pyodide (~6 MB on first Run, cached after).
Python (in browser)
Isolation Forest decision_function heatmap — red regions are scored as anomalous (low score), green regions as normal. The injected outliers fall in the reddest zones.
Python runs entirely in your browser via Pyodide (~6 MB on first Run, cached after).
Python (in browser)
Contamination sweep [0.01, 0.05, 0.1, 0.2] — the number of flagged points equals approximately contamination × n_samples, confirming contamination controls the decision threshold.
Python runs entirely in your browser via Pyodide (~6 MB on first Run, cached after).
When Isolation Forest shines — ideal conditions, strengths, weaknesses, and real-world applications.
Why do anomalies have shorter average paths in an Isolation Forest?
- Isolation Forest scores anomalies by average path length across random trees — shorter path = easier to isolate = more anomalous.
- The anomaly score is 2^(−h(x)/c(n)) — near 1 for anomalies, near 0.5 for normal points.
- contamination sets the fraction of points to flag as anomalies — it adjusts the decision threshold, not the tree structure itself.
- Isolation Forest handles high-dimensional and mixed-feature data where distance-based or per-feature methods fail.
- Use Isolation Forest for global anomalies (fraud, intrusion, sensor spikes); use LOF when local context matters (next lesson).
Credit card fraud detection, network intrusion detection, manufacturing sensor monitoring, medical device anomaly alerts — anywhere you need to flag rare events in multivariate data streams without labelled examples.
If you remove it: You'd default to univariate z-scores per feature and miss multi-dimensional anomalies where no single feature looks unusual but the combination is rare.