Isolation forest

As explained in Outlier Detection in Python

Isolation Forest is an ensemble outlier-detection algorithm that identifies observations that are isolated quickly by random partitioning.

Isolation Forest detects outliers by asking how quickly a record can be separated from other records. Rather than model normal behavior and measure departures from it, it repeatedly partitions the feature space at random. Records isolated after fewer splits are more likely to be outliers. It is a broadly useful starting point for numeric tabular data, but no single detector finds every kind of outlier. section 5.2 section 5.0

Training builds multiple isolation trees, each from a different small random sample of records. At each node, a tree chooses a feature and a split point within that feature’s range, then subdivides the records. Unlike a supervised decision tree, the split is not chosen to improve a prediction. When a leaf holds duplicate training values, the tree estimates the additional depth needed to isolate a record there; common duplicates therefore need more estimated steps than rare ones. section 5.2 section 9.4.2

Figure 5.1 The training data for an Isolation Forest is divided randomly in each Isolation Tree. This shows the first three steps, resulting in eight nodes, each covering some subregion of the full dataspace. At this point (in the bottom right pane), one point (in the top right region) has already been isolated.

The successive partitions show how a point can be isolated within the first few levels of one tree. section 5.2

A practical scikit-learn workflow is:

• Encode categorical columns before fitting. Scaling is not required for Isolation Forest, unlike the distance-based scikit-learn detectors discussed alongside it. section 5.1
• Fit `IsolationForest`, then use `predict()` for labels (`-1` for outliers, `1` for inliers) or `score_samples()` for record-level scores. An explicitly set `contamination` specifies the fraction flagged; the default instead uses a formula. section 5.1 section 5.2.2
• Inspect flagged records and compare detectors where possible. A flag identifies a candidate for investigation, not proof that the record is a meaningful anomaly. section 5.0 section 5.2.2

Network-event detection

On the KDD Cup SA subset, three categorical columns are ordinal-encoded before fitting `IsolationForest`. The resulting scores achieve an AUROC of about 0.95 against available attack labels, though runs without a fixed seed vary because the algorithm is stochastic. The predictions also include 8,155 non-attack records flagged as outliers and 29 attacks not flagged: good ranking does not make every binary decision correct. Training on clean records, when available, raises the reported AUROC to about 0.98 in this example. section 5.2.2

Ordinal encoding can be useful here because it avoids the extra columns created by one-hot encoding. For example, if one encoded department value occurs far less often than another, duplicate-leaf depth estimates can help distinguish their frequencies. This does not make arbitrary ordinal values suitable for distance-based detectors. Compare Isolation Forest with alternatives such as Local Outlier Factor, and measure fit and prediction time when deployment speed matters. section 9.4.2 section 8.7

How Outlier Detection in Python covers it

How deep it goes

Explains random tree construction and duplicate-leaf depth estimates without deriving a scoring formula.

Examples

Demonstrates ordinal encoding, prediction, and AUROC evaluation on KDD Cup network events.

What it assumes

Assumes familiarity with tabular machine-learning workflows while explaining random splitting and the need to encode categorical features.

What you can do after

Apply it via scikit-learn to score encoded tabular records, label candidates, and evaluate results against labels when available.

How it connects

Connects isolation trees with decision trees and ExtraTrees, and contrasts Isolation Forest with distance-based outlier detectors.

liveBookmanning.com

Read Outlier Detection in Python on liveBook Get the book at manning.com

Related concepts

• outlier detectionkind of · Outlier detection is the process of identifying observations that substantially deviate from an expected or prevailing pattern in data.
• KDD Cup datasetuses · The KDD Cup dataset is a large labeled network-connection dataset containing normal records and records associated with network attacks for intrusion and outlier detection research.
• scikit-learnimplemented by · scikit-learn is an open-source Python library providing tools for classical machine learning, including algorithms, preprocessing, model selection, and evaluation.
• anomaly scoreproduces · An anomaly score is a numerical measure of how anomalous an observation or event is relative to a reference or expected pattern.
• anomaly detectionaddresses · Anomaly detection is the identification of observations, events, or behaviors that substantially deviate from expected patterns or a normal baseline.
• surrogate modelused by · A surrogate model is an approximate model that estimates the behavior or outputs of a more complex, costly, or otherwise unavailable model, process, or function.

This explainer was generated by Manning's knowledge graph from the text of Outlier Detection in Python. The section links point to the parts of the book it draws on.