Isolation Forest

Isolation Forest uses random partitions rather than modeling a normal distribution or estimating a boundary around every inlier. A tree chooses a feature and a split value at random, recursively partitioning the data. Points that are unusual relative to the sampled population often fall into small partitions quickly and therefore have shorter path lengths from the root. The algorithm averages path lengths over many trees and converts them into anomaly scores. Shorter paths correspond to stronger anomaly evidence in the method's scoring convention. The intuition is that isolating a rare, distinctive point requires fewer random cuts than isolating a point surrounded by many similar observations. In a hypothetical dataset of transactions, an unusual combination of amount and timing might be separated early. However, rarity is not synonymous with fraud, error or harm. A valid rare customer segment can also be isolated quickly, while a contextual anomaly may look ordinary globally. Contamination is commonly used to set an expected fraction of outliers for thresholding predictions. It influences how scores are converted to labels, not an estimate that the specified fraction is objectively anomalous. Choosing it without considering review capacity and error costs can flood investigators or miss important cases. For an unlabeled setting, teams can review score distributions and use domain-informed thresholds. When labels exist, evaluate precision-recall tradeoffs on representative examples. Isolation Forest can be efficient on large datasets and handles multiple features, but performance depends on subsampling, tree count, feature representation and random seeds. Numerical scale often matters less than in distance-based methods, yet transformations and categorical encoding still affect random splits. Check whether groups with distinct normal behavior are mistakenly marked unusual. Use explanations and human review for consequential decisions; a score ranks isolation behavior under the fitted ensemble and is not a causal or calibrated risk probability.