Isolation Forests for Anomaly Detection

Most anomaly-detection methods work by first building a model of what "normal" looks like — a distribution, a cluster, a density estimate — and then flagging anything that model finds unlikely. An isolation forest skips modeling normal entirely and goes straight at the definition of an outlier: a point that is few and different is easy to cut off from everything else with a handful of random splits, while a point buried in a dense, ordinary crowd takes many splits before it's alone.

Why random splits are enough

Each isolation tree is built with no objective function at all: at every node, pick one feature at random and a random split value between that feature's min and max in the current node's data, and recurse until every point sits alone in its own leaf. There's no notion of "best" split, because the tree isn't trying to predict anything — it's just trying to separate points as fast as random cutting happens to allow.

The path length from the root to a point's leaf — how many random cuts it took to isolate that point — is the raw signal. Averaged across hundreds of such randomly-built trees, an outlier sitting far from the bulk of the data gets isolated in just a few cuts almost every time, because a random split anywhere near it tends to separate it from the dense region. A normal point in the thick of the distribution needs many cuts, because most random splits fail to separate it from its many close neighbors. The final anomaly score compares each point's average path length $h(x)$ against $c(n)$, the expected path length for a normal point in a dataset of that size: $s(x) = 2^{-h(x)/c(n)}$, a score that approaches 1 for a very short path (a clear anomaly) and drops toward 0.5 or below for a typical path length (an ordinary point).

Worked example

An isolation forest of 200 trees is trained on daily trading volumes and price moves for 5,000 stock-days. A stock-day with a completely ordinary 1.1% move and typical volume gets isolated after an average of 11.4 splits across the forest — deep in the tree, typical of a crowded region. A stock-day with a 14% move on 20x average volume (a surprise acquisition announcement) gets isolated after an average of just 3.2 splits — it takes almost no random cutting to separate it from everything else, because it sits far from the bulk of the data on multiple features simultaneously. Converting to the anomaly score $s(x) = 2^{-h(x)/c(n)}$, the ordinary day scores around 0.46 while the acquisition day scores around 0.89, comfortably above the typical 0.6 cutoff used to flag review candidates.

What this means in practice

Isolation forests scale well to high-dimensional, large datasets since they never compute distances or densities — just random splits — and they're a common first-pass anomaly detector for bad-tick screening, fraud flagging, and surfacing days that need manual review before feeding data into downstream models.