[Anomaly Detection]
Isolation Forest.
Isolates anomalies by randomly selecting features and split values.
SPEC SHEET
C — How it actually works
To find outliers, do not model normality - try to isolate points. Build random trees that split on random features at random thresholds: an anomaly, being alone in feature space, gets separated in a few splits; normal points buried in the crowd need many. Average isolation depth IS the anomaly score.
D — The math
Score s(x) = 2^(−E[h(x)]/c(n)), where E[h(x)] is mean path length over trees and c(n) the expected path length in a random BST. Scores near 1 = anomalous, near 0.5 = normal.
Training
O(t·ψ·log ψ) with subsample size ψ (default 256) - near-constant per tree
Inference
O(t·log ψ)
E — When NOT to use it
- You have labelled anomalies - supervised models use that signal far better
- Anomalies are dense local clusters rather than isolated points (try LOF)
- Purely categorical data without a meaningful embedding
F — Tuning that matters
- contamination sets the alert rate - choose it from triage capacity, not from folklore
- Defaults (100 trees, 256 subsample) are genuinely good; tune only with labelled feedback
- Use score_samples() for ranking instead of the binary predict()
- Route analyst confirmations back as labels - graduate to supervised when you have enough
G — Production pitfalls
- Calling every statistical outlier a business problem - rare ≠ bad
- Training on data that already contains the attack you want to catch (it becomes "normal")
- Static thresholds on drifting data - yesterday’s anomaly rate is not today’s
- Skipping per-feature explanations - an alert nobody can interpret gets ignored
H — Minimal starting point
PYTHONfrom sklearn.ensemble import IsolationForest
iso = IsolationForest(n_estimators=200, contamination=0.01, random_state=0)
iso.fit(X_train) # unlabelled "mostly normal" data
scores = -iso.score_samples(X_new) # higher = more anomalous
alerts = scores > np.quantile(scores, 0.99)I — The interview question
Why does Isolation Forest use tiny subsamples (256) per tree?
Swamping and masking: with huge samples, anomalies start appearing near each other and near dense regions, making isolation depths noisy. Small subsamples keep anomalies genuinely isolated, sharpening the depth signal - accuracy stays flat while training gets dramatically cheaper.
J — In the wild
Cloud security platforms score billions of daily login and API events with isolation forests: no labels exist for novel attacks, latency budgets are tiny, and analysts tune the contamination rate to exactly the alert volume the SOC can investigate.
K — Consider instead
- DBSCAN— its noise labels double as density-based outlier detection
- Neural Network (MLP)— autoencoder reconstruction error for images/sequences