Isolation Forest: Find Anomalies Without Labels

Something in your data does not look right. Maybe a handful of transactions are suspiciously large, a few sensor readings are way outside the normal range, or certain user accounts behave nothing like the rest. You do not have labeled examples of "good" and "bad". You just know that anomalies are in there somewhere. Isolation Forest can help find them without labels. Labels are tags that say if a row is usual or unusual. Upload a CSV, or table file, and choose columns, or traits, to get rows ranked by score for review.

Worked Example (Simulated): Can Isolation Forest Find Points Far From a Group?

Question: Can Isolation Forest find points far from a group?

Inputs: Simulated data, seed 23. The script draws 100 usual points, each with two traits, x and y, from a standard normal distribution. Then it adds five planted points far from the group, 7 to 8 units out. The method uses 200 trees. A tree is a set of simple splits. Contamination is the share of rows marked as unusual.

Method: The contamination setting was set to the number of planted rows (5 of 105), so the model must flag five. What the run tests is whether those five are the ones with the highest scores. The model gives each row a score, and a higher score means a more unusual row (the script negates score_samples). The planted points are far from the group, which is the easy case.

import numpy as np
from sklearn.ensemble import IsolationForest

seed = 23
rng = np.random.default_rng(seed)
normal = rng.normal(loc=0.0, scale=1.0, size=(100, 2))
outliers = np.array(
    [[7.0, 7.0], [-7.0, 7.0], [7.0, -7.0], [-7.0, -7.0], [8.0, 0.0]]
)
X = np.vstack([normal, outliers])
contam = 5 / len(X)
model = IsolationForest(
    n_estimators=200, contamination=contam, max_samples="auto", random_state=seed
)
labels = model.fit_predict(X)
# Higher score = more unusual row (score_samples is negated).
scores = -model.score_samples(X)
flagged = np.flatnonzero(labels == -1)
print(f"Simulated data, seed {seed}")
print(f"Rows: {len(X)} total, {len(normal)} normal draws, {len(outliers)} planted")
print(f"Planted points: {outliers.tolist()}")
print(f"Settings: n_estimators=200, contamination={contam:.5f}, random_state={seed}")
print(f"Rows flagged: {len(flagged)}; row indices (zero-based): {flagged.tolist()}")
print("Top five rows by anomaly score (zero-based index, x, y, score):")
for i in np.argsort(scores)[-5:][::-1]:
    print(f"{i}, {X[i, 0]:.3f}, {X[i, 1]:.3f}, {scores[i]:.4f}")
print(f"Highest score among the 100 normal rows: {scores[:100].max():.4f}")

Printed output:

Simulated data, seed 23
Rows: 105 total, 100 normal draws, 5 planted
Planted points: [[7.0, 7.0], [-7.0, 7.0], [7.0, -7.0], [-7.0, -7.0], [8.0, 0.0]]
Settings: n_estimators=200, contamination=0.04762, random_state=23
Rows flagged: 5; row indices (zero-based): [100, 101, 102, 103, 104]
Top five rows by anomaly score (zero-based index, x, y, score):
101, -7.000, 7.000, 0.7804
103, -7.000, -7.000, 0.7745
100, 7.000, 7.000, 0.7660
102, 7.000, -7.000, 0.7594
104, 8.000, 0.000, 0.6906
Highest score among the 100 normal rows: 0.6018

Result: The five rows flagged are the five planted rows, and they hold the five highest scores, 0.6906 to 0.7804. The highest score among the 100 normal rows is 0.6018. The data were built with planted outliers, so finding them is expected.

Limit: These are simple, made-up data. They do not show how well the method finds real issues. A gap in scores is a prompt to look and does not prove a row is wrong.

Sources

• Liu F, Ting K, Zhou Z (2008). Isolation Forest. Eighth IEEE International Conference on Data Mining (ICDM). doi 10.1109/ICDM.2008.17. Cited for who published the method and when.

What Is Isolation Forest?

Isolation Forest is an unsupervised machine learning algorithm designed for anomaly detection. It was published in 2008 (see Sources). The core idea: anomalies are easier to isolate than normal points. If you randomly split data with a series of cuts, an unusual data point gets separated from the crowd in just a few cuts, while a normal point buried in a dense cluster takes many more cuts to isolate. The fewer cuts required, the more anomalous the point.

To find the rows in your own data that do not fit the usual pattern, try the free anomaly detection tool.

Think of it like a game of 20 questions. If someone is thinking of a common animal like a dog, it takes many questions to narrow down the answer. But if they are thinking of a platypus, a couple of targeted questions ("Does it lay eggs?" "Does it have a bill?") isolate it almost immediately. Isolation Forest works the same way. It builds random decision trees that split the data along random features at random thresholds. Points that end up in short branches (isolated quickly) get high anomaly scores. Points deep in the tree (hard to isolate) are normal.

The algorithm builds an ensemble of these random trees, an "isolation forest", and averages the path lengths across all trees to produce a stable anomaly score for every row in your dataset. No distance calculations, no density estimation, no assumptions about what your data distribution looks like. It can work across many kinds of numeric data.

Real-World Applications

Fraud detection. Credit card transactions, insurance claims, expense reports: the method can find transactions that differ in the traits it measures, such as unusual amounts, strange timing, or atypical merchant categories. Isolation Forest scores every transaction, and a person can review the ones that stand out.

Manufacturing quality control. Sensor readings from production lines generate thousands of data points per hour. Most readings fall within normal operating parameters, but defective products or equipment malfunctions create outlier patterns across temperature, pressure, vibration, or dimensional measurements. Isolation Forest catches these without needing a historical database of known defects.

Cybersecurity and intrusion detection. Network traffic logs contain millions of normal connections and a handful of suspicious ones: unusual ports, abnormal data volumes, strange access patterns. Isolation Forest flags the connections that deviate from normal behavior, including ones that do not match a known pattern.

Financial trading. Unusual trading volumes, price movements, or order patterns can indicate market manipulation, insider trading, or system errors. Isolation Forest applied to trading data highlights the transactions or time windows that break from normal market behavior.

Data quality auditing. Before running any analysis, you need clean data. Isolation Forest can scan your dataset for rows that look fundamentally different from the rest: data entry errors, unit mismatches, duplicate records with corrupted fields, or test data mixed into production. It can serve as a first pass to point at problems that summary statistics miss.

What Data Do You Need?

You need a CSV with at least one numeric feature column. In practice, you will get better results with multiple feature columns. The algorithm works by splitting across features, so more dimensions give it more ways to separate anomalies from normal points. Map your feature columns when you upload (the tool supports multiple features via feature_1 through feature_N).

The features should be numeric measurements that you expect anomalies to deviate on. For transaction data, that might be amount, frequency, and time since last transaction. For sensor data, temperature, pressure, and vibration readings. For user behavior, session duration, page views, and click patterns. You do not need to label anything as "anomaly" or "normal": the algorithm figures that out on its own.

There is no set minimum sample size. With little data, the model may not learn a useful pattern, so treat that as a limit to weigh, not a set row count.

Module Parameters

The module exposes four parameters you can adjust:

• n_trees: Number of isolation trees in the forest. More trees produce more stable anomaly scores at the cost of computation time.
• contamination: Expected proportion of anomalies in your data. This sets the threshold for classifying points as anomalous vs. normal. If you know roughly 2% of your transactions are fraudulent, set this to 0.02. If you do not know the share, check how the tool sets it before you read the flags.
• sample_size: Number of rows sampled to build each tree. Smaller samples make anomalies stand out more sharply (they are easier to isolate in a smaller crowd).
• enabled_analyses, Which report sections to include. Default is "all". You can disable specific analyses if you only need certain outputs.

How to Read the Report

The report contains ten sections, each designed to answer a specific question about the anomalies in your data.

Executive Summary

The TL;DR card gives you the headline finding: how many anomalies were detected, what percentage of the dataset they represent, and the key features driving the anomaly scores. Start here to get the big picture before diving into details.

Analysis Overview

Shows the dataset dimensions, feature count, and model configuration used. This is your audit trail. You can confirm exactly which columns were analyzed and what parameters were applied.

Data Preprocessing

Documents how the data was cleaned and prepared before modeling. This includes handling of missing values, feature scaling, and any transformations applied. Transparency matters. You should know what happened to your data before the algorithm touched it.

Anomaly Score Distribution

A histogram of anomaly scores across all data points. Normal points cluster at low scores; anomalies sit in the right tail. The shape of this distribution tells you a lot: a gap in the score chart is a pattern to check. It does not prove the marked rows are unusual. A gradual tail with no clear gap means the boundary between normal and unusual is fuzzy, and you should interpret the threshold with more caution.

Feature Space: Anomalies vs Normal

A scatter plot showing anomalies (highlighted) against normal points in feature space. This is where the anomalies come alive visually. You can see whether they cluster in a specific region, scatter across the feature space, or sit at extreme values on particular dimensions. If the anomalies form a visible group, that suggests a systematic pattern (like a batch of bad sensor readings). If they scatter randomly, each anomaly may have a different cause.

Feature Importance

Not all features contribute equally to the anomaly scores. This section ranks which features the isolation trees relied on most to separate anomalies from normal data. If "transaction_amount" dominates feature importance, your anomalies are primarily driven by unusual amounts. If multiple features contribute roughly equally, the anomalies are multivariate. They look unusual across several dimensions simultaneously, which often indicates more sophisticated outlier patterns.

Normal vs Anomaly Comparison

Side-by-side statistics for normal and anomalous groups: means, medians, standard deviations, and distributions for each feature. This is where you understand what makes the anomalies different. Maybe anomalous transactions have 10x the average amount. Maybe anomalous sensor readings have normal temperature but extreme pressure. The comparison table makes the differences concrete and quantifiable.

Top Anomalies

A ranked table of the most anomalous data points with their scores and feature values. This is a list of rows to review. A high score is a prompt to look, and does not prove a row is wrong. Each row includes the anomaly score and the raw feature values, so you can immediately see why a particular point was flagged. Sort by score to prioritize the most extreme cases first.

Model Configuration

The exact parameters used for the isolation forest model: number of trees, sample size, contamination rate, and random seed. This enables reproducibility: anyone can rerun the analysis with identical settings and get identical results.

Statistical Summary

Descriptive statistics for the full dataset and for the anomaly subset: counts, means, ranges, and quantiles. Provides the numerical context to interpret the anomaly detection results in terms of your actual data scale.

When to Use Something Else

Isolation Forest is one general-purpose choice for anomaly detection, but it is not the only option. The right method depends on your data structure and what kind of anomalies you expect.

If your data is univariate, a single column of numbers, a Z-score approach is simpler and more interpretable. Z-scores flag points that fall more than 2 or 3 standard deviations from the mean. It is easy to explain, requires no model fitting, and works well when the data is roughly normally distributed. For a single column, there is no need for the machinery of a random forest.

If you suspect your anomalies form their own cluster: a group of similar outliers rather than scattered individual points: DBSCAN may be more appropriate. DBSCAN finds dense clusters and labels everything outside those clusters as noise (anomalies). It is particularly effective when normal data forms clear, tight groups and anomalies sit in sparse regions between them.

For high-dimensional data with complex nonlinear relationships, one-class SVM learns a boundary around the normal data in a high-dimensional feature space. It can capture more complex shapes of "normal" behavior than Isolation Forest, but it is slower, harder to tune, and more sensitive to the choice of kernel and hyperparameters.

For very large, high-dimensional datasets (hundreds of features), autoencoders, a neural network approach, can learn a compressed representation of normal data and flag anything that reconstructs poorly. Autoencoders require more data and more tuning, but they scale to problems where tree-based methods struggle with dimensionality.

Isolation Forest handles multivariate data, requires no labels, and produces a score for each row. It is a reasonable first method to try unless you have a specific reason to reach for something more specialized.

The R Code Behind the Analysis

Every report names its method and includes the R code that produced it, so you can reproduce, audit and cite it. The method code is fixed, not rewritten for each run, so the same data gives the same analysis every time.

The analysis uses the isotree package for building the isolation forest model and computing anomaly scores. Feature importance is calculated from the average depth at which each feature contributes to isolating anomalous points. Visualization uses ggplot2 for scatter plots, score distributions, and group comparisons. Every step is visible in the code tab of your report, so you or a data scientist can check exactly what was done, reproduce the results, or adapt the analysis for your own pipeline.