Navigate
Courses Tutorials Practice Pricing Tools Upgrade
Lesson 2 of 7

Isolation Forest and Extended Isolation Forest

In a cold-storage warehouse, 200 freezer units hum along at about 18 degrees below zero, each drawing roughly 3 kilowatts. Then Unit 27 starts to fail: it drifts up to 8 below and pulls 5.2 kilowatts, working hard and losing. Catch it tonight and the stock is saved; miss it and by morning a room of frozen food is ruined. You have no labels and no history of past failures, just tonight's readings. How do you find the one unit that does not belong?

Lesson 1 defined what an anomaly is and warned about the base-rate trap: at a 1% anomaly rate, even a 99%-accurate flag is mostly false alarms, so we judge detectors by precision and recall. This lesson builds your first real detector, one with a wonderfully simple idea at its heart: an anomaly is the point that is easiest to isolate.

By the end of this lesson you will be able to:

  • Explain why an anomaly gets fenced off by random cuts in far fewer steps than a normal point
  • Grow an isolation path in R and turn the average path length into an anomaly score
  • Score a whole fleet, set a threshold, and read what the scores mean
  • Say where the standard forest has an axis-aligned blind spot, and how the extended forest fixes it

Prerequisites: you can run R and read base R (functions, recursion, apply and replicate), and you have done Lesson 1: What Is an Anomaly? (global vs local outliers, and the base-rate trap). No tree or ensemble background is needed; an isolation tree is simpler than a decision tree, and every term is defined here.

The idea

Few and different are easy to isolate

Picture the 200 normal freezers as a tight cloud of dots: all near 18 below, all drawing about 3 kilowatts, packed close together. Unit 27 sits by itself, far out in empty space. Now play a game. Draw a random straight line across the plot and ask: is Unit 27 alone on its side yet? Because it is out in the open, one or two lines already fence it off with nobody else. A normal unit buried in the middle of the cloud is a different story: line after line still leaves it surrounded by neighbours, and it takes many cuts before it finally stands alone.

That gap is the whole method. The number of random cuts it takes to fence a point off on its own is a measure of how isolated it is.

Key Insight
Anomalies are "few and different", so they live in sparse, empty regions. A handful of random cuts isolates them. Normal points are "many and similar", packed together, so they resist isolation and need many cuts. Fewer cuts to isolate means more anomalous. No distances, no density estimates, no labels: just how hard a point is to separate.

This is the reverse of most methods, which describe what normal looks like and then measure distance from it. Isolation forests never model normal at all. They go straight for the odd point, and that is what makes them fast.