The Best Anomaly Detector I Know Optimizes Nothing
Classic Machine Learning Through the Eyes of an SRE — Part 9: Isolation Forest The algorithm in one line: Isolation Forest scores how anomalous a point is by how few random cuts it takes to separate that point from everything else. No model of normal, no loss function, nothing optimized. ← Previous: Part 8 — Hierarchical Clustering Fails Beautifully · Next: this is the series finale — start at…
Anomaly detection algorithms often assume what "normal" looks like, then classify everything else as outliers. K-Means and DBSCAN are examples of such algorithms. Isolation Forest, however, takes a different approach. It doesn't model normal or optimize anything. Instead, it determines how few random cuts it takes to isolate a point from the rest.
A point easily separated in just a few cuts is considered anomalous, while points buried in dense clusters take many more cuts to isolate. This algorithm builds many random trees, averages the isolation depth for each point, and produces an anomaly score. It doesn't use a loss function or any kind of optimization. Every cut is a random choice, and the power comes from averaging these random choices.
Isolation Forest is cheap and random, but surprisingly effective at detecting rare points. It also trains each tree on a small subsample of the data, which keeps the forest focused on isolating anomalies. This is not a performance shortcut, but a deliberate choice. The small subsample keeps rare points rare, making the isolation problem more manageable.
The algorithm outputs a ranking of points based on their anomaly scores, but it's up to the human to decide the threshold for what constitutes an anomaly. This ranking is based on the expected business impact of the anomaly, not just its statistical novelty. Isolation Forest doesn't make assumptions about what is important or costly in terms of business impact.
Instead, it provides a tool for human judgment to decide what anomalies to investigate and prioritize.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
