LearnMachine learning

Anomaly detection

Find the odd ones out by cutting the data at random: lonely points are isolated in just a few cuts.

  • Machine learning
  • Unsupervised
  • Outliers

Click a point to watch random cuts isolate it. Click empty space to add a point; drag points to move them.

How it works

Easy to isolate means unusual.

An isolation forest does not learn what normal looks like. It cuts the space with random vertical and horizontal lines until a point sits alone. A point far from the crowd is separated after a few cuts, while a point inside a crowd needs many.

It grows a hundred such random trees and averages the number of cuts each point needs. Fewer cuts than usual give a score close to 1, typical points score around 0.5 or lower, and every point above the threshold is flagged.

Choosing the threshold is a trade-off: a lower one catches more real anomalies but also raises more false alarms on normal points. Anomalies are rare and often unlabelled, so in practice the threshold is often set by how many alerts people can check.