Isolation Forest
Definition
An unsupervised machine-learning model for anomaly detection. It builds random decision trees and scores each record by the average depth required to isolate it. Anomalous records are isolated in fewer splits and receive high anomaly scores. No labelled fraud cases are required for training.
- Learning type
- Unsupervised
- Mechanism
- Random decision trees, isolation depth
- Anomaly signal
- Shorter average path length
- Labelled data required
- No
Common questions
Why is isolation depth used as the anomaly score instead of distance or density?+
Anomalous records tend to differ sharply from the bulk of the data on at least one feature, so a random split is likely to separate them early. Normal records sit among similar points and need many splits to isolate, so path length becomes a cheap proxy for how unusual a record is without computing distances or densities.
Why is Isolation Forest well suited to fraud investigation specifically?+
Labelled fraud examples are scarce and fraud patterns shift over time, so a supervised classifier trained on past fraud struggles to catch new schemes. An unsupervised model needs no fraud labels and can flag transactions that simply look statistically unusual against the rest of the dataset.
Related terms
- Anomaly Scoring
- A numeric score assigned to each entity or transaction based on how different it is from the expected population, derived from multiple...
- Explainability
- The degree to which a model's output can be explained in terms of its inputs and logic. Logistic regression and decision trees...
- Logistic Regression (Supervised Fraud Model)
- A classification model trained on historically labelled transactions (fraud vs. legitimate) to estimate the probability that a new transaction is fraudulent. Requires...
- Network Analysis (Link Analysis)
- A method that models entities (people, companies, accounts, addresses) as nodes and connections between them (shared attributes, transactions, ownership) as edges, then...
- Timeline Reconstruction
- The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference...