Isolation Forest › Implementation in Scikit-learn
Machine Learning from ScratchAll chapters Isolation Forest › Implementation in Scikit-learnOne section · Sections in this chapter5 / 8 ↓
Reading tools Definitions & inline links
Choose your expertise level to adjust how many terms are explained. Beginners see more tooltips, experts see fewer to maintain reading flow. Hover over underlined terms for instant definitions.
Article links
Make inline references clickable
Scikit-learn gives a stable implementation of Isolation Forest that handles the complexity of building multiple trees and calculating anomaly scores efficiently. Let's implement a complete example that demonstrates the key features and parameters.
import numpy as np
from sklearn.datasets import make_blobs
from sklearn.preprocessing import StandardScaler
np.random.seed(42)
n_samples = 1000
n_outliers = 100
# Create normal data with multiple clusters
X_normal, _ = make_blobs(
n_samples=n_samples - n_outliers,
centers=3,
cluster_std=1.0,
random_state=42,
)
X_anomalies = np.random.uniform(-10, 10, (n_outliers, 2))
X = np.vstack([X_normal, X_anomalies])
y_true = np.hstack([np.zeros(n_samples - n_outliers), np.ones(n_outliers)])
# Standardize the data (important for Isolation Forest)
scaler = StandardScaler()
X_scaled = scaler.fit_transform(X)Dataset shape: (1000, 2) Number of true anomalies: 100 Anomaly ratio: 10.00%
iso_forest = IsolationForest(
n_estimators=100, # Number of isolation trees
contamination=0.1, # Expected proportion of anomalies
max_samples="auto", # Number of samples to draw for each tree
max_features=1.0, # Number of features to draw for each tree
bootstrap=False, # Whether to use bootstrap sampling
random_state=42, # For reproducibility
n_jobs=-1, # Use all available cores
)
iso_forest.fit(X_scaled)
# Get predictions and anomaly scores
y_pred = iso_forest.predict(X_scaled) # -1 for anomalies, 1 for normal
anomaly_scores = iso_forest.decision_function(X_scaled) # Continuous scores
# Convert predictions to binary (0 for normal, 1 for anomaly)
y_pred_binary = (y_pred == -1).astype(int)Model Parameters: Number of trees: 100 Contamination: 0.1 Max samples: auto Max features: 1.0
Classification Report:
precision recall f1-score support
Normal 0.98 0.98 0.98 900
Anomaly 0.79 0.79 0.79 100
accuracy 0.96 1000
macro avg 0.88 0.88 0.88 1000
weighted avg 0.96 0.96 0.96 1000
Confusion Matrix:
[[879 21]
[ 21 79]]
Anomaly Score Statistics:
Mean: 0.0860
Std: 0.0584
Min: -0.1473
Max: 0.1493
Top 10 Most Anomalous Points (indices):
[176 523 665 873 883 25 850 702 348 582]
Their anomaly scores:
[0.14690173 0.14707934 0.1473288 0.14855641 0.1486266 0.14870366
0.14900097 0.14907719 0.14926285 0.14927451]Understanding the Results
The classification report provides detailed performance metrics for each class. Precision measures the proportion of predicted anomalies that are true anomalies, while recall measures the proportion of true anomalies that were correctly identified. The F1-score balances precision and recall. In this example, the model achieves high precision and recall, indicating effective anomaly detection.
The confusion matrix shows the counts of correct and incorrect predictions. True negatives (TN) represent normal points correctly classified, true positives (TP) are anomalies correctly identified, false positives (FP) are normal points incorrectly flagged as anomalies, and false negatives (FN) are anomalies missed by the model. The diagonal elements (TN and TP) should be large relative to the off-diagonal elements (FP and FN) for good performance.
The anomaly score statistics reveal the distribution of scores across all data points. Negative scores indicate normal behavior (harder to isolate), while positive scores indicate anomalous behavior (easier to isolate). The mean score near zero suggests the model is distinguishing well between normal and anomalous points, while a wide range (from min to max) indicates diverse isolation difficulty across the dataset.
Key Parameters
When working with Isolation Forest, several parameters are important for achieving optimal results:
-
n_estimators: Controls the number of isolation trees in the ensemble. More trees lead to more stable and reliable results, but increase computational cost. A value of 100 is typically sufficient for most applications, though you may need more for very large datasets or when stability is critical. -
contamination: Specifies the expected proportion of anomalies in the dataset. This parameter directly affects the decision threshold: higher values result in more points being flagged as anomalies. If you have domain knowledge about the expected anomaly rate, use it to set this parameter. Otherwise, tune it based on validation results or use the default value of 'auto' to estimate it from the data. -
max_samples: Determines how many samples to draw for each tree. The default 'auto' uses min(256, n_samples), which balances computational efficiency with statistical validity. Using fewer samples can reduce memory usage for very large datasets, while using all samples may provide more accurate results but with increased computational cost. -
max_features: Controls the number of features to consider for each split. The default value of 1.0 uses all features, which is appropriate for most cases. Reducing this value can add more randomness to the trees and may help with high-dimensional data where some features are irrelevant. -
random_state: Sets the random seed for reproducibility. Always set this when you need consistent results across runs, especially for debugging or when comparing different parameter configurations.