How to use Isolation Forest

It seems you have many questions, let me try to answer them one by one to the best of my knowledge.

How it works?

It works due to the fact that the nature of outliers in any data set, which is outliers, is few and different, which is quite different from the typical clustering-based or distance-based algorithm. At the top level, it works on the logic that outliers take fewer steps to 'isolate' compare to the 'normal' point in any data set. To do so, this is what IF does; suppose you have training data set X with n data points, each having m features. In training, IF creates Isolation trees (Binary search trees) for different features.

For training, you have 3 parameters for tuning during the train phase:

1. number of isolation trees (n_estimators in sklearn_IsolationForest)
2. number of samples (max_samples in sklearn_IsolationForest)
3. number of features to draw from X to train each base estimator (max_features in sklearn_IF).

max_samples is the number of random samples it will pick from the original data set for creating Isolation trees.

During the test phase:

• sklearn_IF finds the path length of data point under test from all the trained Isolation Trees and finds the average path length. The higher the path length, the more normal the point, and vice-versa.

• Based on the average path length. It calculates the anomaly score, decision_function of sklearn_IF can be used to get this. For sklearn_IF, the lower the score, the more anomalous the sample.

• Based on the anomaly score, you can decide whether the given sample is anomalous or not by setting the proper value of contamination in the sklearn_IF object. The default value of contamination is 0.1, which you can tune for deciding the threshold. The amount of contamination of the data set, i.e., the proportion of outliers in the data set.

Tuning parameters

Training -> n_estimators, max_samples, max_features.

Testing -> contamination

-1 represents the outliers (according to the fitted model). See IsolationForest example for a nice depiction of the process. If you have some prior knowledge, you could provide more parameters to get a more accurate fitting. For example, if you know the contamination (proportion of outliers in the data set) you could provide it as an input. By default it is assumed to be 0.1. See description of the parameters here.