Isolation Forest

Unlike density-based or distance-based methods that construct a profile of normal instances, Isolation Forest explicitly isolates anomalies. The algorithm recursively partitions data by randomly selecting a feature and a split value between its minimum and maximum. Because anomalies are few and different, they require fewer random splits to be isolated in a leaf node. This fundamental difference means the algorithm does not need to compute expensive distance or density measures, making it exceptionally fast for high-dimensional data.

• Profiling methods (e.g., One-Class SVM, DBSCAN) model the normal region and flag deviations
• Isolation Forest directly targets anomalies through their inherent susceptibility to isolation
• The average path length from root to terminal node serves as the anomaly score

Isolation Forest constructs an ensemble of binary trees (iTrees), each built from a random subsample of the training data. Each tree is grown by randomly selecting a feature and a random split point until every instance is isolated or a maximum depth is reached. The randomness across the ensemble ensures that no single feature dominates the anomaly decision. Anomalies consistently produce shorter average path lengths across all trees, while normal points require deeper partitions. This ensemble approach provides robustness and reduces variance compared to a single isolation tree.

• Typical ensemble size: 100 trees
• Subsample size: 256 instances (sufficient for most datasets)
• Maximum tree depth is often set to ceil(log₂(subsample_size)) to avoid overfitting

The anomaly score for an instance is derived from its average path length across all isolation trees, normalized by the expected path length of an unsuccessful search in a Binary Search Tree. The score ranges from 0 to 1, where scores close to 1 indicate a strong anomaly, scores around 0.5 suggest a normal instance, and scores below 0.5 may indicate the instance is too common. The normalization factor c(n) accounts for the subsample size and provides a consistent scale regardless of dataset dimensions.

• Score > 0.6: Likely anomalous
• Score ≈ 0.5: Indistinguishable from normal
• Score < 0.4: Potentially a dense cluster member
• The normalization constant c(n) = 2H(n-1) - (2(n-1)/n), where H(i) is the harmonic number

Isolation Forest achieves O(n) training time complexity with a low constant factor, making it one of the fastest anomaly detection algorithms available. This efficiency stems from two design choices: each tree is built from a small subsample rather than the full dataset, and the splitting process requires no distance calculations or density estimations. The algorithm scales linearly with both the number of instances and the number of trees. This makes it particularly suitable for real-time network telemetry analysis where millions of data points must be processed with minimal latency.

• Training: O(t · ψ · log ψ) where t = number of trees, ψ = subsample size
• No pairwise distance matrix required
• Memory footprint is proportional to the number of trees × subsample size
• Suitable for streaming data with incremental updates

Isolation Forest is inherently robust to the curse of dimensionality because it randomly selects a single feature at each split. Unlike distance-based methods where all dimensions contribute to a distance metric and become meaningless in high-dimensional spaces, Isolation Forest's random feature selection means that irrelevant dimensions are simply ignored during many splits. However, when a dataset contains many noisy or irrelevant features, the algorithm can be combined with dimensionality reduction techniques like PCA as a preprocessing step to improve anomaly contrast.

• Each split uses only one randomly chosen feature
• Irrelevant features do not distort distance calculations
• Performs well on datasets with hundreds or thousands of dimensions
• Can be combined with feature bagging for additional robustness

Isolation Forest uses random subsampling to build each tree, which provides two critical benefits. First, it controls the computational cost independently of dataset size. Second, and more importantly, subsampling reduces swamping (normal instances being falsely flagged as anomalies) and masking (anomalies being hidden by other anomalies). By limiting the sample size, the algorithm reduces the density of normal points, making anomalies stand out more clearly. The recommended subsample size of 256 is often sufficient even for datasets with millions of records.

• Swamping: Normal points incorrectly identified as anomalies due to proximity to true anomalies
• Masking: True anomalies hidden because too many anomalies exist in the sample
• Subsampling naturally mitigates both effects
• Larger subsample sizes do not significantly improve performance beyond a point

The machine learning paradigm that powers Isolation Forest, where algorithms identify hidden patterns in unlabeled data without predefined categories. Unlike supervised methods, unsupervised techniques require no historical labels of 'normal' vs. 'anomalous' events, making them ideal for network telemetry where anomalies are rare and undefined.

• Discovers intrinsic data structures without human annotation
• Essential for exploratory analysis of high-dimensional KPI streams
• Includes clustering, dimensionality reduction, and density estimation

The analysis of multiple interconnected variables simultaneously to find anomalies invisible to univariate methods. While a single KPI like throughput might appear normal, its relationship with latency and error rate could reveal a subtle fault. Isolation Forest excels here by partitioning the joint feature space.

• Considers correlations between RAN performance counters
• Detects subtle faults where individual metrics appear normal
• Critical for identifying complex root causes in cellular networks

A support vector machine algorithm trained exclusively on normal data to learn a tight decision boundary. Any point falling outside this boundary is classified as an anomaly. Unlike Isolation Forest's random partitioning approach, One-Class SVM uses kernel methods to define a hypersphere around normal observations.

• Learns from a single class of 'normal' examples
• Effective for novelty detection in stable network baselines
• Computationally more intensive than Isolation Forest on large datasets

A density-based clustering algorithm that groups tightly packed data points and identifies points in sparse regions as outliers. Unlike Isolation Forest, which uses explicit partitioning trees, DBSCAN defines clusters by connected dense regions and requires no pre-specified number of clusters.

• Identifies arbitrarily shaped clusters in telemetry data
• Automatically labels noise points as anomalies
• Sensitive to distance metric selection for high-dimensional RAN data

A neural network trained to reconstruct its input through a compressed bottleneck layer. After training on normal network telemetry, the reconstruction error becomes an anomaly score—data points that deviate from normal patterns produce high error. Isolation Forest offers a lighter-weight alternative without requiring GPU training.

• Learns a compressed representation of normal behavior
• Reconstruction error serves as a continuous anomaly score
• Deep variants can model complex non-linear relationships in RAN data

The phenomenon where the statistical properties of the target variable change over time, rendering a trained anomaly detection model obsolete. In RAN environments, traffic patterns evolve with user behavior and new applications. Isolation Forest models must be periodically retrained to adapt to this drift.

• Causes model degradation in production deployments
• Requires monitoring of input data distributions
• Mitigated through online learning or scheduled model refreshes