Isolation Forest is similar in principle to Random Forest and is built on the basis of decision trees. Isolation Forest, however, identifies anomalies or outliers rather than profiling normal data points. Isolation Forest isolates observations by randomly selecting a feature and then randomly selecting a split value between the maximum and minimum values of that selected feature. This split depends on how long it takes to separate the points.
Random partitioning produces noticeably shorter paths for anomalies. When a forest of random trees collectively produces shorter path lengths for particular samples, they are highly likely to be anomalies.
Tutorials and Blogs¶
The following tutorials are available that describe how to use Isolation Forest to find anomalies in a dataset and how to interpret the results.
Isolation Forest Deep Dive: Describes how the Isolation Forest algorithm works and how to use it.
Interpreting Isolation Forest Anomalies: Describes how to understand why a particular feature is considered an anomaly.
The Anomaly Detection with Isolation Forests using H2O blog provides a summary and examples of the Isolation Forest algorithm in H2O.
Defining an Isolation Forest Model¶
model_id: (Optional) Specify a custom name for the model to use as a reference. By default, H2O automatically generates a destination key.
training_frame: (Required) Specify the dataset used to build the model. NOTE: In Flow, if you click the Build a model button from the
Parsecell, the training frame is entered automatically.
x: Specify a vector containing the names or indices of the predictor variables to use when building the model. If
xis missing, then all columns except
score_each_iteration: (Optional) Enable this option to score during each iteration of the model training (disabled by default).
score_tree_interval: Score the model after every so many trees. This value is set to 0 (disabled) by default.
ignored_columns: (Optional, Python and Flow only) Specify the column or columns to be excluded from the model. In Flow, click the checkbox next to a column name to add it to the list of columns excluded from the model. To add all columns, click the All button. To remove a column from the list of ignored columns, click the X next to the column name. To remove all columns from the list of ignored columns, click the None button. To search for a specific column, type the column name in the Search field above the column list. To only show columns with a specific percentage of missing values, specify the percentage in the Only show columns with more than 0% missing values field. To change the selections for the hidden columns, use the Select Visible or Deselect Visible buttons.
ignore_const_cols: Specify whether to ignore constant training columns, since no information can be gained from them. This option is enabled by default.
ntrees: Specify the number of trees. This values defaults to 50.
max_depth: Specify the maximum tree depth. Higher values will make the model more complex and can lead to overfitting. Setting this value to 0 specifies no limit. This value defaults to 8.
min_rows: Specify the minimum number of observations for a leaf (
nodesizein R). This value defaults to 1.
max_runtime_secs: Maximum allowed runtime in seconds for model training. This value is set to 0 (disabeld) by default.
seed: Specify the random number generator (RNG) seed for algorithm components dependent on randomization. The seed is consistent for each H2O instance so that you can create models with the same starting conditions in alternative configurations. This value defaults to -1 (time-based random number).
build_tree_one_node: Specify whether to run on a single node. This is suitable for small datasets as there is no network overhead but fewer CPUs are used. This value is disabled by default.
mtries: Specify the columns to randomly select at each level. If the default value of
-1is used, the number of variables is the square root of the number of columns for classification and p/3 for regression (where p is the number of predictors). If
-2is specified, all features of IF are used. Valid values for this option are -2, -1, and any value >= 1.
sample_size: The number of randomly sampled observations used to train each Isolation Forest tree. Only one of
sample_rateshould be defined. If
sample_sizewill be ignored. This value defaults to 256.
sample_rate: Specify the row sampling rate (x-axis). (Note that this method is sample without replacement.) The range is 0.0 to 1.0. Higher values may improve training accuracy. Test accuracy improves when either columns or rows are sampled. For details, refer to “Stochastic Gradient Boosting” (Friedman, 1999). If set to -1 (default), then
sample_sizewill be used instead.
col_sample_rate_change_per_level: This option specifies to change the column sampling rate as a function of the depth in the tree. This can be a value > 0.0 and <= 2.0 and defaults to 1. (Note that this method is sample without replacement.) For example:
level 1: col_sample_rate
level 2: col_sample_rate * factor
level 3: col_sample_rate * factor^2
level 4: col_sample_rate * factor^3
col_sample_rate_per_tree: Specify the column sample rate per tree. This can be a value from 0.0 to 1.0 and defaults to 1. Note that this method is sample without replacement.
categorical_encoding: Specify one of the following encoding schemes for handling categorical features:
AUTO: Allow the algorithm to decide (default). In Isolation Forest, the algorithm will automatically perform
Enum: 1 column per categorical feature
EnumLimited: Automatically reduce categorical levels to the most prevalent ones during training and only keep the T (10) most frequent levels.
OneHotExplicit: N+1 new columns for categorical features with N levels
Binary: No more than 32 columns per categorical feature
Eigen: k columns per categorical feature, keeping projections of one-hot-encoded matrix onto k-dim eigen space only
LabelEncoder: Convert every enum into the integer of its index (for example, level 0 -> 0, level 1 -> 1, etc.)
stopping_rounds: Stops training when the option selected for stopping_metric doesn’t improve for the specified number of training rounds, based on a simple moving average. This value is set to 0 (disabled) by default. The metric is computed on the validation data (if provided); otherwise, training data is used.
Note: If cross-validation is enabled:
All cross-validation models stop training when the validation metric doesn’t improve.
The main model runs for the mean number of epochs.
N+1 models may be off by the number specified for stopping_rounds from the best model, but the cross-validation metric estimates the performance of the main model for the resulting number of epochs (which may be fewer than the specified number of epochs).
stopping_metric: Specify the metric to use for early stopping. The available options are:
AUTO: This defaults to
deviancefor regression, and
anomaly_scorefor Isolation Forest. Note that custom and custom_increasing can only be used in GBM and DRF with the Python client. Must be one of:
anomaly_score. Defaults to
anomaly_score(Isolation Forest only)
AUC(area under the ROC curve)
AUCPR(area under the Precision-Recall curve)
custom(Python client only)
custom_increasing(Python client only)
stopping_tolerance: Specify the relative tolerance for the metric-based stopping to stop training if the improvement is less than this value. This value defaults to 0.01.
export_checkpoints_dir: Specify a directory to which generated models will automatically be exported.
contamination: The contamination ratio is the proportion of anomalies in the input dataset. If undefined (
-1), the predict function will not mark observations as anomalies and only anomaly score will be returned. Defaults to
Below is a simple example showing how to build an Isolation Forest model.