What is Isolation Forest anomaly detection?什么是 Isolation Forest 异常检测？
This focused article is part of the anomaly detection and root cause analysis guide; use the pillar guide to compare related concepts, methods, and implementation decisions across the full topic.
本文是异常检测与根因分析指南内容集群中的专题文章；如需比较完整主题下的相关概念、方法与实施决策，请返回基石指南。
Isolation Forest is an unsupervised tree-ensemble algorithm that ranks observations by how quickly random partitions isolate them. Each tree chooses a feature and a split value at random. Rare observations in sparse regions usually reach a terminal node through shorter paths; the forest averages these path lengths into an anomaly score. A high rank is evidence for review, not proof of fraud, failure, or bad data.
Isolation Forest 是一种无监督树集成算法，根据随机切分隔离观测的速度对异常程度排序。每棵树随机选择一个特征和切分值。稀疏区域中的少数观测通常经过更短路径就到达叶节点；森林再将平均路径长度转换成异常分数。高排名只是需要复核的证据，并不证明欺诈、故障或坏数据。
Unlike z-scores, the method does not require a normal distribution. Unlike Local Outlier Factor, it does not calculate neighborhood density. That makes it a practical baseline for multivariate tabular data, especially when labels are scarce and the dataset is large enough for repeated random subsampling.
与 Z 分数不同，该方法不要求正态分布；与 Local Outlier Factor 不同，它不计算邻域密度。因此，它适合作为多变量表格数据的实用基线，尤其适合标签稀缺且数据规模足以支持重复随机子采样的场景。
When Isolation Forest fits—and when it does notIsolation Forest 适用与不适用的场景
- Mostly numeric, multivariate tabular records.以数值型为主的多变量表格记录。
- Few or unreliable anomaly labels.异常标签很少或可靠性不足。
- Global anomalies that are rare and easy to isolate.数量稀少且易隔离的全局异常。
- A scalable screening stage before human review.人工复核之前的可扩展筛查阶段。
- LOF for anomalies defined relative to local density.相对于局部密度定义的异常可考虑 LOF。
- Change-point or forecasting residual methods for temporal regimes.时序状态变化可考虑变点或预测残差方法。
- Supervised models when representative labels exist.存在有代表性的标签时可用监督模型。
- Rules where regulatory or operational logic must be explicit.监管或业务逻辑必须完全透明时可用规则。
Isolation Forest is not a root-cause analysis method. It tells you which feature combinations are unusual under the fitted representation; it does not tell you whether the cause is a sensor fault, a process change, an account takeover, or an expected campaign. Diagnosis starts after scoring.
Isolation Forest 不是根因分析方法。它只能指出在当前特征表示和拟合数据下哪些特征组合不寻常，不能直接判断原因是传感器故障、流程变化、账户接管还是预期营销活动。诊断应在评分之后开始。
How Isolation Forest creates anomaly scoresIsolation Forest 如何生成异常分数
- Subsample observations. Each isolation tree usually trains on a sample rather than the full dataset. Subsampling reduces cost and can make rare points easier to isolate.子采样观测。每棵隔离树通常使用样本而非完整数据训练。子采样既降低成本，也可能让稀有点更容易被隔离。
- Split at random. At a node, choose a feature and then a split between its observed minimum and maximum. Continue until a point is isolated or the depth limit is reached.随机切分。在节点随机选择特征，再在其观测最小值与最大值之间选择切分点，直到观测被隔离或达到深度上限。
- Measure path length. Count the edges from root to terminal node. Short paths suggest a point lies in a sparse, easily separated region.测量路径长度。统计从根节点到叶节点的边数。短路径意味着观测可能位于稀疏且容易分离的区域。
- Average across trees. A forest reduces the variance of any one random partition. Scores normalize mean path length against an expected path length for the sample size.跨树平均。森林降低单次随机切分带来的方差，并依据样本规模下的期望路径长度对平均路径进行归一化。
Important implementation detail: score
direction differs by library. In scikit-learn, lower
score_samples values are more abnormal, while
decision_function is negative for predicted
outliers under the selected offset. Never copy a threshold
across APIs without checking its definition.
重要实现细节：不同库的分数方向可能相反。在
scikit-learn 中，score_samples
越低通常越异常，而在所选偏移量下，预测为离群点的
decision_function 为负。不要在未核对定义时跨 API
复制阈值。
Interpret path length and Isolation Forest scores解读路径长度与 Isolation Forest 分数
The original formulation normalizes a point’s mean path length against the expected path length of an unsuccessful binary search tree. For subsample size ψ, that reference is commonly written as c(ψ) = 2H(ψ−1) − 2(ψ−1)/ψ, where H is the harmonic number. The anomaly score is then s(x, ψ) = 2−E[h(x)]/c(ψ). Shorter-than-expected paths push the original score toward one; long paths push it toward zero. A value near one-half is not a universal boundary between normal and abnormal—it depends on the fitted sample, implementation, feature representation, and decision policy.
原始方法把观测的平均路径长度与不成功二叉搜索树的期望路径长度进行归一化。对子样本大小 ψ，该参考量通常写作 c(ψ) = 2H(ψ−1) − 2(ψ−1)/ψ，其中 H 为调和数；异常分数为 s(x, ψ) = 2−E[h(x)]/c(ψ)。短于期望的路径会使原始分数趋近 1，长路径使其趋近 0。接近 0.5 并不是正常与异常的通用边界，结果取决于拟合样本、实现、特征表示和决策政策。
Normalization makes scores more comparable across trees trained
with the same sampling design, but it does not make them
calibrated probabilities. “0.82” does not mean an 82% chance of
failure. Score distributions can shift when ψ, the feature set,
missing-value treatment, or reference population changes. Store
both the raw library output and a clearly named operational
score, such as abnormality_rank_percentile, so
dashboards do not silently reverse direction. Persist the
library version and offset used by predict.
归一化能提高采用相同采样设计的树之间的可比性，但不会把分数变成校准概率。“0.82”不代表
82% 的失效概率。当
ψ、特征集、缺失值处理或参考总体变化时，分数分布也会变化。应同时保存库的原始输出和名称明确的业务分数，例如
abnormality_rank_percentile，防止看板无意中反转方向；还应保留库版本及
predict 使用的偏移量。
Rank a record against the operating mode, period, product, or peer group used for its decision. A global percentile can hide a rare but legitimate subgroup.
应在用于决策的运行模式、时期、产品或可比群组内排名。全局百分位可能掩盖稀少但合理的子群。
Repeat seeds and samples, then report top-k overlap and score variation. Unstable edge cases need more evidence before operational escalation.
重复随机种子和样本，并报告 Top-k 重合度与分数变化。不稳定的边界案例需要更多证据才能升级。
Prepare data for Isolation Forest anomaly detection为 Isolation Forest 异常检测准备数据
- Define the observation: one row might be a transaction, device-hour, patient encounter, or account-day. Mixing grains creates artificial anomalies.定义观测粒度：一行可以是交易、设备小时、就诊记录或账户日。混合粒度会制造人为异常。
- Choose a reference population: compare legitimate peers. Separate products, operating modes, regions, or lifecycle stages when their normal behavior differs materially.选择参考群体：比较真正可比的对象。当产品、运行模式、地区或生命周期阶段的正常行为明显不同，应分组建模。
- Repair pipeline defects: investigate duplicate joins, impossible units, sentinel values, clock shifts, and data loss before training. Otherwise the model may accurately detect the pipeline bug.修复管道缺陷：训练前调查重复连接、不可能单位、哨兵值、时钟偏移与数据丢失，否则模型可能只是准确发现管道错误。
- Encode meaningfully: exclude identifiers, free text, and future information from the feature matrix. Encode categories deliberately; arbitrary integer codes create false order.有意义地编码：从特征矩阵排除标识符、自由文本和未来信息。类别必须谨慎编码，任意整数编码会产生虚假顺序。
- Preserve lineage: keep record ID, event time, raw values, transformations, model version, score, threshold, rank, review state, and final disposition.保留血缘：保存记录 ID、事件时间、原始值、变换、模型版本、分数、阈值、排名、复核状态和最终处置。
Tree splits are less sensitive to feature scaling than Euclidean-distance methods, but “scaling is never needed” is too broad. Log transforms can make heavily skewed amounts easier to partition; clipping may hide real extremes; and one-hot expansion can change feature-selection probabilities. Treat preprocessing as part of the model and validate it.
树切分对特征尺度的敏感度通常低于欧氏距离方法，但“永远不需要缩放”过于绝对。对数变换可能让强偏态金额更容易切分，截尾可能掩盖真实极端值，而独热编码会改变特征被选择的概率。应把预处理视为模型的一部分并加以验证。
Isolation Forest anomaly detection in Python使用 Python 实现 Isolation Forest 异常检测
This minimal scikit-learn workflow separates fitting, scoring, and thresholding. The numbers are an illustrative example, not recommended production settings.
下面的最小 scikit-learn 工作流分离拟合、评分和阈值选择。所有数字仅为示例，不是生产环境推荐值。
from sklearn.ensemble import IsolationForest
import numpy as np
features = ["amount_log", "items", "hour_sin", "hour_cos", "account_age_days"]
X_train = train_df[features]
X_valid = valid_df[features]
model = IsolationForest(
n_estimators=300,
max_samples="auto",
contamination="auto",
max_features=1.0,
random_state=42,
n_jobs=-1,
)
model.fit(X_train)
# Lower raw score means more abnormal in scikit-learn.
valid_df["iforest_score"] = model.score_samples(X_valid)
# Example review budget: flag the lowest 0.5% of validation scores.
threshold = np.quantile(valid_df["iforest_score"], 0.005)
valid_df["review_flag"] = valid_df["iforest_score"] <= thresholdFit preprocessing on training data only, persist the complete pipeline, and score an out-of-time or otherwise independent validation period. If you already know the desired alert capacity, a rank- or quantile-based review budget can be more operationally honest than pretending the anomaly prevalence is known.
预处理只能在训练数据上拟合，应持久化完整管道，并在时间外或其他独立验证集上评分。如果已知每日可处理的告警数量，以排名或分位数定义复核预算，通常比假装已知异常比例更符合真实业务。
Tune n_estimators, max_samples, contamination, and features调优 n_estimators、max_samples、contamination 与特征
| Parameter参数 | What it controls控制内容 | How to validate如何验证 |
|---|---|---|
n_estimators |
Number of random trees; more trees usually stabilize scores at added compute cost.随机树数量；更多树通常提高分数稳定性，但增加计算成本。 | Plot rank correlation and top-k overlap across tree counts and random seeds.比较不同树数和随机种子下的排名相关性与 Top-k 重合度。 |
max_samples |
Observations used per tree. Small samples are faster and emphasize isolation; very small samples may miss structure.每棵树使用的观测数。小样本更快并强调隔离，但过小可能遗漏结构。 | Test plausible values on held-out periods and inspect stability by subgroup.在留出时期测试合理取值，并按群组检查稳定性。 |
contamination |
Sets the prediction offset or expected flagged share; it does not teach the forest what an anomaly looks like.设置预测偏移或预期标记比例；它不会教会森林异常的形态。 | Calibrate from labels, review capacity, or false-positive/false-negative costs.根据标签、复核能力或误报与漏报成本校准。 |
max_features |
Feature subsampling per tree. It can diversify trees but may hide anomalies requiring a specific combination.每棵树的特征子采样。它能增加多样性，但可能隐藏依赖特定组合的异常。 | Compare detection quality, subgroup behavior, and repeated-seed stability.比较检测质量、群组表现与重复种子的稳定性。 |
random_state |
Reproducible random partitions.确保随机切分可复现。 | Fix it for audit, then deliberately rerun multiple seeds as a sensitivity test.审计时固定种子，再主动使用多个种子进行敏感性测试。 |
Choose an anomaly threshold without inventing certainty在不制造虚假确定性的前提下选择异常阈值
The forest produces a score or ranking; the threshold is a decision policy. If representative labels exist, evaluate precision, recall, PR-AUC, cost-weighted utility, and performance at the review capacity. With sparse labels, create an adjudicated sample across score bands rather than reviewing only the most extreme points. Without labels, combine score stability, domain constraints, known incidents, synthetic-but-plausible perturbations, and a fixed review budget.
森林产生分数或排名，阈值则属于决策政策。如果存在有代表性的标签，应评估精确率、召回率、PR-AUC、成本加权效用以及复核能力约束下的表现。标签稀缺时，应跨多个分数区间建立裁决样本，而不是只检查最极端点。没有标签时，可结合分数稳定性、领域约束、已知事件、合理的合成扰动和固定复核预算。
A useful deployment metric: precision at k answers “of the k alerts we can investigate, how many are confirmed useful?” Also track alert volume by subgroup, time, source, and model version so a data pipeline shift does not masquerade as improved detection.
实用上线指标：Precision@k 回答“在能够调查的 k 个告警中，有多少被确认有用？”还应按群组、时间、来源和模型版本监控告警量，防止数据管道变化伪装成检测能力提升。
Use Isolation Forest for time-series anomaly detection carefully谨慎使用 Isolation Forest 进行时间序列异常检测
Standard Isolation Forest treats each row as an unordered feature vector. It does not inherently know that Monday follows Sunday, that demand peaks every morning, or that ten mild deviations in a row form a collective anomaly. Represent temporal context explicitly with lags, rolling medians, rolling MAD, rates of change, seasonal residuals, event-window summaries, or learned embeddings.
标准 Isolation Forest 把每行视为无序特征向量。它并不知道星期一接在星期日之后，也不知道需求每天早晨达到峰值，更不知道连续十次轻微偏差可能构成群体异常。必须通过滞后项、滚动中位数、滚动 MAD、变化率、季节残差、事件窗口摘要或学习得到的嵌入显式表示时间上下文。
Split training and evaluation chronologically, fit transforms only on past data, and prevent overlapping windows from leaking near-identical observations across the boundary. For level shifts or regime changes, compare Isolation Forest with dedicated change-point detection. For forecastable seasonality, scoring residuals may be clearer than scoring raw values.
训练集与评估集应按时间顺序划分，所有变换只能在过去数据上拟合，并防止重叠窗口把几乎相同的观测泄漏到边界两侧。对于水平跃迁或状态变化，应与专用变点检测比较；对于可预测的季节性，对残差评分可能比对原始值评分更清晰。
Isolation Forest vs LOF, One-Class SVM, and autoencodersIsolation Forest、LOF、One-Class SVM 与自编码器对比
| Method方法 | Best starting point适合作为起点 | Main limitation主要局限 |
|---|---|---|
| Isolation Forest | Scalable global screening on mostly numeric tabular data.以数值为主的表格数据上的可扩展全局筛查。 | Axis-aligned random cuts may miss local, collective, or nonlinear anomalies.轴对齐随机切分可能遗漏局部、群体或非线性异常。 |
| Local Outlier Factor | Anomalies are sparse relative to nearby peers and cluster densities vary.异常相对近邻更稀疏，且不同簇密度不同。 | Sensitive to distance, scaling, neighborhood size, and high dimension.对距离、缩放、邻域大小与高维度敏感。 |
| One-Class SVM | A clean reference set and a flexible boundary on moderate data.中等规模数据上有干净参考集并需要灵活边界。 | Scaling and kernel tuning matter; large datasets can be expensive.缩放与核调优很重要；大数据集成本可能较高。 |
| Autoencoder | Complex nonlinear patterns, images, signals, or learned representations.复杂非线性模式、图像、信号或学习表示。 | More data, tuning, threshold work, and governance; reconstruction error is not automatically causal.需要更多数据、调优、阈值工作与治理；重构误差也不自动代表因果。 |
Explain an Isolation Forest alert without claiming a root cause解释 Isolation Forest 告警，但不把它当作根因
Start with a cohort comparison, not an attribution chart. Show the flagged record beside robust medians, ranges, and recent examples from legitimate peers. Identify which raw and derived features are unusual, whether the combination or each value is rare, and whether missingness or preprocessing created the difference. Then inspect several nearest records in time and business context. A point can be globally easy to isolate even when every individual feature looks plausible.
应先做群组比较，而不是先看归因图。把标记记录与合理可比对象的稳健中位数、范围和近期样例并排展示，识别哪些原始或派生特征异常，究竟是组合罕见还是单值罕见，以及缺失或预处理是否制造了差异。随后检查时间与业务上下文最接近的若干记录。即使每个单独特征都看似合理，组合后的观测也可能在全局上很容易被隔离。
Tree-path counts, permutation tests, feature removal, and SHAP variants can help describe model sensitivity, but they answer “what influenced this score under this fitted model,” not “what caused the real event.” Correlated features can split credit; one-hot features can dominate explanations; and retraining can change the explanation without changing the record. Validate an explanation by perturbing features only within plausible ranges, checking whether ranking changes consistently across seeds, and comparing it with domain evidence.
树路径计数、置换检验、特征移除和 SHAP 变体可以描述模型敏感性，但它们回答的是“在当前拟合模型下什么影响了分数”，而不是“现实事件由什么造成”。相关特征可能分摊归因，独热特征可能主导解释，重训也可能在记录不变时改变解释。验证解释时，只应在合理范围内扰动特征，检查排名是否跨随机种子一致变化，并与领域证据比较。
| Signal信号 | Question问题 | Evidence证据 |
|---|---|---|
| Rare value稀有值 | Valid extreme, unit error, or new regime?真实极端、单位错误还是新状态？ | Raw source, units, calibration, peer history原始来源、单位、校准、群组历史 |
| Rare combination稀有组合 | Which dependency or operating condition links the features?什么依赖或运行条件连接这些特征？ | Timeline, configuration, process stage, linked records时间线、配置、流程阶段、关联记录 |
| Score shift分数漂移 | Behavior change or data-pipeline change?行为变化还是数据管道变化？ | Schema, missingness, transform version, source coverageSchema、缺失、变换版本、来源覆盖 |
Example: screening unusual equipment operating windows示例：筛查异常设备运行窗口
Hypothetical example: a maintenance team creates one row per machine-hour with vibration RMS, temperature, power draw, load, product type, and rate-of-change features. After excluding planned maintenance and separating operating modes, it fits the forest on an earlier stable period. The team flags a review budget of 20 machine-hours per day.
假设示例：维护团队为每个设备小时建立一行，包含振动 RMS、温度、功耗、负载、产品类型和变化率特征。排除计划维护并区分运行模式后，团队在较早的稳定时期拟合森林，并把每日复核预算设为 20 个设备小时。
One flagged row has high temperature and low power draw. That combination is rare, but the score does not identify a cause. Reviewers join the record to work orders, sensor calibration history, product changeovers, and operator notes. They discover the sensor was recalibrated that morning. The correct action is to repair lineage and retrain or transform consistently—not to label the machine as failing.
某条标记记录同时出现高温与低功耗，这一组合确实少见，但分数不能直接指出原因。复核人员把记录与工单、传感器校准历史、产品换型和操作员备注关联，发现当天早晨刚进行传感器校准。正确行动是修复数据血缘并一致地重训或变换，而不是直接认定设备故障。
Deploy Isolation Forest as a governed decision workflow把 Isolation Forest 部署为受治理的决策流程
Begin in shadow mode: score live records without triggering automated action. Compare alert volume, score distribution, review yield, latency, and subgroup behavior with the offline backtest. Investigate mismatches before enabling notifications. They often reveal a different preprocessing path, late-arriving features, unseen categories, clock boundaries, or a reference population that no longer matches production. Package feature transformations and the model together so training and scoring cannot drift independently.
应先以影子模式运行：对实时记录评分，但不触发自动行动。把告警量、分数分布、复核有效率、延迟和子群表现与离线回测比较，启用通知前调查差异。问题常来自预处理路径不同、特征迟到、未见类别、时钟边界或参考总体已不再匹配生产。应把特征变换与模型一起打包，防止训练和评分独立漂移。
Design the review queue as part of the model. Show reviewers the record time, peer group, transformed and raw feature values, score direction, rank, threshold reason, model version, and relevant source evidence. Provide dispositions that distinguish confirmed harmful events, legitimate rare events, data defects, new normal regimes, and unresolved cases. Randomly sample some below-threshold records to estimate what the queue misses; feedback only from flagged records creates selection bias.
复核队列也是模型的一部分。应向复核人员展示记录时间、可比群组、变换后与原始特征值、分数方向、排名、阈值理由、模型版本和相关来源证据。处置结果要区分已确认有害事件、合理稀有事件、数据缺陷、新常态和未解决案例。还应随机抽查部分阈值以下记录以估计漏检，只从已标记记录获取反馈会产生选择偏差。
Define retraining triggers before launch. Calendar retraining is simple but may be too early or too late; evidence-based triggers include sustained feature or score drift, new operating modes, schema changes, declining precision at k, unstable ranks, or a material change in review policy. Every replacement should run against a fixed regression set, an out-of-time sample, known incidents, and subgroup checks. Version the threshold separately from the forest, because review capacity can change without a new model. Keep a rollback model and preserve the exact features required to reproduce past alerts.
上线前应定义重训触发条件。按日历重训简单，却可能过早或过晚；基于证据的触发包括持续特征或分数漂移、新运行模式、Schema 变化、Precision@k 下降、排名不稳定或复核政策发生重大变化。每个替代模型都应在固定回归集、时间外样本、已知事件和子群检查上运行。阈值与森林应分别版本化，因为复核能力可能在模型不变时变化。保留回滚模型，并保存重现历史告警所需的确切特征。
Automation boundary: avoid deleting records, blocking accounts, stopping equipment, or initiating disciplinary action from an unsupervised score alone. Require controls proportionate to the consequence, including human review, corroborating evidence, appeal or override paths, and audit logs.
自动化边界：不要仅凭无监督分数删除记录、冻结账户、停机或启动纪律处分。应按后果设置相称控制，包括人工复核、佐证、申诉或覆盖路径与审计日志。
Validate alerts before production use在生产使用前验证告警
- Independent evaluation: use out-of-time data or a group holdout that matches deployment.独立评估：使用与部署相符的时间外数据或群组留出集。
- Repeated seeds: measure rank correlation, top-k overlap, and score variation.重复种子：测量排名相关性、Top-k 重合度和分数变化。
- Subgroup review: compare alert rates and precision across products, locations, devices, and protected or operationally sensitive groups.群组复核：比较不同产品、地点、设备及受保护或业务敏感群组的告警率与精确率。
- Data drift: monitor missingness, feature distributions, category coverage, schema changes, and score distributions.数据漂移：监控缺失率、特征分布、类别覆盖、Schema 变化和分数分布。
- Decision audit: retain who reviewed each alert, evidence considered, disposition, and downstream action.决策审计：保留复核人员、所用证据、处置结论和后续行动。
Do not optimize only for an aggregate metric. A model can improve PR-AUC while overwhelming investigators, concentrating false positives in one facility, or becoming unstable after a data-source migration. Validation must reflect the real decision system.
不要只优化汇总指标。模型可能在提高 PR-AUC 的同时压垮调查人员、把误报集中在某个工厂，或在数据源迁移后变得不稳定。验证必须反映真实决策系统。
Investigate reviewed Isolation Forest flags with connected evidence结合关联证据调查已复核的 Isolation Forest 标记
Prepare stable record IDs, raw and transformed features, timestamps, peer groups, scores, thresholds, ranks, model versions, review status, and relevant database or document context. Compute the Isolation Forest scores in your ML environment first. InfiniSynapse is an AI-powered analysis workspace across databases, files, and documents; this page does not claim it contains a built-in Isolation Forest implementation. Use it to investigate computed flags alongside source evidence and business context, then verify conclusions before action.
请准备稳定记录 ID、原始与变换后特征、时间戳、可比群组、分数、阈值、排名、模型版本、复核状态，以及相关数据库或文档上下文。请先在机器学习环境中计算 Isolation Forest 分数。InfiniSynapse 是跨数据库、文件和文档的 AI 辅助分析工作区；本页不声称其内置 Isolation Forest。可用它把已计算标记与来源证据和业务语境一起调查，并在采取行动前验证结论。
Open InfiniSynapse for connected evidence analysis打开 InfiniSynapse 进行关联证据分析Common mistakes and practical limitations常见错误与实际局限
It is an expected fraction or offset choice. A value of 1% does not prove exactly 1% of records are harmful.
它只是预期比例或偏移选择。设置 1% 并不能证明恰好 1% 的记录有害。
Flags may be valid rare events, new regimes, data defects, or valuable opportunities. Preserve raw data and adjudicate.
标记可能是真实稀有事件、新状态、数据缺陷或有价值机会。应保留原始数据并进行裁决。
A global forest can mark a normal minority operating mode. Segment peers or add context features without leaking outcomes.
全局森林可能把正常的少数运行模式标为异常。应划分可比群组或加入不泄漏结果的上下文特征。
The algorithm does not understand sequence, seasonality, or collective events until those properties become features.
除非把顺序、季节性或群体事件转化为特征，否则算法无法理解它们。
Frequently asked questions about Isolation Forest anomaly detection关于 Isolation Forest 异常检测的常见问题
What is Isolation Forest anomaly detection?什么是 Isolation Forest 异常检测？
Isolation Forest is an unsupervised tree-ensemble method that flags observations requiring unusually few random splits to isolate.
Isolation Forest 是无监督树集成方法，用于标记在随机切分下用异常少的步骤就能被隔离的观测。
Does Isolation Forest require feature scaling?Isolation Forest 需要特征缩放吗？
It is less scale-sensitive than distance-based methods, but units, transformations, skew, missing values, and feature semantics still affect which random cuts are useful.
它通常不如距离方法敏感，但单位、变换、偏态、缺失值和特征语义仍会影响哪些随机切分有效。
How should contamination be chosen?如何选择 contamination？
Treat contamination as a thresholding assumption, not discovered truth. Prefer a review budget, labeled validation set, or cost-based threshold and test sensitivity across plausible values.
应把 contamination 视为阈值假设而非发现的真相。优先依据复核预算、有标签验证集或成本选择阈值，并对合理取值进行敏感性测试。
Can Isolation Forest detect time-series anomalies?Isolation Forest 能检测时间序列异常吗？
Yes, after representing temporal context with lags, rolling statistics, residuals, or windows. Raw timestamps alone do not teach seasonality or sequence order.
可以，但需使用滞后项、滚动统计、残差或窗口表示时间上下文。仅有原始时间戳无法让模型理解季节性与顺序。
How do I explain an Isolation Forest alert?如何解释 Isolation Forest 告警？
Pair the score with feature-level comparisons, peer groups, tree-path or attribution diagnostics, source records, timestamps, and domain review. The score alone is not a root cause.
应把分数与特征层比较、可比群组、树路径或归因诊断、来源记录、时间戳和领域复核结合。分数本身不是根因。
Official sources and verification notes官方来源与验证说明
- Liu, Ting, and Zhou: Isolation-Based Anomaly DetectionLiu、Ting 与 Zhou：基于隔离的异常检测论文
- scikit-learn IsolationForest API referencescikit-learn IsolationForest API 参考
- scikit-learn guide to novelty and outlier detectionscikit-learn 新颖性与离群检测指南
These primary and official implementation sources support the algorithm description and API behavior used here. Recheck score direction, defaults, supported missing-value behavior, and version-specific parameters against the exact library release deployed in your environment.
这些论文与官方实现文档支持本文的算法说明和 API 行为。实际部署时，应针对环境中使用的确切库版本，重新核对分数方向、默认值、缺失值支持方式和版本特定参数。