An isolation forest is trained to detect anomalies in a network traffic dataset. An observation receives an anomaly score close to 1.0. What does this score indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because isolation forests work by building random trees that isolate individual observations through random axis-aligned splits. Anomalies (which lie in sparse, extreme regions) require fewer splits to isolate than normal observations (which lie in dense clusters requiring many splits).
Full explanation below image
Full Explanation
B is correct because isolation forests work by building random trees that isolate individual observations through random axis-aligned splits. Anomalies (which lie in sparse, extreme regions) require fewer splits to isolate than normal observations (which lie in dense clusters requiring many splits). A high anomaly score (near 1.0) means the average path length across isolation trees was short — consistent with an anomaly. A is wrong (high score = anomalous, not normal). C is wrong; isolation scores are not percentile-based on training data. D is wrong; isolation forests are tree-based and don't use standard deviation thresholds.