In isolation forests for anomaly detection, why are anomalies isolated in fewer random splits than normal points?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're relying on the fact that anomalies are few and different, sitting in sparse regions with few neighbors. In isolation forests, random splits isolate them quickly, while normal points in dense regions need many more splits.
Full Explanation
Anomalies are few and different; they lie in sparse regions requiring fewer splits to separate them from all other points. Isolation forests exploit this by building random partitioning trees: because anomalies have few neighbors, a small number of random splits can isolate them, while normal points in dense regions require many more splits. Claiming anomalies have higher density and cluster together is wrong because anomalies are sparse, not dense. Claiming smaller residuals from a fitted regression model is wrong because regression residuals are not the mechanism. Claiming anomalies always have missing values is wrong because missing values are not defining characteristics.