An isolation forest is trained to detect anomalies in a network traffic dataset. An observation receives an anomaly score close to 1.0. What does this score indicate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because isolation forests work by building random trees that isolate individual observations through random axis-aligned splits. Anomalies (which lie in sparse, extreme regions) require fewer splits to isolate than normal observations (which lie in dense clusters requiring many splits).
Full Explanation
B is correct because isolation forests work by building random trees that isolate individual observations through random axis-aligned splits. Anomalies (which lie in sparse, extreme regions) require fewer splits to isolate than normal observations (which lie in dense clusters requiring many splits). A high anomaly score (near 1.0) means the average path length across isolation trees was short — consistent with an anomaly. A is wrong (high score = anomalous, not normal). C is wrong; isolation scores are not percentile-based on training data. D is wrong; isolation forests are tree-based and don't use standard deviation thresholds.