An isolation forest is trained to detect anomalies in a network traffic dataset. An observation receives an anomaly score close to 1.0. What does this score indicate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're seeing a score near 1.0 because the observation was isolated with very few random splits, which means it sits in a sparse region and is likely anomalous.
Full Explanation
The correct answer is the observation that required very few splits to isolate, indicating it lies in a sparse region of the feature space and is likely anomalous. Isolation forests build random trees that isolate observations through random axis-aligned splits. Anomalies in sparse, extreme regions need fewer splits than normal observations in dense clusters. A score near 1.0 means a short average path length across trees, consistent with an anomaly. The claim that the observation is near the centroid of the most dense data cluster and is very normal is wrong because a high score means anomalous, not normal. The claim that the score exceeds the 95th percentile of training data scores is wrong because isolation scores are not percentile-based on training data. The claim that a feature is more than 3 standard deviations from the mean is wrong because isolation forests are tree-based and do not use standard deviation thresholds.