How does isolation forest detect anomalies in trading data?

Question

AcadiFi · Accepted Answer

Isolation forest is an ensemble method for anomaly detection that exploits a simple insight: anomalies are few and different, so they are easier to isolate than normal points. The algorithm builds many random trees by repeatedly picking a random feature and a random split value. Each tree isolates observations by recursively partitioning the data. Anomalies reach a leaf in fewer splits because they sit in sparse regions; normal points take more splits because they nest among similar neighbors.

The anomaly score is derived from the average path length across trees, normalized by the expected path length for a random point in a dataset of the same size. Points with short average path lengths are anomalies.

For trade monitoring at a firm like Selverton Markets, fit isolation forest on 24 features per trade (volume, bid-ask spread, queue position, order type, etc.) with 200 trees and subsample size 256. The model assigns a score between 0 and 1 to each trade. Trades scoring above 0.7 are flagged for compliance review. On 500,000 trades, this runs in minutes.

Isolation forest is fast (linear in sample size with a small constant), handles high-dimensional data well, does not assume normality or a specific distribution, and requires minimal tuning. Its main parameters are the number of trees and subsample size. Contrast with one-class SVM, which is slower but can produce tighter decision boundaries for small datasets. For CFA candidates, isolation forest is the go-to anomaly detector for large operational datasets.

How does isolation forest detect anomalies in trading data?

Master Level II with our CFA Course

Related Questions

Practice Questions