Online Isolation Forest
Online Isolation Forest (Streaming Anomaly Detection with Isolation Trees) · Also known as: streaming isolation forest, incremental isolation forest, online iForest, adaptive isolation forest
Online Isolation Forest extends the Isolation Forest anomaly-detection algorithm to streaming or continuously arriving data. Instead of rebuilding isolation trees from scratch when new observations arrive, the forest is updated incrementally so that anomaly scores remain current without reprocessing the entire history. This makes it practical for real-time monitoring, fraud detection, and sensor-data surveillance where data volumes grow indefinitely.
Read the full method
Sign in with a free account to read this section.
Method map
The neighbourhood of related methods — select a node to explore.
When to use it
Use Online Isolation Forest when anomalies must be detected in real time from a continuously arriving data stream, and when the underlying distribution may drift over time so that a static model would become stale. It is well-suited for network intrusion detection, financial transaction monitoring, industrial sensor surveillance, and log-stream analysis with high throughput. Avoid it when the entire dataset fits comfortably in memory and there is no need for real-time decisions — standard batch Isolation Forest will be simpler and equally effective. Also avoid it when you need interpretable rejection rules, as isolation trees remain black-box.
Strengths & limitations
- Processes data streams without storing the entire history, making it memory-efficient.
- Adapts to distribution shift by replacing stale trees with freshly grown ones.
- Inherits iForest's near-linear time complexity, enabling high-throughput real-time scoring.
- No assumption about the anomaly distribution; effective on multivariate, mixed-type tabular streams.
- Anomaly score is a continuous value, supporting flexible threshold tuning.
- Choosing when and how aggressively to replace trees requires careful tuning and domain knowledge.
- Performance degrades on data with many irrelevant features because random splits waste tree depth.
- Anomaly scores can be misleading for clustered anomalies (anomaly masking), a known limitation inherited from batch iForest.
- Lacks transparent decision rules, making it hard to explain flagged anomalies to non-technical stakeholders.
Frequently asked
How is Online Isolation Forest different from standard Isolation Forest?
Standard Isolation Forest is trained once on a fixed batch of data and cannot adapt to new observations. Online Isolation Forest incrementally updates the tree forest as new data arrives, allowing it to track distribution changes in a stream without full retraining.
How do I choose how often to refresh the trees?
A common strategy is to replace the oldest tree with a new one grown on a recent window of data every time a fixed number of new observations arrive. The replacement rate should be calibrated against the expected speed of distribution drift in your application.
Does Online Isolation Forest work well on high-dimensional data?
Its performance degrades as irrelevant dimensions increase, because random splits are spread across useless features. Applying feature selection or dimensionality reduction before streaming the data improves detection accuracy.
What anomaly score threshold should I use?
Scores above about 0.6 are conventionally flagged as anomalies, but this is dataset-dependent. Always calibrate the threshold using labelled validation examples or domain knowledge about acceptable false-positive rates before deploying.
Can it handle concept drift?
Yes — that is its primary advantage over batch iForest. By continuously replacing old trees with trees grown on recent data, the model tracks gradual or sudden shifts in the normal data distribution.
Sources
- Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008). Isolation Forest. In Proceedings of the 8th IEEE International Conference on Data Mining (ICDM), pp. 413–422. DOI: 10.1109/ICDM.2008.17 ↗
- Tan, S. C., Ting, K. M., & Liu, T. F. (2011). Fast Anomaly Detection for Streaming Data. In Proceedings of the 22nd International Joint Conference on Artificial Intelligence (IJCAI), pp. 1511–1516. link ↗
How to cite this page
ScholarGate. (2026, June 3). Online Isolation Forest (Streaming Anomaly Detection with Isolation Trees). ScholarGate. https://scholargate.app/en/machine-learning/online-isolation-forest
Which method?
Set this method beside its closest kin and read them side by side — the library lays the books on the table; the choice is yours.
- Autoencoder Anomaly DetectionMachine learning↔ compare
- Isolation ForestMachine learning↔ compare
- One-class SVMMachine learning↔ compare
- Online LearningMachine learning↔ compare
- Online Random ForestMachine learning↔ compare
- Semi-supervised Isolation ForestMachine learning↔ compare