Lion Cipher Lab
Detect outliers with Isolation Forest
- AI Security
- Beginner
- ~40 min
- Free · no account required
Why it matters
Most real security data arrives with no labels. Nobody has gone through your millions of logins and marked which were attacks, so the supervised recipe (train on labeled examples) simply does not apply. Unsupervised anomaly detection is the honest tool for that world: it learns the shape of ordinary data and flags what does not fit, without ever being shown a single example of bad. Isolation Forest is one of the standard, fast, offline ways to do it, and running it on your own data once demystifies a technique that sits under a great deal of fraud, intrusion, and monitoring tooling. It also…
What you'll learn
- unsupervised anomaly detection with no labels
- the isolation intuition (anomalies are easier to isolate)
- building your own small numeric dataset
- fitting scikit-learn's IsolationForest
- reading predictions (-1 = outlier) and anomaly scores
- tuning the contamination parameter
- why unsupervised is not the same as accurate
- why an anomaly is not the same as malicious
Steps in this lab
- Unsupervised anomaly detection, in plain terms
- The intuition: anomalies are easier to isolate
- Install scikit-learn, offline after this
- Make your own small numeric dataset
- Fit IsolationForest and read the flags and scores
- Tune contamination and see the threshold move
- The honest limits: unsupervised is not accurate, and anomaly is not malicious
- What you can now do that most people can't