Machine learning-based anomaly detection with Isolation Forest in large-scale data analysis

Abstract

This paper presents an applied study of unsupervised anomaly detection with Isolation Forest on large multivariate sensor data. The study implements a concise Python workflow that acquires city‑scale measurements for Kyiv, merges reference metadata, removes invalid records, selects two continuous indicators, and trains Isolation Forest with parameters. Temporal analysis shows that anomalies concentrate in contiguous intervals rather than isolated single points, while a two‑feature projection indicates that many flags coincide with jointly high values and others arise from atypical value combinations, highlighting multivariate effects.
The study documents practical advantages of Isolation Forest, including minimal distributional assumptions, direct control of alert volume via the contamination parameter, and near‑linear scaling that supports repeated retraining. It also notes limitations, such as sensitivity on small samples due to random tree construction, dependence on threshold calibration that can drift across datasets, and limited inherent explainability of individual alerts. Configuration guidance, robustness checks, and lightweight diagnostics are provided to support deployment and to maintain stable performance under changing conditions.