Research and Publications

Introduction

Streaming Isolation Forest (SIF) is an online anomaly‑detection method designed for evolving data streams, where data arrives continuously and patterns change over time. It extends the classic Isolation Forest algorithm, originally built for static datasets, so it can operate efficiently, adapt to drift, and detect anomalies in real time without storing historical data.

Problems

• The original algorithm requires full‑dataset access and cannot update incrementally

• Real‑world streams change over time, so models must adapt continuously

• Storing past data is impossible in high‑velocity streams

• Anomaly detection must work without labeled feedback

• Online updates must preserve the randomness and structure that make Isolation Forest effective

Method

The Streaming Isolation Forest method works by updating isolation trees incrementally as new data arrives, rather than rebuilding the entire forest from scratch. Each incoming instance is used to partially refresh or replace parts of the existing trees, allowing the model to adapt continuously to changes in the data stream. To handle concept drift, the algorithm incorporates mechanisms such as sliding windows or decay functions so that older, less relevant data gradually loses influence. Only small samples of data are used during updates, keeping computation fast and memory usage low. As the forest evolves, anomaly scores are recalculated in a way that reflects the current structure of the trees, ensuring that the system can detect unusual or rare patterns in real time without storing historical data.

Key outcomes

• SIF detects anomalies quickly with low latency

• The model adapts to changing data distributions

• No need to store historical data

• Performs competitively against other streaming anomaly‑detection methods

• Efficient enough for real‑world, high‑throughput applications

Findings

The core finding is that Isolation Forest can be successfully adapted to streaming environments by using incremental tree updates and adaptive scoring. Streaming Isolation Forest maintains the strengths of the original algorithm while enabling fast, memory‑efficient, and drift‑aware anomaly detection in evolving data streams.