Anomaly Detection in Machine Learning: Isolation Forest and One-Class SVM Guide

Anomaly Detection in Machine Learning: Isolation Forest and One-Class SVM Guide (Updated August 2026)

Anomaly detection is one of the most directly useful machine learning skills you can build — and one of the least taught in standard courses. Every major Indian company dealing with financial transactions, manufacturing sensors, or network security needs someone who can identify unusual data points automatically. TCS processes billions of transactions annually. Siemens India runs sensor-heavy manufacturing lines. ICICI Bank flags thousands of potentially fraudulent cards every day. All of them use anomaly detection in some form. According to NASSCOM-Deloitte, India needs 1.25 million AI professionals by 2027, and anomaly detection specialists are among the highest-paid because the use cases are so directly tied to business risk. This guide covers the theory, the algorithms, and the Python implementation you need to get started.

▶ Watch on YouTube

What Is Anomaly Detection and Why Is It Critical in India?

Anomaly detection identifies data points that deviate significantly from the expected pattern. These unusual points — called anomalies, outliers, or novelties — signal something important: a fraudulent transaction, a failing machine bearing, a network intrusion, or a sensor malfunction. The defining challenge: anomalies are rare by definition. In a dataset of 100,000 bank transactions, maybe 50 are fraudulent — 0.05%. Standard classifiers trained on this imbalanced data predict normal for everything and achieve 99.95% accuracy while detecting zero fraud. Anomaly detection algorithms are specifically designed for this problem. Real applications in India: Bajaj Auto and Tata Motors use sensor anomaly detection on production lines in Pune and Chhatrapati Sambhajinagar. HDFC Bank, SBI, and Paytm use transaction anomaly detection for fraud prevention. Infosys and TCS use log anomaly detection for IT infrastructure monitoring. IoT deployments in AURIC (Aurangabad Industrial City, ₹71,343 crore investment zone) use edge anomaly detection on industrial equipment — catching failures before they cause production stoppages.

Three Types of Anomaly Detection: Supervised, Unsupervised and Semi-Supervised

Supervised anomaly detection requires labeled data — examples of both normal and anomalous points. Train a standard classifier. Works well when you have enough labeled anomaly examples. Rarely practical in real deployments because anomalies are hard to label at scale and their patterns shift over time. Unsupervised anomaly detection requires no labels — the algorithm learns what normal looks like from data structure, then flags anything that deviates significantly. Most widely used in production. Key algorithms: Isolation Forest, DBSCAN, Autoencoders. Semi-supervised anomaly detection trains only on normal examples — no anomaly labels needed. The model learns the normal boundary; anything outside it is anomalous. One-Class SVM is the canonical algorithm. Most practical approach when you can collect plenty of normal data but anomalies are too rare or diverse to label comprehensively. Choosing: if you have labeled anomalies, use supervised. If you have only normal training data, use semi-supervised (One-Class SVM). If you have no labels at all, use unsupervised (Isolation Forest).

Isolation Forest: The Industry Standard Algorithm Explained

Isolation Forest is the most widely used unsupervised anomaly detection algorithm. The core intuition: anomalies are few and different, so they are easier to isolate. The algorithm randomly selects a feature, then randomly selects a split value for that feature — recursively partitioning the data. Normal points require many splits to isolate (they blend into the crowd). Anomalous points need very few splits (they are already separated from the rest). The anomaly score is the average tree depth across all trees in the forest — lower score means more anomalous. Python implementation: from sklearn.ensemble import IsolationForest. Then: clf = IsolationForest(contamination=0.05, random_state=42) where contamination is your estimate of the anomaly fraction. clf.fit(X_train). labels = clf.predict(X_test) returns 1 for normal and -1 for anomaly. Plot results with matplotlib — normal points cluster in high-density regions and anomalies scatter in low-density areas. Key parameters: contamination (expected fraction of outliers), n_estimators (number of trees, default 100), max_samples (samples per tree). Isolation Forest is efficient on high-dimensional data, handles non-Gaussian distributions, and requires no distance calculations — making it fast even on datasets with millions of rows.

One-Class SVM: Boundary-Based Anomaly Detection

One-Class SVM takes a different approach — it learns a tight boundary around the normal training data, and flags any test point outside that boundary as anomalous. The intuition: draw the smallest possible surface that contains all normal training points. New points outside that surface are anomalies. In practice the boundary is a complex shape in high-dimensional feature space — the RBF kernel handles non-linear boundaries naturally. Python implementation: from sklearn.svm import OneClassSVM. clf = OneClassSVM(kernel=''rbf'', gamma=0.1, nu=0.1) where nu controls the maximum fraction of training errors (similar to contamination in Isolation Forest). clf.fit(X_normal_train) — train only on normal data, no anomaly examples needed. labels = clf.predict(X_test) returns 1 for normal and -1 for anomaly. When to choose One-Class SVM over Isolation Forest: One-Class SVM works better when the normal data distribution is compact and well-defined. It is computationally expensive on large datasets — O(n squared) or worse — so practical only below 10,000 rows. Isolation Forest scales to millions of rows and is generally the recommended starting point. Use One-Class SVM when you have a small dataset and need fine-grained boundary control, or when combining with other features from domain expertise.

Evaluating Your Anomaly Detection Model: Metrics That Actually Matter

Standard accuracy is useless for anomaly detection on imbalanced datasets — predicting normal for every sample gives 99.9% accuracy on a dataset where anomalies are 0.1%. Use these metrics instead. Precision for the anomaly class: of all points the model flagged as anomalous, what fraction actually are anomalies? High precision means few false alarms. Recall for the anomaly class: of all actual anomalies in the data, what fraction did the model catch? High recall means few missed anomalies. F1 Score: harmonic mean of precision and recall — best single metric for imbalanced anomaly datasets. AUC-ROC (Area Under the Receiver Operating Characteristic Curve): plots true positive rate vs. false positive rate across all thresholds. A random model scores 0.5 and a perfect model scores 1.0. Aim for AUC above 0.85 in production. The precision-recall tradeoff is the key decision: in fraud detection, you accept more false positives (flagging legitimate transactions for review) to avoid missing real fraud — optimize for recall. In manufacturing alert systems, false alarms are costly — optimize for precision. The contamination or nu hyperparameter directly controls this tradeoff. Tune it based on the business cost of a missed anomaly versus the cost of a false alarm.

FAQs

Which industries in India use anomaly detection most, and what are the real salaries?

Banking and fintech use it most — HDFC Bank, Paytm, Razorpay, and SBI for fraud detection. Manufacturing (Bajaj Auto, Mahindra, Tata Motors, Bosch India) for equipment failure prediction. IT operations (TCS, Infosys, Wipro) for log monitoring. Freshers with ML anomaly detection skills can expect ₹4–7 LPA. With 2–3 years of experience in fintech or manufacturing ML, ₹10–18 LPA is realistic. Senior ML engineers specializing in real-time anomaly systems earn ₹20 LPA and above.

How many anomaly examples do I need in my training data?

For unsupervised methods like Isolation Forest, zero — these algorithms train only on the unlabeled dataset and learn what normal looks like from data structure alone. For supervised classification approaches, you need enough labeled anomalies to be representative — in practice, at least 100 to 500 anomaly examples across key anomaly types. For semi-supervised methods like One-Class SVM, you need only normal examples (which are usually easy to collect in large quantities).

What is the contamination parameter in Isolation Forest and how do I set it?

Contamination is your estimate of the fraction of anomalies in the dataset. If you expect roughly 5% of your data to be anomalous, set contamination=0.05. This parameter controls the threshold used to label points as normal or anomalous. If you do not know the fraction, start with contamination=0.01 (1%) and adjust based on the false alarm rate acceptable for your application. In production fraud detection, contamination is often set lower (0.001 to 0.005) to minimize false positives on legitimate transactions.

Can anomaly detection models be deployed in real-time systems like fraud detection?

Yes — this is one of the most valuable production applications. Isolation Forest prediction is fast (each prediction traverses a small number of trees in milliseconds). For real-time fraud detection or IoT monitoring, train the model offline and deploy it as a REST API using FastAPI or Flask, or embed it in a streaming pipeline (Apache Kafka plus Spark ML is common at Indian fintech companies). The model scores each new transaction or sensor reading in real time with no batch delay.