# Online Isolation Forest

arXiv: https://arxiv.org/abs/2505.09593 · HTML: https://mlsanity.com/paper/2505.09593/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 35 references that are in the map.
- First posted on arXiv 14 May 2025.

## Builds on (most cited first, 7 of 7)

- [Deep Anomaly Detection with Deviation Networks](https://mlsanity.com/paper/1911.08623/) (2019)
- [Deep Isolation Forest for Anomaly Detection](https://mlsanity.com/paper/2206.06602/) (2022)
- [Extended Isolation Forest](https://mlsanity.com/paper/1811.02141/) (2018)
- [Challenges in Benchmarking Stream Learning Algorithms with Real-world Data](https://mlsanity.com/paper/2005.00113/) (2020)
- [Functional Isolation Forest](https://mlsanity.com/paper/1904.04573/) (2019)
- [PySAD: A Streaming Anomaly Detection Framework in Python](https://mlsanity.com/paper/2009.02572/) (2020)
- [Nonparametric and Online Change Detection in Multivariate Datastreams using QuantTree](https://mlsanity.com/paper/2208.14801/) (2022)

## Abstract (arXiv)

The anomaly detection literature is abundant with offline methods, which require repeated access to data in memory, and impose impractical assumptions when applied to a streaming context. Existing online anomaly detection methods also generally fail to address these constraints, resorting to periodic retraining to adapt to the online context. We propose Online-iForest, a novel method explicitly designed for streaming conditions that seamlessly tracks the data generating process as it evolves over time. Experimental validation on real-world datasets demonstrated that Online-iForest is on par with online alternatives and closely rivals state-of-the-art offline anomaly detection techniques that undergo periodic retraining. Notably, Online-iForest consistently outperforms all competitors in terms of efficiency, making it a promising solution in applications where fast identification of anomalies is of primary importance such as cybersecurity, fraud and fault detection.