Empirical test: Isolation Forest performs best with max_samples=1.0 on IDS data

Ragno_ · reddit · 2026-09-30

Training an Isolation Forest on CICIDS2017 for network anomaly detection, the author swept maxsamples from 256 to 1.0: the paper's default 256 only helps when anomalies are in training data, while maxsamples=1.0 achieved 94% recall and 7.6% FPR versus 91%/10% at 200k, for just 30 extra seconds of training. Cross-dataset validation on CSE-CIC-IDS2018 showed poor performance either way, and the author asks whether their benign-only training split and threshold calibration approach is sound.

Original post →

More from Research

Research channel →