SilIF: Silhouette-Augmented Isolation Forest for Unsupervised Transaction Fraud Detection

# SilIF: Silhouette-Augmented Isolation Forest for Unsupervised Transaction Fraud Detection
Source: [https://arxiv.org/html/2605.26135](https://arxiv.org/html/2605.26135)
###### Abstract

Unsupervised anomaly detection is widely used in transaction fraud detection where labels are scarce\. Isolation Forest \(IF\) is among the most popular classical methods due to its scalability and ease of deployment\. We proposeSilIF, an augmentation of Isolation Forest that adds a silhouette\-based scoring layer computed in a representation space induced by the trees of the forest\. For each point, we extract a vector of per\-tree path lengths, cluster these “fingerprints” into structural groups, and compute a silhouette score that measures how well the point fits its assigned group versus the nearest alternative\. The silhouette signal is combined with the base IF score via a single hyperparameterα\\alpha\. On the IEEE\-CIS Fraud Detection benchmark \(∼\\sim590K transactions, 3\.5% fraud\), SilIF withα=1\.0\\alpha=1\.0improves over plain Isolation Forest by\+0\.0080\+0\.0080AUC\-PR on average across five seeds, with SilIF winning on all five seeds \(pairedtt\-testp=0\.046p=0\.046\)\. We also report results on a synthetic credit\-card dataset \(Sparkov\) where the silhouette augmentation*does not*improve over plain IF, and we characterize the conditions that distinguish the two outcomes\. The paper presents SilIF as a tunable, easy\-to\-deploy enhancement to Isolation Forest with honest reporting of when it helps and when it does not\. Code and experimental scripts are available at[https://github\.com/venkat15vk/silif\-anomaly\-detection](https://github.com/venkat15vk/silif-anomaly-detection)\.

## IIntroduction

Transaction fraud imposes substantial costs on financial institutions and consumers\. Unlike many supervised problems, fraud detection in practice must contend with delayed and incomplete labels, evolving adversarial behavior, and heavy class imbalance\[[2](https://arxiv.org/html/2605.26135#bib.bib12),[4](https://arxiv.org/html/2605.26135#bib.bib21)\]\. Unsupervised anomaly detection methods are therefore widely deployed as a first line of defense and as a complement to supervised classifiers\. Among unsupervised methods, Isolation Forest\[[13](https://arxiv.org/html/2605.26135#bib.bib1),[14](https://arxiv.org/html/2605.26135#bib.bib2)\]has become a workhorse: it is fast, scales to large datasets, requires few hyperparameters, and produces interpretable per\-point anomaly scores\.

The Isolation Forest score summarizes, in a single scalar, how easily a point is separated from others across an ensemble of randomized trees\. Anomalies require fewer random splits to isolate and thus have shorter average path lengths\. While effective, this scalar summary discards per\-tree information: two points with identical average path length may have arrived there via very different patterns across the forest\. We hypothesize that this discarded structural information carries additional signal about anomalousness, and we propose a method to extract and use it\.

Our proposed method,SilIF\(Silhouette\-augmented Isolation Forest\), treats each point’s vector of per\-tree path lengths as a*fingerprint*representation, clusters these fingerprints into structural groups, and applies the silhouette coefficient\[[17](https://arxiv.org/html/2605.26135#bib.bib6)\]—originally a cluster\-quality measure—as an anomaly signal in the fingerprint space\. Points whose fingerprint fits its assigned structural cluster poorly receive higher anomaly scores\. The silhouette signal is combined with the base IF score via a single weightα\\alpha, withα=0\\alpha=0recovering plain Isolation Forest as a sanity\-check special case\.

#### Contributions\.

- •We propose SilIF, a silhouette\-based augmentation layer for Isolation Forest\. The method leaves the base IF unchanged and adds a post\-hoc scoring layer with a single hyperparameter\.
- •On IEEE\-CIS Fraud Detection\[[11](https://arxiv.org/html/2605.26135#bib.bib17)\], SilIF withα=1\.0\\alpha=1\.0improves Isolation Forest by\+0\.008\+0\.008AUC\-PR \(mean across 5 seeds, pairedtt\-testp=0\.046p=0\.046, SilIF winning on 5/5 seeds\)\. It also outperforms HBOS and ECOD by wide margins\.
- •We report negative results on a second dataset \(Sparkov\[[19](https://arxiv.org/html/2605.26135#bib.bib18),[8](https://arxiv.org/html/2605.26135#bib.bib19)\]\) where the silhouette layer does not help, and characterize the conditions distinguishing the two regimes\.
- •We release code reproducing all experiments and provide the per\-seed result CSVs\.

## IIRelated Work

We organize prior work into three streams that intersect at SilIF\.

### II\-AIsolation Forest and its variants

Isolation Forest\[[13](https://arxiv.org/html/2605.26135#bib.bib1),[14](https://arxiv.org/html/2605.26135#bib.bib2)\]exploits the observation that anomalies are typically few and different: randomized recursive partitioning isolates them in fewer splits than normal points\. The expected path length from root to leaf serves as a scalar anomaly score\. Several extensions modify the base partitioning: the Extended Isolation Forest\[[7](https://arxiv.org/html/2605.26135#bib.bib3)\]addresses axis\-aligned bias by using random hyperplane splits; Deep Isolation Forest\[[21](https://arxiv.org/html/2605.26135#bib.bib4)\]maps data to random representations using neural networks before applying IF; and attention\-based variants\[[20](https://arxiv.org/html/2605.26135#bib.bib5)\]learn weights over trees\. These methods change either the data representation or the tree mechanism\. SilIF takes a complementary approach: it leaves IF unchanged and instead exploits the discarded per\-tree structural information*after*training\. The silhouette\-augmentation principle could in principle be combined with any of these IF variants\.

The broader family of tree\-ensemble anomaly detectors includes Random Cut Forest\[[5](https://arxiv.org/html/2605.26135#bib.bib15)\], which shares with IF the property of producing scalar scores from ensemble information\.

### II\-BCluster\-based and density\-based outlier detection

A second line treats anomalies as points that fit poorly within discovered clusters or density regions\. The Local Outlier Factor \(LOF\)\[[1](https://arxiv.org/html/2605.26135#bib.bib7)\]measures local reachability density relative to nearest neighbors\. Cluster\-Based Local Outlier Factor \(CBLOF\)\[[9](https://arxiv.org/html/2605.26135#bib.bib8)\]explicitly clusters the data and scores points by distance to the nearest large cluster\. These methods operate directly in the input feature space\. SilIF differs in that the clustering operates not in feature space but in the path\-length fingerprint space induced by Isolation Forest, which can encode non\-linear relationships discovered by the trees\.

The silhouette coefficient\[[17](https://arxiv.org/html/2605.26135#bib.bib6)\]is classically used to assess cluster quality and select the number of clusters\. Some recent applied work has used silhouette and Isolation Forest in parallel as independent anomaly flags\[[10](https://arxiv.org/html/2605.26135#bib.bib14)\], computing silhouette in aKK\-means clustering of raw features and IF scores separately, then taking the union or intersection of flagged points\. SilIF differs from this prior use in two ways: \(i\) we compute silhouette in the path\-length fingerprint space rather than the raw feature space, and \(ii\) the two signals are combined as a continuous weighted score rather than as separate Boolean flags\. To our knowledge, applying silhouette as an augmentation layer on the internal representation of an isolation ensemble has not been previously reported\.

### II\-CModern statistical anomaly detection

A third stream develops parameter\-free or weakly parameterized statistical detectors\. The Histogram\-Based Outlier Score \(HBOS\)\[[3](https://arxiv.org/html/2605.26135#bib.bib10)\]assumes feature independence and scores points using per\-feature histogram densities\. ECOD\[[12](https://arxiv.org/html/2605.26135#bib.bib11)\]uses per\-feature empirical CDFs and is fully parameter\-free\. Thekk\-nearest neighbor distance score\[[16](https://arxiv.org/html/2605.26135#bib.bib9)\]computes an anomaly score from average distance to thekknearest neighbors\. Recent deep learning approaches to anomaly detection\[[15](https://arxiv.org/html/2605.26135#bib.bib13)\]can capture complex non\-linear structure but typically require larger training budgets and produce less interpretable scores\. Benchmarks\[[6](https://arxiv.org/html/2605.26135#bib.bib20)\]indicate that classical methods remain competitive on many tabular anomaly detection tasks\.

## IIIMethod

### III\-ABackground

Given a datasetX=\{xi\}i=1NX=\\\{x\_\{i\}\\\}\_\{i=1\}^\{N\}ofNNtransactions, Isolation Forest\[[13](https://arxiv.org/html/2605.26135#bib.bib1)\]trains an ensemble ofTTrandomized binary trees\. For treett, letht​\(xi\)h\_\{t\}\(x\_\{i\}\)denote the path length from the root to the leaf isolatingxix\_\{i\}\. The IF anomaly score is

sIF​\(xi\)=2−h¯​\(xi\)/c​\(ψ\),h¯​\(xi\)=1T​∑t=1Tht​\(xi\),s\_\{\\mathrm\{IF\}\}\(x\_\{i\}\)=2^\{\-\\bar\{h\}\(x\_\{i\}\)/c\(\\psi\)\},\\quad\\bar\{h\}\(x\_\{i\}\)=\\tfrac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}h\_\{t\}\(x\_\{i\}\),\(1\)wherec​\(ψ\)c\(\\psi\)is the average path length of an unsuccessful search in a binary tree ofψ\\psisamples and serves as a normalizer\.

Given a clustering with labelsℓ​\(i\)∈\{1,…,K\}\\ell\(i\)\\in\\\{1,\\dots,K\\\}, the silhouette coefficient\[[17](https://arxiv.org/html/2605.26135#bib.bib6)\]of pointiiis

s​\(i\)=b​\(i\)−a​\(i\)max⁡\{a​\(i\),b​\(i\)\}∈\[−1,1\],s\(i\)=\\frac\{b\(i\)\-a\(i\)\}\{\\max\\\{a\(i\),b\(i\)\\\}\}\\in\[\-1,1\],\(2\)wherea​\(i\)a\(i\)is the mean dissimilarity to other points in clusterℓ​\(i\)\\ell\(i\)andb​\(i\)b\(i\)is the minimum mean dissimilarity to points of any other cluster\. Values near11indicate good fit; values near−1\-1indicate the point fits a neighboring cluster better than its own\.

### III\-BSilIF

SilIF comprises four steps\.

#### \(1\) Train IF\.

Train a standard Isolation Forest ofTTtrees onXXand obtainsIF​\(xi\)s\_\{\\mathrm\{IF\}\}\(x\_\{i\}\)for each point\.

#### \(2\) Extract path\-length fingerprints\.

For eachxix\_\{i\}, form theTT\-dimensional vector

ϕ​\(xi\)=\(h1​\(xi\),h2​\(xi\),…,hT​\(xi\)\)∈ℝT,\\phi\(x\_\{i\}\)=\\bigl\(h\_\{1\}\(x\_\{i\}\),h\_\{2\}\(x\_\{i\}\),\\dots,h\_\{T\}\(x\_\{i\}\)\\bigr\)\\in\\mathbb\{R\}^\{T\},\(3\)which encodes the detailed pattern of how the forest isolatedxix\_\{i\}\. WhilesIFs\_\{\\mathrm\{IF\}\}is a function of onlyh¯​\(xi\)\\bar\{h\}\(x\_\{i\}\),ϕ​\(xi\)\\phi\(x\_\{i\}\)retains per\-tree variation\.

#### \(3\) Cluster fingerprints\.

Standardizeϕ\\phifeature\-wise and cluster the standardized fingerprints intoKKstructural groups usingKK\-means\. For largeNNwe use MiniBatchKMeans\[[18](https://arxiv.org/html/2605.26135#bib.bib16)\]for efficiency\. Letℓ​\(i\)\\ell\(i\)denote the cluster assignment ofxix\_\{i\}and\{ck\}k=1K\\\{c\_\{k\}\\\}\_\{k=1\}^\{K\}the cluster centroids in fingerprint space\.

#### \(4\) Compute silhouette and combine\.

We use a centroid\-based approximation of the silhouette for scalability:

a​\(i\)=‖ϕ​\(xi\)−cℓ​\(i\)‖2,b​\(i\)=mink≠ℓ​\(i\)⁡‖ϕ​\(xi\)−ck‖2,a\(i\)=\\\|\\phi\(x\_\{i\}\)\-c\_\{\\ell\(i\)\}\\\|\_\{2\},\\quad b\(i\)=\\min\_\{k\\neq\\ell\(i\)\}\\\|\\phi\(x\_\{i\}\)\-c\_\{k\}\\\|\_\{2\},\(4\)and define the silhouette\-based anomaly contribution

ssil​\(xi\)=1−b​\(i\)−a​\(i\)max⁡\{a​\(i\),b​\(i\)\}\.s\_\{\\mathrm\{sil\}\}\(x\_\{i\}\)=1\-\\frac\{b\(i\)\-a\(i\)\}\{\\max\\\{a\(i\),b\(i\)\\\}\}\.\(5\)This quantity ranges in\[0,2\]\[0,2\]: low silhouette \(poor cluster fit\) yields a high anomaly contribution\. The final SilIF score combines the two components via a single hyperparameterα≥0\\alpha\\geq 0:

sSilIF​\(xi\)=z​\(sIF​\(xi\)\)\+α⋅z​\(ssil​\(xi\)\),s\_\{\\mathrm\{SilIF\}\}\(x\_\{i\}\)=z\\bigl\(s\_\{\\mathrm\{IF\}\}\(x\_\{i\}\)\\bigr\)\+\\alpha\\cdot z\\bigl\(s\_\{\\mathrm\{sil\}\}\(x\_\{i\}\)\\bigr\),\(6\)wherez​\(⋅\)z\(\\cdot\)denotes z\-score standardization over the dataset\. The standardization places the two components on a common scale so thatα\\alphahas a meaningful interpretation:α=0\\alpha=0recovers plain IF;α=1\\alpha=1gives equal weight to the two components after standardization\.

### III\-CIntuition

The base IF score compresses per\-tree information into the average path length\. SilIF retains the full path\-length pattern and asks a second question:*given how this point was isolated, does its pattern of isolation match a typical structural group?*A point that is hard to isolate \(lowsIFs\_\{\\mathrm\{IF\}\}\) but unusually positioned in fingerprint space \(highssils\_\{\\mathrm\{sil\}\}\) receives an elevated total score\. The hyperparameterα\\alphacontrols how strongly the silhouette evidence is allowed to modify the base IF judgment\.

### III\-DComplexity

Beyond IF training, SilIF requires \(i\) extracting per\-tree path lengths,O​\(N​T\)O\(NT\); \(ii\)KK\-means onTT\-dimensional fingerprints,O​\(N​T​K\)O\(NTK\)per iteration; and \(iii\) per\-point silhouette computation,O​\(N​K\)O\(NK\)\. For our largest dataset \(N≈1\.85N\\approx 1\.85M,T=100T=100,K=8K=8\), SilIF completes in about 60 seconds per seed on a single laptop CPU\.

## IVExperimental Setup

### IV\-ADatasets

We evaluate on two transaction\-fraud datasets summarized in Table[I](https://arxiv.org/html/2605.26135#S4.T1)\.

TABLE I:Datasets used in our evaluation\.IEEE\-CIS Fraud Detection\[[11](https://arxiv.org/html/2605.26135#bib.bib17)\]is a real\-world benchmark from a Kaggle competition originally published by Vesta Corporation\. It contains 590,540 transactions with 393 features \(transaction amount, product code, anonymized card and address features, countsC1,…,C14C\_\{1\},\\dots,C\_\{14\}, time deltasD1,…,D15D\_\{1\},\\dots,D\_\{15\}, and Vesta\- engineered features\)\. We usecard1as the customer identifier\.

Sparkov\[[19](https://arxiv.org/html/2605.26135#bib.bib18),[8](https://arxiv.org/html/2605.26135#bib.bib19)\]is a synthetic credit\-card transaction dataset generated by the Sparkov simulator\. It contains 1,852,394 transactions across 999 customers over a two\-year period, with 23 features including merchant, category, amount, geographic coordinates, and timestamps\.

### IV\-BPreprocessing

For both datasets we filter to customers with≥5\\geq 5transactions to ensure the silhouette computation has meaningful per\-customer history; this retains all 999 customers on Sparkov and 6,512 customers \(577,192 transactions\) on IEEE\-CIS\. We use a compact, dataset\-agnostic feature set for the per\-transaction representation: log\-scaled transaction amount, transaction type \(encoded\), and four numeric features chosen per dataset \(IEEE\-CIS:C1,C2,C13,C14C\_\{1\},C\_\{2\},C\_\{13\},C\_\{14\}; Sparkov: latitude, longitude, merchant latitude, merchant longitude\)\. Negative values are handled via sign\-preserving log scaling\.

### IV\-CBaselines

We compare SilIF against the following unsupervised baselines, all operating on the same feature representation:

- •Isolation Forest\[[13](https://arxiv.org/html/2605.26135#bib.bib1)\]: 100 trees, default settings; equivalent to SilIF withα=0\\alpha=0\.
- •HBOS\[[3](https://arxiv.org/html/2605.26135#bib.bib10)\]: histogram\-based with 20 bins\.
- •ECOD\[[12](https://arxiv.org/html/2605.26135#bib.bib11)\]: empirical CDF\-based, parameter\-free\.
- •Global K\-Means: K\-means in feature space \(K=8K=8\), with distance\-to\-centroid as the anomaly score\. This is the “single\-level” baseline against which the role of structural information is isolated\.
- •LOF\[[1](https://arxiv.org/html/2605.26135#bib.bib7)\]: local outlier factor,k=20k=20neighbors \(run only whenN≤100,000N\\leq 100\{,\}000due toO​\(N2\)O\(N^\{2\}\)memory\)\.
- •kk\-NN distance\[[16](https://arxiv.org/html/2605.26135#bib.bib9)\]: mean distance tok=5k=5nearest neighbors \(same scalability caveat as LOF\)\.

### IV\-DMetrics

We report:

- •AUC\-ROC: standard receiver\-operating\-characteristic area under the curve\.
- •AUC\-PR: area under the precision\-recall curve, more informative under heavy class imbalance\.
- •Precision@kkfork∈\{50,100,500,1000\}k\\in\\\{50,100,500,1000\\\}: relevant for analyst\-triage use cases where only the top\-scored points are reviewed\.

Labels \(isFraud\) are used only for evaluation; no method has access to labels during scoring\. All experiments use 5 random seeds \(42–46\)\. We report mean±\\pmstandard deviation across seeds and conduct pairedtt\-tests for significance\.

## VResults

### V\-AMain comparison on IEEE\-CIS

Table[II](https://arxiv.org/html/2605.26135#S5.T2)reports mean±\\pmstd across 5 seeds on IEEE\-CIS\. SilIF at the recommended settingα=1\.0\\alpha=1\.0achieves the highest AUC\-PR among Isolation\-Forest\-family methods, with a statistically significant improvement over plain IF \(pairedtt\-test on AUC\-PR:p=0\.046p=0\.046, 5/5 seeds win for SilIF\)\. HBOS and ECOD perform substantially worse than SilIF on this dataset\.

TABLE II:Main results on IEEE\-CIS \(mean±\\pmstd over 5 seeds\)\. Best in bold; second\-best underlined\.We note that Global K\-Means achieves higher AUC\-PR \(0\.145\) than SilIF \(0\.134\) on IEEE\-CIS\. Both are within the same regime of performance; the contribution of SilIF here is specifically the improvement*over plain Isolation Forest*, which is the closest base method and the one SilIF augments\.

### V\-BEffect ofα\\alphaon IEEE\-CIS

Figure[1](https://arxiv.org/html/2605.26135#S5.F1)and Table[III](https://arxiv.org/html/2605.26135#S5.T3)report a sweep overα∈\{0,0\.25,0\.5,1\.0,2\.0,4\.0\}\\alpha\\in\\\{0,0\.25,0\.5,1\.0,2\.0,4\.0\\\}on IEEE\-CIS\. SilIF exhibits a clear inverted\-U shape on AUC\-PR with peak atα=1\.0\\alpha=1\.0, indicating that the silhouette layer contributes useful signal at moderate weight but dominates the base IF signal at highα\\alpha, harming performance\. On AUC\-ROC, smallα\\alphavalues \(0\.25–0\.5\) are best\.

TABLE III:α\\alpha\-sweep on IEEE\-CIS \(mean over 5 seeds\)\.α=0\\alpha=0reduces SilIF to plain Isolation Forest\.![Refer to caption](https://arxiv.org/html/2605.26135v1/x1.png)Figure 1:SilIF on IEEE\-CIS: AUC\-PR \(blue\) and AUC\-ROC \(red\) versus silhouette weightα\\alpha, mean±\\pmstd over 5 seeds\. AUC\-PR peaks atα=1\.0\\alpha=1\.0; AUC\-ROC peaks atα=0\.25\\alpha=0\.25–0\.50\.5\. Both metrics drop sharply atα=4\.0\\alpha=4\.0as the silhouette signal begins to dominate the base IF score\.
### V\-CPaired statistical comparison: SilIF vs Isolation Forest on IEEE\-CIS

Table[IV](https://arxiv.org/html/2605.26135#S5.T4)reports paired comparisons between SilIF \(α=1\.0\\alpha=1\.0\) and key reference methods on IEEE\-CIS\. The improvement over plain IF is consistent: SilIF wins on all 5 seeds, mean AUC\-PR difference\+0\.0080\+0\.0080, pairedtt\-testp=0\.046p=0\.046\. This is the key positive result of the paper\.

TABLE IV:Paired comparisons \(SilIFα=1\.0\\alpha=1\.0vs baseline\) on IEEE\-CIS across 5 seeds\. “Wins” counts the number of seeds on which SilIF beats the baseline on AUC\-PR\.
### V\-DCross\-dataset evaluation: Sparkov

We now report results on Sparkov, a second dataset chosen to test generalization\. Table[V](https://arxiv.org/html/2605.26135#S5.T5)reports theα\\alpha\-sweep on Sparkov\.

TABLE V:α\\alpha\-sweep on Sparkov \(mean over 5 seeds\)\. On this dataset, the silhouette augmentation*does not*improve over plain IF; the optimum isα=0\\alpha=0\.On Sparkov, every positive value ofα\\alphaproduces*worse*AUC\-PR and AUC\-ROC thanα=0\\alpha=0, monotonically\. The silhouette augmentation does not help on this dataset\. We report this honestly because the contrast with IEEE\-CIS is informative: it tells us SilIF is dataset\- dependent and characterizes a regime in which the method should not be applied\.

For completeness, the strongest method on Sparkov in our experiments is HBOS with AUC\-PR≈0\.348\\approx 0\.348on a 100K\-row subsample \(full\-dataset multi\-seed comparison was deferred for computational cost reasons\), well above plain IF and SilIF\.

## VIDiscussion

### VI\-AWhy SilIF helps on IEEE\-CIS

IEEE\-CIS contains many engineered features with non\-trivial interactions \(counts, time deltas, encoded categorical features\)\. The Isolation Forest trees are likely to discover several distinct partitioning structures across the feature space, so per\-tree path lengths carry information beyond the scalar average\. The silhouette layer in fingerprint space identifies points whose isolation pattern does not match any of the discovered structural groups—and these points are over\-represented among fraud labels\. Theα\\alphasweep with a clear peak atα=1\\alpha=1supports the interpretation that the silhouette signal is genuine: it is not simply re\-weighting the base score, since pure base score \(α=0\\alpha=0\) and pure silhouette \(α→∞\\alpha\\rightarrow\\infty, approximated byα=4\\alpha=4\) are both worse than the balanced combination\.

### VI\-BWhy SilIF does not help on Sparkov

Sparkov has fewer features and a fundamentally different feature distribution: with synthetic generation, geographic and category information dominates the discriminative signal\. Several explanations are consistent with our results: \(i\) IF trees on Sparkov produce highly correlated path lengths because few features are informative, so the fingerprint space carries little additional structure beyond the average; \(ii\) the silhouette layer then introduces noise rather than signal; or \(iii\) the appropriate clustering may not be in fingerprint space at all\. Our results do not adjudicate between these explanations\. We report the negative result transparently to inform practitioners that SilIF should not be deployed without dataset\-specific validation\.

### VI\-CWhen SilIF should be used

We recommend evaluating SilIF on a held\-out validation set with a smallα\\alphasweep \(e\.g\.\{0,0\.5,1\.0,2\.0\}\\\{0,0\.5,1\.0,2\.0\\\}\) before deployment\. Our results suggest SilIF is most likely to help when:

- •The base feature space has many features and non\-linear interactions that Isolation Forest can discover\.
- •Anomalies differ from normal points in*patterns of isolation*, not just average difficulty of isolation\.

Conversely, on datasets where simple per\-feature statistics are highly discriminative \(e\.g\. Sparkov\), histogram\-based methods such as HBOS may outperform both SilIF and plain IF\.

### VI\-DLimitations

Several limitations are worth noting\. We evaluated SilIF only on one base method \(Isolation Forest\)\. Extending the silhouette\-augmentation idea to other tree\-ensemble bases \(e\.g\. Random Cut Forest\) or to non\-tree methods is left for future work\. We tested only two fraud datasets; broader benchmarks\[[6](https://arxiv.org/html/2605.26135#bib.bib20),[4](https://arxiv.org/html/2605.26135#bib.bib21)\]could clarify when the method generalizes\. We did not compare against deep anomaly detection methods, focusing on classical, scalable baselines that are widely deployed in practice\. The centroid\-approximated silhouette we use is a known approximation of the exact silhouette; an exact\-silhouette variant may behave differently and is worth study at smallerNN\.

### VI\-EFuture work

Several directions follow naturally\. First, the silhouette\-augmentation principle could be tested on Extended Isolation Forest\[[7](https://arxiv.org/html/2605.26135#bib.bib3)\]and Deep Isolation Forest\[[21](https://arxiv.org/html/2605.26135#bib.bib4)\]; combining a stronger base with the silhouette layer may yield additive improvements\. Second, learningα\\alphaper\-instance rather than as a global hyperparameter could better adapt to varying local structure\. Third, the fingerprint construction itself can be enriched \(e\.g\. using leaf identifiers in addition to path lengths\)\. Fourth, broader cross\-dataset evaluation on benchmarks beyond transaction fraud would establish when SilIF’s pattern of effects generalizes\.

## VIIConclusion

We presented SilIF, a silhouette\-based augmentation layer for Isolation Forest\. The method extracts a per\-tree path\-length fingerprint for each point, clusters fingerprints into structural groups, and computes a silhouette score that augments the base IF score via a single hyperparameterα\\alpha\. On the IEEE\-CIS Fraud Detection benchmark, SilIF improves over plain IF by\+0\.008\+0\.008AUC\-PR \(5/5 seeds,p=0\.046p=0\.046\) and substantially outperforms HBOS and ECOD\. On a second dataset \(Sparkov\), the silhouette augmentation does not help, and we characterize this contrast as an empirical guide to when the method is appropriate\. We release code and experimental scripts for reproducibility\.

## References

- \[1\]M\. M\. Breunig, H\. Kriegel, R\. T\. Ng, and J\. Sander\(2000\)LOF: identifying density\-based local outliers\.InProceedings of the 2000 ACM SIGMOD International Conference on Management of Data,pp\. 93–104\.External Links:[Document](https://dx.doi.org/10.1145/342009.335388)Cited by:[§II\-B](https://arxiv.org/html/2605.26135#S2.SS2.p1.1),[5th item](https://arxiv.org/html/2605.26135#S4.I1.i5.p1.3)\.
- \[2\]V\. Chandola, A\. Banerjee, and V\. Kumar\(2009\)Anomaly detection: a survey\.ACM Computing Surveys41\(3\),pp\. 1–58\.External Links:[Document](https://dx.doi.org/10.1145/1541880.1541882)Cited by:[§I](https://arxiv.org/html/2605.26135#S1.p1.1)\.
- \[3\]M\. Goldstein and A\. Dengel\(2012\)Histogram\-based outlier score \(hbos\): a fast unsupervised anomaly detection algorithm\.InKI\-2012: Poster and Demo Track,pp\. 59–63\.Cited by:[§II\-C](https://arxiv.org/html/2605.26135#S2.SS3.p1.2),[2nd item](https://arxiv.org/html/2605.26135#S4.I1.i2.p1.1),[TABLE II](https://arxiv.org/html/2605.26135#S5.T2.14.12.3)\.
- \[4\]P\. Grover, J\. Xu, J\. Tittelfitz, A\. Cheng, Z\. Li, J\. Zablocki, J\. Liu, and H\. Zhou\(2022\)Fraud dataset benchmark and applications\.arXiv preprint arXiv:2208\.14417\.Cited by:[§I](https://arxiv.org/html/2605.26135#S1.p1.1),[§VI\-D](https://arxiv.org/html/2605.26135#S6.SS4.p1.1)\.
- \[5\]S\. Guha, N\. Mishra, G\. Roy, and O\. Schrijvers\(2016\)Robust random cut forest based anomaly detection on streams\.InInternational Conference on Machine Learning,pp\. 2712–2721\.Cited by:[§II\-A](https://arxiv.org/html/2605.26135#S2.SS1.p2.1)\.
- \[6\]S\. Han, X\. Hu, H\. Huang, M\. Jiang, and Y\. Zhao\(2022\)ADBench: anomaly detection benchmark\.InAdvances in Neural Information Processing Systems,Cited by:[§II\-C](https://arxiv.org/html/2605.26135#S2.SS3.p1.2),[§VI\-D](https://arxiv.org/html/2605.26135#S6.SS4.p1.1)\.
- \[7\]S\. Hariri, M\. Carrasco Kind, and R\. J\. Brunner\(2021\)Extended isolation forest\.IEEE Transactions on Knowledge and Data Engineering33\(4\),pp\. 1479–1489\.External Links:[Document](https://dx.doi.org/10.1109/TKDE.2019.2947676)Cited by:[§II\-A](https://arxiv.org/html/2605.26135#S2.SS1.p1.1),[§VI\-E](https://arxiv.org/html/2605.26135#S6.SS5.p1.1)\.
- \[8\]B\. Harris\(2019\)Sparkov data generation\.Note:GitHub repository[https://github\.com/namebrandon/Sparkov\_Data\_Generation](https://github.com/namebrandon/Sparkov_Data_Generation)Cited by:[3rd item](https://arxiv.org/html/2605.26135#S1.I1.i3.p1.1),[§IV\-A](https://arxiv.org/html/2605.26135#S4.SS1.p3.1)\.
- \[9\]Z\. He, X\. Xu, and S\. Deng\(2003\)Discovering cluster\-based local outliers\.Pattern Recognition Letters24\(9\-10\),pp\. 1641–1650\.External Links:[Document](https://dx.doi.org/10.1016/S0167-8655%2803%2900003-5)Cited by:[§II\-B](https://arxiv.org/html/2605.26135#S2.SS2.p1.1)\.
- \[10\]A\. Herreros\-Martínez, R\. Magdalena\-Benedicto, J\. Vila\-Francés, A\. J\. Serrano\-López, and S\. Pérez\-Díaz\(2024\)Applied machine learning to anomaly detection in enterprise purchase processes\.arXiv preprint arXiv:2405\.14754\.Cited by:[§II\-B](https://arxiv.org/html/2605.26135#S2.SS2.p2.1)\.
- \[11\]IEEE Computational Intelligence Society and Vesta Corporation\(2019\)IEEE\-CIS fraud detection\.Note:Kaggle Competition[https://www\.kaggle\.com/c/ieee\-fraud\-detection](https://www.kaggle.com/c/ieee-fraud-detection)Cited by:[2nd item](https://arxiv.org/html/2605.26135#S1.I1.i2.p1.4),[§IV\-A](https://arxiv.org/html/2605.26135#S4.SS1.p2.2),[TABLE I](https://arxiv.org/html/2605.26135#S4.T1.1.2.1.1)\.
- \[12\]Z\. Li, Y\. Zhao, N\. Botta, C\. Ionescu, and X\. Hu\(2023\)ECOD: unsupervised outlier detection using empirical cumulative distribution functions\.IEEE Transactions on Knowledge and Data Engineering35\(12\),pp\. 12181–12193\.External Links:[Document](https://dx.doi.org/10.1109/TKDE.2022.3159580)Cited by:[§II\-C](https://arxiv.org/html/2605.26135#S2.SS3.p1.2),[3rd item](https://arxiv.org/html/2605.26135#S4.I1.i3.p1.1),[TABLE II](https://arxiv.org/html/2605.26135#S5.T2.16.14.3)\.
- \[13\]F\. T\. Liu, K\. M\. Ting, and Z\. Zhou\(2008\)Isolation forest\.In2008 Eighth IEEE International Conference on Data Mining,pp\. 413–422\.External Links:[Document](https://dx.doi.org/10.1109/ICDM.2008.17)Cited by:[§I](https://arxiv.org/html/2605.26135#S1.p1.1),[§II\-A](https://arxiv.org/html/2605.26135#S2.SS1.p1.1),[§III\-A](https://arxiv.org/html/2605.26135#S3.SS1.p1.6),[1st item](https://arxiv.org/html/2605.26135#S4.I1.i1.p1.1),[TABLE II](https://arxiv.org/html/2605.26135#S5.T2.10.8.3)\.
- \[14\]F\. T\. Liu, K\. M\. Ting, and Z\. Zhou\(2012\)Isolation\-based anomaly detection\.ACM Transactions on Knowledge Discovery from Data6\(1\),pp\. 1–39\.External Links:[Document](https://dx.doi.org/10.1145/2133360.2133363)Cited by:[§I](https://arxiv.org/html/2605.26135#S1.p1.1),[§II\-A](https://arxiv.org/html/2605.26135#S2.SS1.p1.1)\.
- \[15\]G\. Pang, C\. Shen, L\. Cao, and A\. V\. D\. Hengel\(2021\)Deep learning for anomaly detection: a review\.ACM Computing Surveys54\(2\),pp\. 1–38\.External Links:[Document](https://dx.doi.org/10.1145/3439950)Cited by:[§II\-C](https://arxiv.org/html/2605.26135#S2.SS3.p1.2)\.
- \[16\]S\. Ramaswamy, R\. Rastogi, and K\. Shim\(2000\)Efficient algorithms for mining outliers from large data sets\.InProceedings of the 2000 ACM SIGMOD International Conference on Management of Data,pp\. 427–438\.External Links:[Document](https://dx.doi.org/10.1145/342009.335437)Cited by:[§II\-C](https://arxiv.org/html/2605.26135#S2.SS3.p1.2),[6th item](https://arxiv.org/html/2605.26135#S4.I1.i6.p1.2)\.
- \[17\]P\. J\. Rousseeuw\(1987\)Silhouettes: a graphical aid to the interpretation and validation of cluster analysis\.Journal of Computational and Applied Mathematics20,pp\. 53–65\.External Links:[Document](https://dx.doi.org/10.1016/0377-0427%2887%2990125-7)Cited by:[§I](https://arxiv.org/html/2605.26135#S1.p3.2),[§II\-B](https://arxiv.org/html/2605.26135#S2.SS2.p2.1),[§III\-A](https://arxiv.org/html/2605.26135#S3.SS1.p2.2)\.
- \[18\]D\. Sculley\(2010\)Web\-scale k\-means clustering\.InProceedings of the 19th International Conference on World Wide Web,pp\. 1177–1178\.External Links:[Document](https://dx.doi.org/10.1145/1772690.1772862)Cited by:[§III\-B](https://arxiv.org/html/2605.26135#S3.SS2.SSS0.Px3.p1.7)\.
- \[19\]K\. Shenoy\(2020\)Credit card transactions fraud detection dataset\.Note:Kaggle Dataset, generated with Sparkov simulator[https://www\.kaggle\.com/datasets/kartik2112/fraud\-detection](https://www.kaggle.com/datasets/kartik2112/fraud-detection)Cited by:[3rd item](https://arxiv.org/html/2605.26135#S1.I1.i3.p1.1),[§IV\-A](https://arxiv.org/html/2605.26135#S4.SS1.p3.1),[TABLE I](https://arxiv.org/html/2605.26135#S4.T1.1.3.2.1)\.
- \[20\]L\. Utkin, A\. Ageev, A\. Konstantinov, and V\. Muliukha\(2022\)Improved anomaly detection by using the attention\-based isolation forest\.Algorithms16\(1\),pp\. 19\.External Links:[Document](https://dx.doi.org/10.3390/a16010019)Cited by:[§II\-A](https://arxiv.org/html/2605.26135#S2.SS1.p1.1)\.
- \[21\]H\. Xu, G\. Pang, Y\. Wang, and Y\. Wang\(2023\)Deep isolation forest for anomaly detection\.InIEEE Transactions on Knowledge and Data Engineering,External Links:[Document](https://dx.doi.org/10.1109/TKDE.2023.3270293)Cited by:[§II\-A](https://arxiv.org/html/2605.26135#S2.SS1.p1.1),[§VI\-E](https://arxiv.org/html/2605.26135#S6.SS5.p1.1)\.