Isolation Forest performs best with 1.0 as max_samples [R]

A user training an Isolation Forest model for anomaly detection on the CICIDS2017 dataset found that a max_samples value of 1.0 performed best, yielding approximately 94% recall and 7.6% FPR. This contrasts with the standard 256 and even 200,000, which resulted in lower recall and higher FPR. The user's training approach involves using only benign traffic for training, with validation and testing sets including attacks, and they question if this method is optimal given potential issues like swamping/masking in high-dimensional data.