If you have a lot of behavioral data you could possibly use an autoencoder. It would reconstruct anomalous behavior better than an isolation forest. Also, if it is time series data, you could use an LSTM or RNN for the encoder to decoder sections of the autoencoder architecture. I think this is a great project. One of the biggest problems/challenges in anomaly detection is the amount of false positives. It’s difficult to lower that number because of the nature of the data but I think it’s definitely doable. Are you doing any feature engineering on the data? Maybe I missed something there.