A method for determining whether encrypted data is potentially anomalous with respect to an encrypted data set, the method comprising: receiving a data set of encrypted data points, wherein each encrypted data point includes a plurality of encrypted features, and wherein the data set of encrypted data points is sorted for each encrypted feature into a sequence from smallest to largest values for a respective encrypted feature; generating, for the data set, an isolation tree data structure having a number of levels (402, 404, 406, 408), each level of the isolation tree data structure corresponding to one of the encrypted plurality of features and including a plurality of nodes, based on a plurality of fuzzy splits of the data set, each of the plurality of fuzzy splits corresponding to a split on a particular feature in the encrypted data points, wherein generating the isolation tree data structure comprises: for each respective level in the isolation tree data structure: computing weights representing a probability of an imaginary split value being present in an interval of values for a respective encrypted feature corresponding to the respective level, calculating, for each data point, a probability that the respective data point should be assigned to a left child node (404 L, 406 LL, 406 LR,406 RL) and a right child node (404 R 406 LR, 406 RL, 406 RR) relative to a parent node in a higher level of the isolation tree data structure, the left child node corresponding to feature values less than the split value and the right child node corresponding to feature values greater than the split value; and receiving a first data point for analysis, the first data point including the plurality of encrypted features; and determining that the first data point is potentially anomalous using the generated isolation tree data structure, wherein the encrypted data points, encrypted features of the encrypted data points, and the received data point are encrypted using a homomorphic encryption scheme such that mathematical operations can be performed on the encrypted data points, encrypted features of the encrypted data points, and the received data point without decrypting the encrypted data points and the received data point. receiving a data set of encrypted data points, wherein each encrypted data point includes a plurality of encrypted features, and wherein the data set of encrypted data points is sorted for each encrypted feature into a sequence from smallest to largest values for a respective encrypted feature; generating, for the data set, an isolation tree data structure having a number of levels (402, 404, 406, 408), each level of the isolation tree data structure corresponding to one of the encrypted plurality of features and including a plurality of nodes, based on a plurality of fuzzy splits of the data set, each of the plurality of fuzzy splits corresponding to a split on a particular feature in the encrypted data points, wherein generating the isolation tree data structure comprises: for each respective level in the isolation tree data structure: computing weights representing a probability of an imaginary split value being present in an interval of values for a respective encrypted feature corresponding to the respective level, calculating, for each data point, a probability that the respective data point should be assigned to a left child node (404 L, 406 LL, 406 LR,406 RL) and a right child node (404 R 406 LR, 406 RL, 406 RR) relative to a parent node in a higher level of the isolation tree data structure, the left child node corresponding to feature values less than the split value and the right child node corresponding to feature values greater than the split value; and receiving a first data point for analysis, the first data point including the plurality of encrypted features; and determining that the first data point is potentially anomalous using the generated isolation tree data structure, wherein the encrypted data points, encrypted features of the encrypted data points, and the received data point are encrypted using a homomorphic encryption scheme such that mathematical operations can be performed on the encrypted data points, encrypted features of the encrypted data points, and the received data point without decrypting the encrypted data points and the received data point. computing weights representing a probability of an imaginary split value being present in an interval of values for a respective encrypted feature corresponding to the respective level, calculating, for each data point, a probability that the respective data point should be assigned to a left child node (404 L, 406 LL, 406 LR,406 RL) and a right child node (404 R 406 LR, 406 RL, 406 RR) relative to a parent node in a higher level of the isolation tree data structure, the left child node corresponding to feature values less than the split value and the right child node corresponding to feature values greater than the split value; and receiving a first data point for analysis, the first data point including the plurality of encrypted features; and determining that the first data point is potentially anomalous using the generated isolation tree data structure, wherein the encrypted data points, encrypted features of the encrypted data points, and the received data point are encrypted using a homomorphic encryption scheme such that mathematical operations can be performed on the encrypted data points, encrypted features of the encrypted data points, and the received data point without decrypting the encrypted data points and the received data point.