As the widespread deployment of Internet of Things (IoT) devices expands, network infrastructures face increasing vulnerability to cyberattacks, often without sufficient labeled data for traditional detection methods. This study explores the effectiveness of the Isolation Forest algorithm, an unsupervised anomaly detection model trained solely on benign traffic, in identifying diverse network intrusions using the Kitsune Network Attack Dataset. The methodology involved evaluating the model across nine distinct attack scenarios using a balanced test set of benign and malicious samples. Results showed that Isolation Forest consistently achieved high accuracy, precision, and recall for overt attacks such as SYN DoS, SSL Renegotiation, and SSDP Flood, but struggled with stealthier intrusions like Fuzzing and some Mirai Botnet instances due to their low statistical deviation from normal traffic. Despite its limitations, the algorithm proved to be a reliable and scalable solution for real-time intrusion detection in resource-constrained IoT environments. This research underscores the model’s strengths and offers direction for future enhancements through hybrid approaches and refined feature analysis.