Due to the complex topology, multiple line branches, and dense spatial distributions of distribution networks, the potential disturbances and failures cannot be eliminated. Thus, a protection system is required to ensure a high level of both reliability and stability. In that case, new challenges in the monitoring and identification of these potential abnormal operation statues must be worked out. To this end, a data-driven-based real-time anomaly detection model is proposed in this paper. To start with, the kernel principal components analysis (KPCA) process is deployed to compress the dimensionality of input data, which can reduce the computational complexity within such high-dimensional data environments. Next, the isolated forest (IF) model is applied to excavate potential outliers according to the numeric range of normal operating states of each feature. Thus, the IF can maintain a high detection performance in the biased or sparse distributions, and react swiftly to those outliers. Finally, the operation data of a relay system in one regional distribution network are utilized in the case study. The results verify the better performance of the proposed model in practical applications, and therefore can be utilized to assist in the automatic identification and response of the risks of distribution networks.