One-Class SVM
A one-class SVM learns a boundary that encloses normal data, treating outside points as anomalies.
Learning the shape of normal
A one-class support vector machine learns a decision boundary around the region occupied by normal training data, so that new points falling outside are flagged as anomalies. It is trained on data assumed to be mostly normal, without needing anomaly labels, which suits the label-scarce setting of anomaly detection.
Two related formulations
In the Scholkopf formulation, the algorithm finds a hyperplane in a kernel feature space that separates the data from the origin with maximum margin, allowing a controlled fraction of points to fall on the wrong side. In the support-vector-data-description formulation, it instead finds the smallest hypersphere enclosing the data. With the common radial-basis kernel the two are closely related and both trace a nonlinear boundary in the original space.
The nu parameter
A parameter nu, between zero and one, upper-bounds the fraction of training points allowed outside the boundary and lower-bounds the fraction of support vectors. It effectively sets the expected anomaly rate and the tightness of the boundary. The kernel bandwidth gamma controls how flexibly the boundary can wrap around the data; too large a gamma overfits and treats normal points as anomalies.
- No anomaly labels required, only mostly-clean normal data
- nu sets the tolerated outlier fraction
- Kernel choice and bandwidth strongly affect the boundary
- Scales poorly to very large datasets due to kernel computation
Practical use
One-class SVMs work well in modest dimensions with a carefully tuned kernel, but they are sensitive to contamination in the training set and to feature scaling, so inputs should be standardized. On large or high-dimensional data, isolation forest or autoencoder reconstruction error are usually more practical. The method is best viewed as one tool in a portfolio of detectors compared on precision-recall.