What is One-Class SVM: A Complete Guide for Beginners

Most machine learning classification problems assume you have labeled examples of every class you want to detect. But what if you only have examples of normal behavior and want to detect anything unusual? This is the anomaly detection problem, and it comes up constantly in the real world. Fraud looks different every time it happens. Network attacks take new forms that have never been seen before. Manufacturing defects vary in unexpected ways. One-Class SVM was designed for exactly these situations, learning what normal looks like and raising an alarm when something does not fit. 

TL;DR Summary

1. One-Class SVM is a machine learning algorithm used for anomaly detection and novelty detection, trained on only one class of data, the normal class
2. Unlike regular classification which learns to distinguish between two or more classes, One-Class SVM learns the boundary around normal data and flags anything outside that boundary as an anomaly
3. It works by finding a hyperplane that separates normal data points from the origin in a high-dimensional feature space with maximum margin
4. Key applications include fraud detection, network intrusion detection, medical diagnosis, and manufacturing quality control

What Is a Support Vector Machine?

A standard SVM is a binary classification algorithm. Given labeled data from two classes, it finds the hyperplane that best separates them, maximizing the margin between the two classes. The data points closest to the boundary are called support vectors and they define where the boundary sits.

In two dimensions, a hyperplane is just a line. In three dimensions it is a plane. In higher dimensions it is still called a hyperplane but the intuition is the same: a flat boundary that divides the feature space into two regions.

SVMs are powerful because they use a technique called the kernel trick to handle data that is not linearly separable. The kernel function transforms data into a higher-dimensional space where a linear boundary becomes possible, then maps the boundary back to the original space where it may look curved or complex.

Read More: Supervised and Unsupervised Learning

Want to build practical machine learning skills covering anomaly detection, supervised and unsupervised learning, and real-world model deployment? Explore HCL GUVI’s Artificial Intelligence & Machine Learning Course, designed to help you go from ML fundamentals to production-ready models. 

What Makes One-Class SVM Different

A regular SVM needs labeled data from two classes. One-Class SVM removes this requirement. It trains using only normal data and learns a boundary around that data. At prediction time, any new point that falls inside the boundary is labeled normal and any point outside is labeled an anomaly.

The intuition is straightforward. Imagine all your normal training data forms a cluster in feature space. One-Class SVM draws the tightest possible boundary around that cluster. When a new data point arrives, the algorithm simply checks whether it is inside or outside the boundary. Inside means normal. Outside means something unusual has happened.

This is different from regular classification in a fundamental way. The algorithm has never seen an anomaly during training. It has no idea what an anomaly looks like. It only knows what normal looks like and uses that knowledge to define what is not normal.

How One-Class SVM Works Mathematically

You do not need to memorize the math to use One-Class SVM effectively, but understanding the core idea helps you tune it better.

One-Class SVM works by mapping all training data into a high-dimensional feature space using a kernel function. In that high-dimensional space it tries to find a hyperplane that separates all the normal training data from the origin, the zero point of that space, with as large a margin as possible.

The origin acts as a reference point representing the absence of any data. By pushing normal data as far as possible from the origin, the algorithm creates a region in feature space that belongs to the normal class. Data points that map close to or on the wrong side of the origin are treated as anomalies.

The parameter nu controls the trade-off between how tight the boundary is and how many training points are allowed to fall outside it. A lower nu creates a tighter boundary with fewer training points treated as anomalies. A higher nu allows a looser boundary that accepts more variation in what counts as normal.

The Two Key Parameters You Need to Understand

1. Nu

Nu is the most important parameter in One-Class SVM. It has a specific mathematical meaning: it is an upper bound on the fraction of training examples that can be treated as outliers and a lower bound on the fraction of support vectors.

In practice, if you set nu to 0.05, the algorithm allows up to 5 percent of your training data to be treated as outliers when fitting the boundary. Setting nu too low makes the boundary very tight and causes the model to flag too many normal points as anomalies in production. Setting nu too high makes the boundary too loose and causes the model to miss real anomalies.

A good starting point is to set nu to your estimate of the true anomaly rate in your data. If you expect roughly 2 percent of transactions to be fraudulent, start with nu around 0.02.

2. Kernel and Gamma

The kernel function controls the shape of the decision boundary. The most common choices are:

The RBF (Radial Basis Function) kernel is the default and works well for most problems. It creates smooth, curved boundaries that adapt to the shape of your normal data. The gamma parameter controls how tightly the boundary wraps around training points. High gamma creates a very tight boundary that follows individual training points closely, risking overfitting. Low gamma creates a smoother, more generalized boundary.

The linear kernel creates a flat boundary and works best when your normal data is roughly linearly separable from anomalies in the original feature space. Use it when you have very high-dimensional data like text.

One-Class SVM vs Other Anomaly Detection Methods

One-Class SVM is the strongest choice when your data is high-dimensional, you expect non-linear boundaries between normal and anomalous regions, and your dataset is small to medium in size. For very large datasets with millions of rows, Isolation Forest is faster and often equally accurate.

Implementing One-Class SVM in Python

Scikit-learn provides a clean, ready-to-use implementation of One-Class SVM through its OneClassSVM class.

from sklearn.svm import OneClassSVM

from sklearn.preprocessing import StandardScaler

import numpy as np

scaler = StandardScaler()

X_train_scaled = scaler.fit_transform(X_train)

X_test_scaled = scaler.transform(X_test)

model = OneClassSVM(kernel="rbf", nu=0.05, gamma="scale")

model.fit(X_train_scaled)

predictions = model.predict(X_test_scaled)

The predict method returns 1 for normal points and -1 for anomalies. Always scale your features before fitting One-Class SVM because it is sensitive to feature magnitude. StandardScaler centers each feature to zero mean and unit variance, which ensures no single feature dominates the boundary purely because of its scale.

You can also get a continuous anomaly score for each point using decision_function, which returns a negative value for anomalies and a positive value for normal points. The more negative the score, the more anomalous the point.

scores = model.decision_function(X_test_scaled)

Using scores rather than binary predictions gives you more flexibility to set thresholds based on your specific precision and recall requirements.

Want to build practical machine learning skills covering anomaly detection, supervised and unsupervised learning, and real-world model deployment? Explore HCL GUVI’s Artificial Intelligence & Machine Learning Course, designed to help you go from ML fundamentals to production-ready models. 

Conclusion

One-Class SVM fills an important gap in the machine learning toolkit: anomaly detection when you have abundant normal data but few or no labeled anomalies to train on. 

Its ability to learn complex, non-linear boundaries around normal data using kernel functions makes it particularly effective for high-dimensional problems like fraud detection, network security, and medical screening.

FAQ