Most machine learning classification problems assume you have labeled examples of every class you want to detect. But what if you only have examples of normal behavior and want to detect anything unusual? This is the anomaly detection problem, and it comes up constantly in the real world. Fraud looks different every time it happens. Network attacks take new forms that have never been seen before. Manufacturing defects vary in unexpected ways. One-Class SVM was designed for exactly these situations, learning what normal looks like and raising an alarm when something does not fit. <\/p>\n\n\n\n
A standard SVM <\/a>is a binary classification algorithm. Given labeled data from two classes, it finds the hyperplane that best separates them, maximizing the margin between the two classes. The data points closest to the boundary are called support vectors and they define where the boundary sits.<\/p>\n\n\n\n In two dimensions, a hyperplane is just a line. In three dimensions it is a plane. In higher dimensions it is still called a hyperplane but the intuition is the same: a flat boundary that divides the feature space into two regions.<\/p>\n\n\n\n SVMs are powerful because they use a technique called the kernel trick to handle data that is not linearly separable. The kernel function <\/a>transforms data into a higher-dimensional space where a linear boundary becomes possible, then maps the boundary back to the original space where it may look curved or complex.<\/p>\n\n\n\n Read More: <\/strong>Supervised and Unsupervised Learning<\/strong><\/a><\/p>\n\n\n\n Want to build practical machine learning skills covering anomaly detection, supervised and unsupervised learning, and real-world model deployment? Explore HCL GUVI’s <\/strong>Artificial Intelligence & Machine Learning Course<\/strong><\/a>, designed to help you go from ML fundamentals to production-ready models. <\/a><\/p>\n\n\n\n A regular SVM needs labeled data from two classes. One-Class SVM removes this requirement. It trains using only normal data and learns a boundary around that data. At prediction time, any new point that falls inside the boundary is labeled normal and any point outside is labeled an anomaly.<\/p>\n\n\n\n The intuition is straightforward. Imagine all your normal training data forms a cluster in feature space. One-Class SVM draws the tightest possible boundary around that cluster. When a new data point arrives, the algorithm simply checks whether it is inside or outside the boundary. Inside means normal. Outside means something unusual has happened.<\/p>\n\n\n\n This is different from regular classification in a fundamental way. The algorithm has never seen an anomaly during training. It has no idea what an anomaly looks like. It only knows what normal looks like and uses that knowledge to define what is not normal.<\/p>\n\n\n\n You do not need to memorize the math to use One-Class SVM effectively, but understanding the core idea helps you tune it better.<\/p>\n\n\n\n One-Class SVM<\/a> works by mapping all training data into a high-dimensional feature space using a kernel function. In that high-dimensional space it tries to find a hyperplane that separates all the normal training data from the origin, the zero point of that space, with as large a margin as possible.<\/p>\n\n\n\n The origin acts as a reference point representing the absence of any data. By pushing normal data as far as possible from the origin, the algorithm creates a region in feature space that belongs to the normal class. Data points that map close to or on the wrong side of the origin are treated as anomalies.<\/p>\n\n\n\n The parameter nu controls the trade-off between how tight the boundary is and how many training points are allowed to fall outside it. A lower nu creates a tighter boundary with fewer training points treated as anomalies. A higher nu allows a looser boundary that accepts more variation in what counts as normal.<\/p>\n\n\n\n Nu is the most important parameter in One-Class SVM. It has a specific mathematical meaning: it is an upper bound on the fraction of training examples that can be treated as outliers and a lower bound on the fraction of support vectors.<\/p>\n\n\n\n In practice, if you set nu to 0.05, the algorithm allows up to 5 percent of your training data to be treated as outliers when fitting the boundary. Setting nu too low makes the boundary very tight and causes the model to flag too many normal points as anomalies in production. Setting nu too high makes the boundary too loose and causes the model to miss real anomalies.<\/p>\n\n\n\n A good starting point is to set nu to your estimate of the true anomaly rate in your data. If you expect roughly 2 percent of transactions to be fraudulent, start with nu around 0.02.<\/p>\n\n\n\n The kernel function controls the shape of the decision boundary. The most common choices are:<\/p>\n\n\n\n The RBF (Radial Basis Function) kernel is the default and works well for most problems. It creates smooth, curved boundaries that adapt to the shape of your normal data. The gamma parameter controls how tightly the boundary wraps around training points. High gamma creates a very tight boundary that follows individual training points closely, risking overfitting. Low gamma creates a smoother, more generalized boundary.<\/p>\n\n\n\n The linear kernel creates a flat boundary and works best when your normal data is roughly linearly separable from anomalies in the original feature space. Use it when you have very high-dimensional data like text.<\/p>\n\n\n\nWhat Makes One-Class SVM Different<\/strong><\/h2>\n\n\n\n
\n One-Class SVM using an RBF kernel is mathematically equivalent to a density estimation technique called Parzen window estimation in the limit, meaning it implicitly learns the probability density of your normal data even though it was not explicitly designed as a density estimator.\u00a0\n<\/div>\n\n\n\nHow One-Class SVM Works Mathematically<\/strong><\/h2>\n\n\n\n
The Two Key Parameters You Need to Understand<\/strong><\/h2>\n\n\n\n
\n
\n
One-Class SVM vs Other Anomaly Detection Methods<\/strong><\/h2>\n\n\n\n