One-class svm

As explained in Outlier Detection in Python

OneClassSVM is a scikit-learn estimator that learns a boundary around training data to identify observations outside the learned region.

A one-class support vector machine (OCSVM) learns what one class of observations looks like, usually from normal training data. It draws a decision boundary around most of those observations while trying to keep the boundary tight. A later observation outside the boundary is a candidate novelty, not automatically a meaningful anomaly. section 5.4 section 5.8

Think of a simple one-class model that stores the minimum and maximum of its training values: a new value outside that range fails its test for normality. OCSVM applies the same basic idea with a more flexible boundary. It can leave some training points outside that boundary, and some unusual new points can fall inside it. section 5.4

A practical scikit-learn workflow is:

• Prepare a training sample that is as clean as possible, and keep separate data for testing. Available normal labels can help filter the training rows. section 5.4.1
• Create a `OneClassSVM`, fit it on the training data, then call `predict()` and `score_samples()` on the test data. section 5.4.1
• Check results rather than trusting the boundary alone. Kernel-related parameters can be difficult to tune, and different detectors may prioritize different records. section 5.4.1 section 5.0

Network-traffic test

In a KDD Cup dataset example, known labels identify normal records for a small training sample. The fitted OCSVM scores a separate test set and reaches an AUROC of 0.999. Even training without filtering achieves about 0.98 in this case; that result does not establish that contaminated training data is generally safe. section 5.4.1

Figure 5.5 The training data and subsequent data used on an OCSVM detector. This also shows the decision boundary created around the training data and a contour indicating the distance from the decision boundary. Some training points and normal subsequent points fall outside the decision boundary, though only slightly. Most generated outliers are well outside the boundary, though some randomly fall within it.

The plotted boundary shows both kinds of error: some normal points sit just outside it, while some generated outliers land inside. A two-dimensional plot helps explain the detector but does not necessarily carry over to higher-dimensional data. section 5.4

A one-class model can also learn a particular category of known, useful outliers rather than the normal class, helping sort detector results. This differs from training a binary classifier on a few scattered outliers: their locations may give too little guidance for a general boundary. For broad tabular outlier detection, compare OCSVM with other detectors instead of assuming one method will work best. section 15.3.2 section 5.8

How Outlier Detection in Python covers it

How deep it goes

Explains the boundary intuitively and demonstrates fitting and scoring, but does not derive the SVM optimization.

Examples

Uses two synthetic clusters with a plotted boundary and a KDD Cup network-traffic example with separate training and test data.

What it assumes

Assumes familiarity with tabular data and train-test workflows while explaining the one-class idea from a simple range analogy.

What you can do after

Apply it via scikit-learn’s `OneClassSVM` to fit clean training data, score separate observations, and examine boundary errors.

How it connects

Connects one-class classification to novelty detection, binary classification, Isolation Forest, and detector-result sorting.

liveBookmanning.com

Read Outlier Detection in Python on liveBook Get the book at manning.com

Related concepts

• one-class methodkind of · A one-class method is an approach trained on data from a single class to characterize that class and identify observations that do not fit it.
• support vector machinekind of · A support vector machine is a supervised-learning model that uses support vectors to determine a maximum-margin decision boundary or regression function, optionally using kernels to model nonlinear relationships.
• anomaly detectionaddresses · Anomaly detection is the identification of observations, events, or behaviors that substantially deviate from expected patterns or a normal baseline.
• parameterconfigures · A model parameter is a numerical value, such as a weight or bias, that is learned or set to determine how a model computes outputs.
• area under the curveproduces · The area under a curve is the integral of its values over a specified domain and, in classification evaluation, commonly summarizes performance across decision thresholds.

This explainer was generated by Manning's knowledge graph from the text of Outlier Detection in Python. The section links point to the parts of the book it draws on.