A training dataset is the data used to fit a model. In outlier detection, it establishes a working description of normality: the patterns against which records are judged. The same collected records may serve both as training data and as data searched for outliers. In an ongoing system, the fitted model can also become the reference for future records until it is refit. section 4.4
What fitting stores depends on the detector. A simple statistical model may retain feature means and standard deviations; another may learn clusters or frequent item sets. Distance- and density-based methods such as KNN or Radius depend more directly on the training points themselves, which may be stored in a BallTree or similar structure. Training-data quality therefore matters not just for estimating parameters but, for some detectors, for the comparisons made at prediction time. section 4.4
Learning a boundary from one class
A one-class SVM fits a decision boundary around all or most of its training points. Subsequent points inside the boundary fit its learned class; points outside are candidates for novelty. In a two-cluster synthetic example, some training and subsequently generated normal points fall slightly outside the boundary, while some generated outliers fall inside it. The boundary is a learned comparison, not a guarantee of the correct label. section 5.4
Figure 5.5 The training data and subsequent data used on an OCSVM detector. This also shows the decision boundary created around the training data and a contour indicating the distance from the decision boundary. Some training points and normal subsequent points fall outside the decision boundary, though only slightly. Most generated outliers are well outside the boundary, though some randomly fall within it.
The plot makes the distinction between training points, subsequent points, and the fitted decision boundary visible. section 5.4
Choose and maintain training data as a reference, not merely as a quantity of rows:
- Prepare features for the detector: numeric detectors generally need categorical features encoded and numeric features scaled; categorical detectors may require numeric features to be binned. section 4.15
- When ground truth is unavailable, test sample-size stability by fitting on several samples of each candidate size and comparing their predictions. More rows may improve consistency, but the additional execution time may not be justified. section 10.2.2
- Revisit the reference period as conditions change. Older data may no longer represent current behavior, while a recent period may itself be atypical. section 4.14
Checking how much training data is enough
For roughly 100,000 KDD Cup records, a CBLOF stability test tries training samples from 100 to 25,000 rows, with ten trials per size. It compares overlap among the top 50 selected records and correlation among high-scored records. This checks whether results settle as sample size grows; without ground truth, it does not establish that the resulting outliers are correct. section 10.2.2
The meaning of being outside the training distribution also depends on the task. For image outlier detection, the focus is often a novel type of object rather than an unusual color, angle, or background. A detector operating alongside image classification can flag such an object even when the classifier assigns a confident familiar label. section 16.3
