Beginning Anomaly Detection Using

unsupervised anomaly detection when applied in the manner 

implemented in this section.

 One-Class Support Vector Machine

The One-Class SVM is a modified support vector machine model that is well-suited for 

novelty detection (an example of 

semi-supervised anomaly detection). The idea is 

that the model trains on normal data and is used to detect anomalies when new data is 

presented to it. While the OC-SVM might seem best suited to semi-supervised anomaly 

detection, since training on only one class means it’s still “partially labeled” when 

considering the entire data set, it can also be used for unsupervised anomaly detection. 

You will perform semi-supervised anomaly detection on the same KDDCUP 1999 data 

DQRPDOLHVBWHVW DQRPDO\BVFRUHVBWHVW!

PDWFKHV \BWHVW  

OLVW

HQFRGHGFODVVHVB LQGH[ QRUPDO

DXF URFBDXFBVFRUH DQRPDOLHVBWHVWPDWFKHV

SULQW

$8&^`IRUPDW DXF

Figure 2-28.  Applying the code in Figure 

2-24

 to the test set. In this case, the 

threshold was the same, but you still picked it based on the histogram

Figure 2-29.  The generated AUC score for the test set

Chapter 2   traditional Methods of anoMaly deteCtion

---

52

set as the isolation forest example. Similar to the isolation forest, the OC-SVM is also 

good for high-dimensional data. Additionally, the OC-SVM can capture the shape of the 

data set pretty well, a point that will be elaborated upon below.

To understand how a support vector machine works, first visualize some data on a 

2D plane (Figure 

2-30

).

How do you separate the data into two distinct regions using a line? Well, it’s pretty 

simple (Figure 

2-31

).

Figure 2-30.  Some points plotted so that they group up in two regions on  

the graph

Chapter 2   traditional Methods of anoMaly deteCtion

---

53

Now you have two regions representing two different labels. However, the problem 

goes a little bit deeper than that.

The reason the model is called a “support vector machine” is because these “support 

vectors” actually play a huge role in how the model draws the decision boundary, 

represented in this case by the line in Figure 

2-32

.

Figure 2-31.  A line that separates the two regions based on the points plotted

Chapter 2   traditional Methods of anoMaly deteCtion

---

54

Basically, a