Not all machine learning problems are about predicting a known outcome. Sometimes the more interesting question is whether something looks unusual when compared with everything else. This is the idea behind One Class Support Vector Machine (One Class SVM). Supported by Oracle Machine Learning, it is an anomaly detection algorithm designed to identify observations that differ from normal patterns in a dataset.
One Class SVM approaches the problem differently from ordinary classification. In a typical classification task, a model is trained using examples from different categories, such as customers who did and didn’t respond to a campaign. Unlike this, it doesn’t require these predefined categories. Instead, it learns what normal data looks like and then identifies observations that fall outside of that pattern.
This makes the algorithm convenient when unusual events are difficult to determine in advance. For example, a financial organization may have millions of transactions but only a very small number may be suspicious. Rather than needing a large collection of confirmed fraudulent transactions for training, One Class SVM can learn the general characteristics of normal activity and highlight records that appear significantly different.
The same idea can be applied to customer behavior. A business could analyze purchasing patterns or account activity to identify customers whose behavior varies considerably from the usual pattern. These peculiar cases could then be investigated further to determine whether they represent fraud, errors, or simply legitimate activity.
Another possible application is network monitoring. Most activity on a computer network tends to follow relatively predictable patterns. If a device suddenly begins behaving very differently, One Class SVM can help flag the observation as unusual. This can give security teams an opportunity to investigate potentially suspicious activity before it develops into a more serious problem.
The algorithm is also valuable in industrial/operational environments. Sensors and monitoring systems can continuously generate measurements relating to machinery, equipment, etc. If these values begin to vary a lot from normal behavior, the algorithm can identify them as potential anomalies, thus helping find equipment problems or unexpected process changes.
An intriguing feature of Oracle’s implementation is that the model produces both a prediction and a probability when it is applied to new data. A prediction of 1 indicates a typical case, while a prediction of 0 indicates an anomalous case. This provides a straightforward way of finding which observations require further attention.
Additionally, Oracle provides an outlier rate setting, which allows users to specify the approximate percentage of observations they expect to be unusual. This can be useful when an organization has some prior knowledge about how frequently suspicious cases are likely to occur.
One Class SVM does have limitations. An observation being identified as anomalous doesn’t automatically mean that it’s harmful or incorrect. It simply means that the observation fluctuates from the typical system learned by the model. So human investigation or additional analysis may still be needed to understand why an observation has been flagged.
This is also what makes the technique particularly valuable. Rather than attempting to predict every possible unusual event, it can help narrow down a large dataset to the observations that deserve closer attention.
Lastly, One Class Support Vector Machine provides businesses with an effective way of finding unusual behavior when predefined anomaly examples aren’t available. By learning what normal activity looks like and finding deviating observations, the algorithm can provide support in many sectors. For companies dealing with large quantities of data, this can make it much easier to focus attention on the cases that may matter most.
