Abstract:Anomaly detection plays an important role in industry, especially in ensuring system safety and product quality. Due to the unavailability of anomalous data in many practical cases, anomaly detection is usually solved by one-class classification (OCC) methods using only normal data. As a classical OCC method, one-class support vector machine (OCSVM) is a popular discriminative approach for anomaly detection, which detects abnormal data points by establishing a decision boundary in the kernel space. However, the performance of OCSVM heavily relies on kernel parameters, whose selection is not trivial for anomaly detection problems. Moreover, for some uneven and complex data distributions, different data regions may have quite different densities and shapes, making it difficult for OCSVM to obtain good boundaries in all regions using a global kernel parameter. To address the above two issues, in this article, we propose a hybrid algorithm incorporating vector quantization and OCSVM (VQ-OCSVM). Specifically, vector quantization is used to extract distribution information of normal data, and the results are used to construct an explicit mapping function to map data into a high-dimensional feature space. Then, OCSVM is performed in the feature space to build a classifier. By introducing the explicit mapping into OCSVM, the proposed method can effectively bypass the kernel parameter selection problem of the classical OCSVM method. Furthermore, the constructed mapping carries the data distribution information, and the VQ-OCSVM model can be regarded as an integration of generative learning and discriminative learning. The complementary properties of these two paradigms make the proposed VQ-OCSVM algorithm have better generalization capacity for complex data distribution. Both qualitative and quantitative experimental results demonstrate the effectiveness and advantages of the proposed method.

PCA/KPCA Feature Extraction Approach to SVM for Anomaly Detection

Anomaly detection model of user behavior based on principal component analysis

An Intrusion Detection Method Based on Principal Component Analysis and Decision Tree

An efficient anomaly detection algorithm for vector-based intrusion detection systems

A Hybrid Algorithm Incorporating Vector Quantization and One-Class Support Vector Machine for Industrial Anomaly Detection

Performance Investigation of Principal Component Analysis for Intrusion Detection System Using Different Support Vector Machine Kernels

Adaptive kernel subspace method for speeding up feature extraction

Distributed Online One-Class Support Vector Machine for Anomaly Detection over Networks

KPCA Based on Feature Samples for Fault Detection

Kernel PCA for Out-of-Distribution Detection

The abnormal traffic detection scheme based on PCA and SSH

Diagnosing Traffic Anomalies Using a Two-Phase Model

Abnormal Subspace Sparse PCA for Anomaly Detection and Interpretation

Multiple kernel learning method for network anomaly detection

UFKLDA: An unsupervised feature extraction algorithm for anomaly detection under cloud environment

Intrusion detection using SVM

Anomaly internet network traffic detection by kernel principle component classifier

SIFT and SURF based feature extraction for the anomaly detection

PCA-subspace Method - is It Good Enough for Network-Wide Anomaly Detection.

Performance Analysis of Anomaly-Based Network Intrusion Detection Using Feature Selection and Machine Learning Techniques

A Novel SVM by Combining Kernel Principal Component Analysis and Improved Chaotic Particle Swarm Optimization for Intrusion Detection