High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning

• Published in: Pattern recognition Vol. 58; pp. 121 - 134
• Main Authors: Erfani, Sarah M., Rajasegarar, Sutharshan, Karunasekera, Shanika, Leckie, Christopher
• Format: Journal Article
• Language: English
• Published: Elsevier Ltd 01.10.2016
• Subjects: Anomalies; Anomaly detection; Architecture; Belief networks; Deep belief net; Deep learning; Detectors; Feature extraction; High-dimensional data; Learning; Obstacles; One-class SVM; Outlier detection; Support vector machines; High-dimensional data; Deep learning; One-class SVM; Deep belief net; Outlier detection; Feature extraction; Anomaly detection
• ISSN: 0031-3203; 1873-5142
• DOI: 10.1016/j.patcog.2016.03.028

High-dimensional problem domains pose significant challenges for anomaly detection. The presence of irrelevant features can conceal the presence of anomalies. This problem, known as the ‘curse of dimensionality’, is an obstacle for many anomaly detection techniques. Building a robust anomaly detection model for use in high-dimensional spaces requires the combination of an unsupervised feature extractor and an anomaly detector. While one-class support vector machines are effective at producing decision surfaces from well-behaved feature vectors, they can be inefficient at modelling the variation in large, high-dimensional datasets. Architectures such as deep belief networks (DBNs) are a promising technique for learning robust features. We present a hybrid model where an unsupervised DBN is trained to extract generic underlying features, and a one-class SVM is trained from the features learned by the DBN. Since a linear kernel can be substituted for nonlinear ones in our hybrid model without loss of accuracy, our model is scalable and computationally efficient. The experimental results show that our proposed model yields comparable anomaly detection performance with a deep autoencoder, while reducing its training and testing time by a factor of 3 and 1000, respectively. •We use a combination of a one-class SVM and deep learning.•In our model linear kernels can be used rather than nonlinear ones.•Our model delivers a comparable accuracy with a deep autoencoder.•Our model executes 3times faster in training and 1000 faster than a deep autoencoder.