Novelty Detection

The model is trained exclusively on normal data that is assumed to be free of outliers. This is the fundamental distinction from outlier detection. The training set represents the known 'normal' state, and the algorithm learns a boundary tightly enclosing this distribution. Any contamination in the training set will cause the model to learn a flawed representation of normality.

Novelty detection is a form of open-set classification, where the model must reject inputs from unknown classes not seen during training. Unlike closed-set problems with a fixed number of labels, the algorithm must distinguish between 'known normal' and 'everything else,' which is an unbounded, infinite set of possible novelties.

The core computational task is estimating a compact decision boundary around the normal data in feature space. Common approaches include:

• One-Class SVM: Finds a hyperplane that separates normal data from the origin in kernel space
• Support Vector Data Description (SVDD): Encloses normal data within a minimal-volume hypersphere
• Gaussian Mixture Models: Defines a probability density threshold for normality

Every new observation receives a continuous novelty score rather than a binary label. This score quantifies the degree of abnormality. A threshold is then applied to trigger an alert. The score function is the model's learned metric, such as the distance to the decision boundary in a One-Class SVM or the negative log-likelihood in a density estimation model.

Novelty detection targets semantic anomalies—new, previously unseen classes of data—rather than statistical outliers within a known class. A point anomaly is an extreme value of a known distribution (e.g., an unusually high latency spike). A novelty is a fundamentally different pattern (e.g., a completely new failure mode in a base station that was never observed during training).

The defining operational constraint is the complete absence of anomalous examples during training. This scenario occurs in safety-critical systems where failures are rare, in manufacturing where defects are unknown a priori, or in scientific discovery where the target signal has never been observed. The model must generalize from only positive examples.

The broader parent category. While novelty detection focuses strictly on identifying new, unseen patterns after training on a clean 'normal' dataset, general anomaly detection often includes identifying outliers in a contaminated training set. In network telemetry, this is the difference between flagging a known hardware fault signature versus detecting a completely new zero-day attack pattern.

A classical algorithm for novelty detection. It learns a decision boundary that tightly encapsulates the 'normal' training data in a high-dimensional space. Any new telemetry point falling outside this boundary is flagged as a novelty. This is particularly effective for KPI anomaly detection where historical data is assumed to be fault-free.

A neural network architecture serving as a deep learning engine for novelty detection. Trained exclusively on normal network telemetry, it learns to compress and reconstruct this data. A high reconstruction error on a new input signals that the pattern is novel and does not conform to the learned manifold of normal behavior.

The primary operational adversary of a deployed novelty detection system. If the statistical definition of 'normal' evolves—for example, due to a network upgrade—the model will incorrectly flag legitimate new traffic patterns as novelties. Continuous monitoring for data drift is required to trigger model retraining on the new normal.

An unsupervised algorithm that, while often used for general anomaly detection, can be adapted for novelty scoring. It exploits the property that anomalous points are few and different. By measuring the average path length required to isolate a new observation in a forest of random trees, it provides a computationally efficient novelty score for high-dimensional telemetry.

A data point that is only anomalous within a specific context. In novelty detection, a model trained on summer temperature data would correctly identify a 35°C reading in winter as a novelty. This contrasts with a point anomaly, which is globally extreme. Network traffic patterns often require this contextual awareness to avoid false alarms during off-peak hours.