One-Class SVM

The algorithm maps input data into a high-dimensional feature space and finds a hyperplane that maximally separates the training data from the origin. It treats the origin as the only representative of the anomaly class. The optimization objective is to find a small region in feature space that contains most of the training data, controlled by the nu (ν) parameter, which sets an upper bound on the fraction of training errors and a lower bound on the fraction of support vectors.

Real-world network telemetry is rarely linearly separable. One-Class SVM uses kernel functions to implicitly project data into a higher-dimensional space without computing the coordinates. The Radial Basis Function (RBF) kernel is the most common choice, as it can model tight, non-convex boundaries around complex normal data distributions. The gamma (γ) parameter defines how far the influence of a single training example reaches; a low gamma creates a smooth, generalized boundary, while a high gamma risks overfitting to noise.

A critical operational requirement is that the training dataset must be clean and representative of normal behavior. Any anomalies present in the training set will be learned as 'normal,' permanently blinding the model to that type of fault. This contrasts with supervised methods and makes One-Class SVM ideal for novelty detection in controlled environments like a newly commissioned 5G cell site, where a baseline of fault-free performance counters can be established before anomalies appear.

During inference, the model computes a signed distance from each new data point to the separating hyperplane. A negative score indicates the point is outside the learned boundary and is flagged as an anomaly. The magnitude of the score can serve as a continuous anomaly severity metric, allowing operations teams to prioritize alerts. This is more informative than a simple binary label, enabling dynamic thresholding based on operational context.

The nu (ν) parameter is the primary tuning knob for model sensitivity. It accepts values between 0 and 1. A lower ν (e.g., 0.01) forces a tighter boundary, accepting fewer training points as normal and potentially increasing false positives. A higher ν (e.g., 0.1) allows more training points inside the boundary, increasing the model's tolerance to variance but risking false negatives. This parameter directly maps to the expected fraction of outliers in the training set.

The standard One-Class SVM has a training time complexity between O(n²) and O(n³), where n is the number of training samples, making it challenging for massive, high-velocity telemetry streams. However, the model is defined only by its support vectors—the few training points that lie on or outside the margin. Inference is therefore very fast, scaling linearly with the number of support vectors. For large-scale RAN deployments, linear kernel approximations or incremental learning variants are often preferred.

The specific machine learning task that One-Class SVM is designed to solve. The model is trained exclusively on a clean dataset of 'normal' operating states. Its goal is to determine if a new, unseen observation belongs to the same distribution or is an outlier. This differs from outlier detection, which often involves identifying anomalies within a contaminated training set. In network telemetry, novelty detection is ideal for identifying previously unknown fault signatures.

An alternative unsupervised algorithm that takes a fundamentally different approach. Instead of learning a boundary around normal data, it explicitly isolates anomalies by randomly partitioning the feature space. Anomalies, being 'few and different,' require fewer random splits to be isolated. This method is often computationally faster than One-Class SVM on high-dimensional telemetry data and does not require kernel trick optimization.

A neural network architecture that serves as a deep learning alternative to One-Class SVM. It compresses input data into a lower-dimensional latent space and then reconstructs it. The core principle is that the network learns only the patterns of normal data. An anomaly is flagged when the reconstruction error—the difference between the input and output—exceeds a set threshold, indicating the data does not conform to learned normality.

The supervised predecessor from which One-Class SVM is derived. A standard SVM finds a maximum-margin hyperplane that separates two or more classes. One-Class SVM adapts this by finding a hyperplane that separates the entire training dataset from the origin in a high-dimensional feature space, effectively creating a tight boundary around the 'normal' class without needing negative examples.

A mathematical technique critical to One-Class SVM's power. It implicitly maps data into a high-dimensional feature space without explicitly computing the coordinates, allowing the algorithm to find complex, non-linear decision boundaries. The Radial Basis Function (RBF) kernel is the most common choice for network telemetry, as it can model the intricate, non-linear relationships of performance management counters.

A production challenge that directly impacts One-Class SVM models. It occurs when the statistical properties of 'normal' network behavior change over time due to software upgrades or traffic pattern shifts. A static One-Class SVM boundary will become stale, generating false positives. Continuous monitoring and periodic retraining are required to adapt the model to the new normal state.