One-Class SVM

One-Class SVM maps input data into a high-dimensional feature space using a kernel function (typically Radial Basis Function (RBF)). In this space, it constructs a maximum-margin hyperplane that separates the origin from the normal data points. The algorithm's objective is to find the smallest region that captures the training data density, effectively learning a tight envelope around normal signal features. The nu parameter controls the upper bound on the fraction of training errors and the lower bound on the fraction of support vectors, directly tuning the model's sensitivity to outliers.

For each new sample, the model computes a signed distance from the learned boundary. Negative values indicate the sample lies outside the normal region and is flagged as an anomaly. The raw distance serves as an anomaly score, allowing operators to rank alerts by severity. Key scoring mechanics include:

• Positive distance: Sample is within the normal envelope
• Negative distance: Sample is an outlier; magnitude indicates deviation severity
• Support vectors: Only the boundary-defining training samples influence the score, making the model memory-efficient at inference time

One-Class SVM is particularly effective for spectrum anomaly detection because it handles high-dimensional feature vectors without assuming any underlying distribution. It works directly on:

• Raw I/Q samples transformed into statistical feature sets
• Spectral kurtosis and higher-order statistics
• Cyclostationary signatures extracted from modulated signals
• Constellation diagram deviations mapped to feature space The kernel trick allows the model to find non-linear boundaries in the original feature space without explicitly computing the high-dimensional mapping, making it computationally tractable for real-time spectrum monitoring applications.

A defining advantage of One-Class SVM is its ability to train exclusively on normal operating conditions without requiring labeled anomaly examples. This is critical in spectrum monitoring where:

• Anomalous transmissions are rare and unpredictable
• Novel interference types appear that were never seen during training
• Labeling every possible anomaly class is infeasible The model learns a compact representation of normality from clean spectrum captures. Any deviation—whether a rogue emitter, jamming signal, or equipment malfunction—is detected as an outlier, enabling open-set recognition in dynamic electromagnetic environments.

While One-Class SVM operates on handcrafted features, Deep Support Vector Data Description (Deep SVDD) combines neural networks with the same one-class objective. Key distinctions:

• One-Class SVM: Requires explicit feature engineering; works well with smaller datasets and known signal characteristics
• Deep SVDD: Learns features and boundary jointly via a neural network; excels with raw I/Q data and large-scale deployments
• Trade-off: One-Class SVM offers better interpretability and faster training on moderate datasets, while Deep SVDD provides superior performance when massive labeled-normal datasets are available Both methods share the core principle of enclosing normal data in a minimal hypersphere.

When deploying One-Class SVM for real-time spectrum anomaly detection, engineers must address:

• Feature scaling: All input features must be normalized (e.g., StandardScaler) since SVM is distance-based
• Kernel selection: RBF is standard, but domain-specific kernels can encode prior knowledge about signal structures
• Nu parameter tuning: Higher nu allows more training points to be treated as outliers, increasing sensitivity at the cost of false positives
• Concept drift: The model of normality must be periodically retrained as the RF environment evolves with new legitimate emitters
• Computational efficiency: Inference is fast (only support vectors matter), but training complexity scales quadratically with dataset size