One Class Support Subsequence Machine: Abnormal time series subsequences detection using One-Class SVM

Abstract

In this paper, an approach is proposed for the detection of abnormal time series subsequences using the One-Class SVM with an application to defect detection of two automatic welding processes. The One Class-SVM has been used in many works for the same purpose but only after transforming the subsequences into a set of feature vectors. However, finding the relevant features that allow anomaly detection may be challenging. Methods dealing with the raw subsequences, on the other hand, can be easily generalized to other problems and are known to be efficient. Nevertheless, they often suffer from high computational cost since they involve computing the distances to all the reference subsequences, which may restrict their application, especially with the need of real time predictions in most of the applications. We show in this work that, contrary to what is indicated in the literature, the One- Class SVM can be used directly with the raw subsequences. This is achieved by employing distance substitution kernels, which are a class of kernels that allow to use dissimilarity measures in the One-class SVM formulation. The results show that the approach has a similar efficiency of those suggested in the literature that operate with raw subsequences in terms of accuracy. Furthermore, because it just requires the distances to the support vectors, the approach has a low time complexity in the prediction phase, making it more suitable for real-time monitoring. We further show that the One-Class SVM with non-metric dissimilarity remains efficient for aberrant subsequence identification.

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

“…Furthermore, OCSVM can build a more accurate model and has robustness for noise samples. OCSVM has been proven to be an effective machine learning method for intrusion detection in industrial control systems [166]; • Gaussian Mixture Models: GMM assumes that data points are generated from a mixture of several Gaussian distributions. Anomalies can be detected as instances with low probabilities under the fitted GMM.…”