[论文解读] An Efficient One-Class SVM for Anomaly Detection in the Internet of Things

Kun Yang, Samory Kpotufe+1 more|arXiv (Cornell University)|Apr 22, 2021

Anomaly Detection Techniques and Applications参考文献 27被引用 37

一句话总结

本文将 One-Class SVM 与 Nyström 和 Kernel Johnson-Lindenstrauss (KJL) 草图化相结合，用于物联网异常检测，在保持与 OCSVM 相当的 AUC 的同时，实现 14–40x 的检测速度提升和 20x 的内存削减。

ABSTRACT

Insecure Internet of things (IoT) devices pose significant threats to critical infrastructure and the Internet at large; detecting anomalous behavior from these devices remains of critical importance, but fast, efficient, accurate anomaly detection (also called "novelty detection") for these classes of devices remains elusive. One-Class Support Vector Machines (OCSVM) are one of the state-of-the-art approaches for novelty detection (or anomaly detection) in machine learning, due to their flexibility in fitting complex nonlinear boundaries between {normal} and {novel} data. IoT devices in smart homes and cities and connected building infrastructure present a compelling use case for novelty detection with OCSVM due to the variety of devices, traffic patterns, and types of anomalies that can manifest in such environments. Much previous research has thus applied OCSVM to novelty detection for IoT. Unfortunately, conventional OCSVMs introduce significant memory requirements and are computationally expensive at prediction time as the size of the train set grows, requiring space and time that scales with the number of training points. These memory and computational constraints can be prohibitive in practical, real-world deployments, where large training sets are typically needed to develop accurate models when fitting complex decision boundaries. In this work, we extend so-called Nyström and (Gaussian) Sketching approaches to OCSVM, by combining these methods with clustering and Gaussian mixture models to achieve significant speedups in prediction time and space in various IoT settings, without sacrificing detection accuracy.

研究动机与目标

• Motivate fast, memory-efficient novelty detection for heterogeneous IoT devices and traffic patterns.
• Address prediction-time and space bottlenecks of traditional OCSVM in IoT deployments.
• Develop scalable OCSVM variants using Nyström and KJL to preserve cluster structure for effective novelty detection.
• Integrate Gaussian Mixture Models to detect novelty via density in a reduced-dimensional embedding.
• Offer automatic or data-driven hyperparameter strategies suitable for unlabeled IoT data.

提出的方法

• Embed normal training data into a lower-dimensional space Rd using Nyström or Kernel Johnson-Lindenstrauss (KJL).
• Model the embedded normal data with a Gaussian Mixture Model to detect novelty as low-density regions.
• Automatically (or via heuristics) determine the number of GMM components k using density-mode estimators like QuickShift++.
• Maintain a detection rule based on the GMM density evaluated at the embedded test point φ′(x).
• Provide two practical training scenarios: with or without labeled novelty validation data for hyperparameter choice.

实验结果

研究问题

• RQ1 Can Nyström or KJL-based embedding of OCSVM preserve detection performance while reducing time and memory at prediction?
• RQ2 Does fitting a GMM to the embedded normal data enable effective novelty detection in IoT traffic?
• RQ3 How does automatic selection of the number of Gaussian components (k) affect detection accuracy and robustness in practice?
• RQ4 What are the comparative gains in detection time and space versus baseline OCSVM on IoT datasets?
• RQ5 How do OC-Nyström and OC-KJL perform under calibration versus rule-of-thumb hyperparameter choices?

主要发现

• Detection time gains of 14–20x, up to 40x on some datasets, with OC-Nyström and OC-KJL.
• Space complexity reduced by factors of 20x or more compared to OCSVM.
• OC-Nyström and OC-KJL achieve AUC comparable to baseline OCSVM when hyperparameters are properly calibrated.
• Under less-ideal, rule-of-thumb hyperparameters, OC-Nyström and OC-KJL achieve at least 0.85 of OCSVM’s AUC on most datasets and can improve AUC in many cases.
• KJL and Nyström embeddings preserve cluster structures, enabling effective density-based novelty detection via GMM on the embedded data.
• Typically only a small number of clusters (k between 1 and 20) suffices to model IoT normal traffic, aiding efficiency.