Theoretical Considerations on Artificial Intelligence and Cybersecurity, One-Class SVM for Anomaly Detection in Network Traffic

Abstract

In this article, One-Class SVM has been highlighted as a particularly valuable approach, as it does not require collecting large datasets of labeled attack samples. Instead, it effectively models normal behavior and identifies significant deviations from the expected pattern.

Both theoretical considerations and a Python code example have been presented, demonstrating how such a model can be trained on real or synthetic network data and subsequently used to detect potential anomalies.

Additionally, the text includes guidelines for data preparation, covering collection, cleaning, normalization, and potential dimensionality reduction, as well as hyperparameter optimization (including nu and gamma).

Furthermore, a mathematical perspective is provided, explaining the role of the weight vector (w), the threshold value (R), and the kernel function, which enables nonlinear mapping and the separation of normal samples from outliers.