timeSeriesOcsvmAD
Create a machine learning one-class SVM anomaly detector model for time series data
Since R2026a
Description
Add-On Required: This feature requires the Time Series Anomaly Detection for MATLAB add-on.
timeSeriesOcsvmAD creates an anomaly detector based on the
machine learning One-Class SVM (support vector machine) algorithm. This
algorithm detects anomalies by separating data from the origin in the transformed
high-dimensional predictor space, and finding a decision boundary.
For more information on the model that timeSeriesOcsvmAD creates, see
<>.
detector = timeSeriesOcsvmAD(numChannels)TimeseriesOCSVMDetector model for time series data with
numChannels input channels.
detector = timeSeriesOcsvmAD(
sets additional options using one or more name-value arguments.numChannels,Name=Value)
For example, detector = timeSeriesOcsvmAD(3,IterationLimit=500) sets
the iteration limit for optimization to 500.
Examples
Load the file sineWaveAnomalyData.mat, which contains two sets of synthetic 3-channel sinusoidal signals.
sineWaveNormal contains 10 sinusoids of stable frequency and amplitude. Each signal has a series of small-amplitude impact-like imperfections. The signals have different lengths and initial phases. sineWaveAbnormal contains 3 sinusoids that contain the same normal data as sineWaveNormal, but that also include anomalous data.
load sineWaveAnomalyData.mat sineWaveNormal sineWaveAbnormal
Plot input signals
Plot all 3 channels of the first three anomalous signals.
s1 = 3; tiledlayout("vertical") ax = zeros(s1,1); for kj = 1:s1 ax(kj) = nexttile; plot(sineWaveAbnormal{kj}) title("Anomalous Signals") end
sineWaveAbnormal contains three signals, all of the same length. Each signal in the set has one or more anomalies.
All channels of the first signal have an abrupt change in frequency that lasts for a finite time.
The second signal has a finite-duration amplitude change in one of its channels.
The third signal has spikes at random times in all channels.
Create Detector
Use the TimeSeriesOCSVM detector to create a one-class SVM detector with 3 channels.Set an iteration limit of 500.
detector_tsocsvm = timeSeriesOcsvmAD(3,IterationLimit=500)
detector_tsocsvm =
TimeSeriesOCSVMDetector with properties:
BlockSize: 4000
KernelScale: "auto"
Lambda: "auto"
NumExpansionDimensions: "auto"
BetaTolerance: 1.0000e-04
GradientTolerance: 1.0000e-06
IterationLimit: 500
NumChannels: 3
IsTrained: 0
WindowLength: 10
TrainingStride: 1
DetectionStride: 10
Threshold: []
ThresholdMethod: "kSigma"
ThresholdParameter: 3
ThresholdFunction: []
Normalization: "zscore"
FeatureExtraction: 1
Train Detector
Train the detector using the normal data.
detector_tsocsvm = train(detector_tsocsvm,sineWaveNormal);
View the threshold that train computes and saves within detector_tslof. This computed value is influenced by random factors, such as which subsets of the data are used for training, and can change somewhat for different training sessions and different machines.
thresh = detector_tsocsvm.Threshold
thresh = -0.5513
Plot Anomaly Scores
Plot the histogram of the anomaly scores for the normal data. Each score is calculated over a single detection window. The threshold, plotted as a vertical line, does not always completely bound the scores.
plotHistogram(detector_tsocsvm,sineWaveNormal);
Use Detector to Identify Anomalies
Use the detect function to determine the anomaly scores for the anomalous data. Then, plot the anomaly scores of the normal and anomalous data together.
results = detect(detector_tsocsvm, sineWaveAbnormal);
results is a cell array that contains three tables, one table for each signal. Each cell table contains three variables: WindowLabel, WindowAnomalyScore, and WindowStartIndices.
View the contents of the five rows between 10 and 15 of the third table.
results_table3 = results{3};
results_t3_rows10to15 = results_table3(10:15,:)results_t3_rows10to15=6×3 table
false -1.3501 91
false -0.9483 101
true 0.0534 111
false -0.9461 121
false -0.9045 131
false -1.1543 141
The results indicate an anomaly in the third window of this set. The anomaly score is significantly distant from the scores for the other windows.
Plot Anomaly Score Distributions
Plot a histogram that shows the anomaly scores for both sets of data together, along with the threshold, for comparison.
plotHistogram(detector_tsocsvm,sineWaveNormal,sineWaveAbnormal)
The histogram uses different colors for the normal (Data 1) and anomalous (Data 2) data. Both types of data appear to the left of the threshold. To the right of threshold, Data 2 is prevalent.
Plot Detected Anomalies
Plot the detected anomalies of the third abnormal signal set.
plot(detector_tsocsvm,sineWaveAbnormal{3})
The top plot shows an overlay of red where the anomalies occur. The bottom plot shows how effective the threshold is at dividing the normal from the abnormal scores for Signal set 3.
Input Arguments
Name-Value Arguments
Output Arguments
Version History
Introduced in R2026a
See Also
train | detect | plot | plotHistogram | updateDetector
