1
$\begingroup$

I need to decide between SVM (One-Class Support Vector Machine) and PCA (PCA-Based Anomaly Detection) as anomaly detection methods. Azure ML is used and provides SVM and PCA as methods - hence the choice of 2 possible methods.

Does anyone have suggestions or a defined process for method selection? (Similar to cheat sheets you get for selecting a regression method).

The use case is to detect anomalies in high frequency network traffic data (from firewalls, routers & switches)?

$\endgroup$
  • 1
    $\begingroup$ I recently found this Cheat-sheet. I don't know if it's accurate or not, maybe someone else will tell. ![ML cheat sheet from SAS](i.stack.imgur.com/QTWxL.png) $\endgroup$ – Abyuks Apr 24 '17 at 8:52
  • $\begingroup$ "I need to decide between SVM and PCA as anomaly detection methods." This is not correct. PCA is not an anomaly detection method. Why are you restricting yourself to these methods? $\endgroup$ – Hobbes Apr 24 '17 at 15:05
  • $\begingroup$ As mentioned, I am using Azure ML, which offers these methods as Anomaly Detection models msdn.microsoft.com/en-US/library/azure/dn913096.aspx $\endgroup$ – Snympi Apr 25 '17 at 13:07
  • $\begingroup$ It is not about restricting my options. My question was to understand if this community has experience to share with regards to the selection between these two methods. $\endgroup$ – Snympi Apr 25 '17 at 13:09
  • $\begingroup$ Without putting in the time to look through Azure's documentation, my guess is that their PCA method is really just a way to do a feature reduction, then use some algorithm they have to classify. Best thing to do is try both methods and then CV and compare performances. gallery.cortanaintelligence.com/Experiment/… $\endgroup$ – Hobbes Apr 25 '17 at 14:30
4
$\begingroup$

Without putting in the time to look through Azure's documentation, my guess is that their PCA method is really just a way to do a feature reduction, then use some algorithm they have to classify. Best thing to do is try both methods and then CV and compare performances. https://gallery.azure.ai/Experiment/1219e87f8fb84e88a2e1b54256808bb3

| improve this answer | |
$\endgroup$
  • $\begingroup$ Actually PCA for anomaly detection is based on reconstruction error i.e. when projecting the data to an orthogonal space, what is the error on each sample after trying to go back to the original space. For reference: oreilly.com/library/view/hands-on-unsupervised-learning/… $\endgroup$ – Moreno Aug 31 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.