I am trying to create a model that would capture the usual behavior of a user: i.e., create a model for user profiling.

I do have 2 million rows of data indicating normal behavior of a user and want to define a model that can detect any variation from the normal behavior of the user.

I am contemplating of using one class svm / isolation forest trained on normal behavior. I would like to get an opinion whether that looks as a good direction.

Or should I venture into deep learning or unsupervised clustering based model and gather data for abnormal behavior of a user as well to possibly use supervised models.


3 Answers 3


I think it depends mostly on how difficult/expensive/time-consuming it is to gather data for abnormal behavior.It also depends on whether you'd expect this abnormal behavior to belong to one (or a fixed number of) classes or it could be anything that deviates from normal.

If you can afford to collect labelled data and expect the abnormal behavior to be limited to a fixed number of classes, then the supervised approach is very likely going to give you better results.

Instead, if any of the above hypothesis do not hold, then I think the semi-supervised approach (as you said, One Class SVM or similar techniques) is in my opinion a good way to go.


There is one class classification. In particular OC-SVM.

Or you could simply anaylze the distance to the nearest sample.


The baseline of my answer is certainly, try the simplest approach first, then go on. Machine Learning is not about heavy lifting, it is about smart usage of your tools.

The choice of your algorithm depends mostly on your data and the types of anomalies you would expect. Do you have timeseries data with sesonality effects and trends, maybe the twitter anomaly detection package would be a good start.

For instance. If your CPU is hot you would expect it to run with high load. If the load is low maybe it is an anomaly or it has suffered from a high load. So one of your questions would be, can you spot anomalies or identify normal behaviour by just looking at one sample?

Therefore the, "No-free-Lunch", theorem applies again.

That being said, SVM and Isolation Forest are a good start. Even if you have a time series problem, where you want to track short term dependencies. Just include "old" rows to your current set:Link

You can even try simpler approaches like Gaussian distribution of your values, calculating the probabilities of each permutation (if you features are small enough) or building a markov modell.

Unsatisfying results? Dive deeper, maybe Auto Encoder do the trick, maybe LSTMs, maybe a combination of both.

A short summary of unsupervised and semi-supervised ML algorithms I recently used, sorted by complexity (kind of):

  • Median Absolute Deviation (Twitters anomaly detection library)
  • Local Outloer Factor
  • Isolation Forest
  • Elliptic Envelope
  • Autoregressive integrated moving average
  • Auto Encoder
  • Time Series Discordes
  • LSTMs for forcasting
  • Replicator Neuronal Networks
  • Bayesian networks

There are certainly supervised approaches but I am not familiar with those.


Not the answer you're looking for? Browse other questions tagged or ask your own question.