TimeSeriesOCSVMDetector

Detect subsequence anomalies in time series using a one-class SVM detector

Since R2026a

Description

Add-On Required: This feature requires the Time Series Anomaly Detection for MATLAB add-on.

The TimeSeriesOcsvmAD object implements an anomaly detector based on the machine learning One-Class SVM (support vector machine) algorithm. This algorithm detects anomalies by separating data from the origin in the transformed high-dimensional predictor space, and finding a decision boundary.

TimeSeriesOCSVMDetector provides a time series version, for outlier point and subsequence detection, of the ocsvm detector in Statistics and Machine Learning Toolbox™.

Creating a TimeSeriesOCSVMDetector model is the first step in a workflow that includes training the detector with normal data, testing the detector with anomalous data, and validating the model by visualizing detection effectiveness on anomalous data using plotting functions. To improve detection performance, you can use updateDetector to change certain properties, such as threshold properties, by updating the trained model without retraining. To change other properties, you must create a new detector object and specify the new properties using name-value arguments. You cannot modify detector properties using dot notation.

For more information on the local outlier algorithm on which TimeSeriesOCSVMDetector is based, see the "More About" section in OneClassSVM in Statistics and Machine Learning Toolbox.

For more information on the functions this workflow uses, see Object Functions.

Creation

Create a TimeSeriesOCSVMDetector object by using the timeSeriesOcsvmAD function.

Properties

Input

NumChannels — Number of input channels

positive integer

Number of input channels in each time series, represented as a positive integer. All time series inputs must have the same number of channels.

This property is read-only after object creation.

Window

WindowLength — Length of detection window

10 (default) | positive integer scalar

Window length of each time series segment, represented as a positive integer scalar.

This property is read-only after object creation.

TrainingStride — Stride length for training data

1 (default) | positive integer

Stride length of sliding window in training stage, specified as a positive integer.

This property is read-only after object creation.

DetectionStride — Detection Stride length

positive integer

Stride length of sliding window in detection stage, represented as a positive integer. DetectionStride controls the number of overlapped samples. If you did not specify DetectionStride when creating the detector using timeSeriesOcsvmAD, the detection stride length is equal to the value of detectionWindowLength, resulting in non-overlapping windows.

This property is read-only after object creation.

Threshold

ThresholdMethod — Method for computing detection threshold

"kSigma" (default) | "contaminationFraction" | "max" | "mean" | "median" | "manual" | "customFunction

Method for computing the detection threshold, represented as one of these.

• "kSigma" — Sigma-based standard deviation of the normalized anomaly scores, calculated as mean + k + standard deviation. The parameter k determines how many standard deviations above the mean the threshold is set. The value of k is specified by ThresholdParameter.

• "contaminationFraction" — Percentage of anomalies within a specified fraction of windows, measured over the entire training set. The fraction value is specified by ThresholdParameter.

• "max" — Maximum window loss measured over the entire training data set and multiplied by ThresholdParameter.

• "mean" — Mean window loss measured over the entire training data set and multiplied by ThresholdParameter.

• "median" — Median window loss measured over the entire training data set and multiplied by ThresholdParameter.

• "manual" — Manual detection threshold value based on Threshold.

• "customFunction" — Custom detection threshold method based on ThresholdFunction.

If you specify ThresholdMethod, you can also specify ThresholdParameter, Threshold, or ThresholdParameter. The available threshold parameter depends on the specified detection method.

This property can be set only during object creation and, after training, by using the updateDetector function.

Threshold — Detection threshold

1 (default) | positive scalar

Detection threshold that separates the normal anomaly scores from the anomalous anomaly scores, specified as a scalar. During the detection process, the software assigns anomaly labels according to this threshold.

. The source of the Threshold value depends on the setting of ThresholdMethod.

• If ThresholdMethod is "manual", you set the value.

• If ThresholdMethod is "customFunction", the function specified in ThresholdFunction computes the value.

• For other values of ThresholdMethod, specify ThresholdParameter as the input to the specified method. The software uses this method to compute the threshold value.

This property can be set only during object creation and, after training, by using the updateDetector function.

ThresholdParameter — Parameter for determining detection threshold

numeric scalar

Parameter for determining the detection threshold, represented as a numeric scalar.

The way you specify ThresholdParameter depends on the specified value for ThresholdMethod. This list describes the specification of ThresholdParameter for each possible value of ThresholdMethod.

• "kSigma" — Specify ThresholdParameter as a positive numeric scalar. If you do not specify ThresholdParameter, the detector sets the threshold to 3.

• "contaminationFraction"— Specify ThresholdParameter as a as a nonnegative scalar less than 0.5. For example, if you specify "contaminationFraction" as 0.05, then the threshold is set to identify the top 5% of the anomaly scores as anomalous. If you do not specify ThresholdParameter, the detector sets the threshold to 0.01.

• "max", "mean", or "median" — Specify ThresholdParameter as a positive numeric scalar. If you do not specify ThresholdParameter, the detector sets the threshold to 1.

• "customFunction" or "manual" — ThresholdParameter does not apply.

This property can be set only during object creation and, after training, by using the updateDetector function.

ThresholdFunction — Function for computing detection threshold

function handle

Function to compute custom detection threshold, represented as a function handle. This property applies only when ThresholdMethod is specified as "customFunction".

• The function must have one input and one output.

  • The input must be the vector of the anomaly scores.

  • The output must contain a scalar corresponding to the detection threshold.

For more information about how the detector uses the threshold to detect anomalies, see Threshold.

This property can be set only during object creation and, after training, by using the updateDetector function.

Feature Extraction

FeatureExtraction — Enable feature extraction

1(true) (default) | 0(false)

Enable feature extraction option, represented as 1(true) or 0(false).

• When FeatureExtraction is enabled, the software extracts statistical features to use during training. Extracted features are generally cleaner and more meaningful than raw data, but the extraction process can be computationally expensive.

• When FeatureExtraction is disabled, the training process uses only raw data points that are combined into a single flattened vector. Raw data is likely to be noisier and include random disturbances. However, if you have a relatively small number of signals and they already represent useful features, then the computational cost FeatureExtraction may not be worth the benefit.

This property can be set only during object creation.

One Class Support Vector Machine Model Options

BlockSize — Maximum amount of allocated memory

4e^3 (4 GB) (default) | positive scalar

Maximum amount of allocated memory in megabytes, represented as a positive scalar.

KernelScale — Kernel scale parameter

"auto" (default) | 1 | positive scalar

Kernel scale parameter, represented as "auto" or a positive scalar. The software obtains a random basis for random feature expansion by using the kernel scale parameter.

If you specify "auto", then the software selects an appropriate kernel scale parameter using a heuristic procedure. This heuristic procedure uses subsampling, so estimates can vary from one call to another. Therefore, to reproduce results, set a random number seed by using rng before training.

Lambda — Regularization term strength

"auto" (default) | nonnegative scalar

Regularization term strength, represented as "auto" or a nonnegative scalar.

If you specify "auto", then the software selects an appropriate regularization parameter by using a heuristic procedure.

NumExpansionDirections — Number of dimensions of expanded space

"auto" (default) | positive integer

Number of dimensions in the expanded space, represented as "auto" or a positive integer.

If you specify "auto", then the software selects an appropriate number of dimensions using a heuristic procedure.

BetaTolerance — Relative tolerance on linear coefficients and bias term

1e-4 (default) | nonnegative scalar

Relative tolerance on linear coefficients and bias term (intercept), represented as a nonnegative scalar.

This value, along with GradientTolerance, provides a stopping criterion for optimization.

GradientTolerance — Absolute gradient tolerance term

1e-6 (default) | nonnegative scalar

Absolute gradient tolerance, represented as a nonnegative scalar.

This value, along with BetaTolerance, provides a stopping criterion for optimization.

IterationLimit — Maximum number of optimization iterations

positive integer

Maximum number of optimization iterations, represented as a positive integer.

The default value is 1000 if the transformed data fits in memory, as specified by the BlockSize name-value argument. Otherwise, the default value is 100.

Normalization

Normalization — Normalization technique

"zscore" (default) | "range" | "off"

Normalization technique for training and testing, represented as "zscore", "range", or "off".

• "range" — Rescale the data range to [0,1].

• "zscore" — Distance from a data point to the mean in terms of standard deviation

• "off" — Do not normalize the data.

The data to which Normalization is applied depends whether FeatureExtraction is enabled.

• If FeatureExtraction is enabled, then normalization is applied to the features.

• If FeatureExtraction is disabled, then normalization is applied to the raw data.

If all the input data values are the same (the data is constant), then normalization returns zeros. For example, if X is a vector containing all equal values, then normalize(X) returns a vector of the same size that contains all zeros.

For more information on normalization methods, see normalize.

This property is read-only after object creation.

Read-Only Properties

IsTrained — Training status

Read-only: 0 (false) | 1 (true)

This property is read-only.

Training status, represented as 0 (false) or 1 (true). After you train the detector, IsTrained is equal to 1.

Object Functions

train	Train time series machine learning anomaly detector and obtain detection threshold
detect	Detect anomalies in time series using a trained time series machine learning detector model
plot	Plot detected anomalies and anomaly scores generated from trained machine learning anomaly detectors
plotHistogram	Plot histogram of anomaly scores and detection threshold for trained machine learning anomaly detector
plotHistogram	Plot histogram of anomaly scores and detection threshold for trained machine learning anomaly detector

Version History

Introduced in R2026a