One-Class SVM Anomaly Detector

Find anomalies in data using one-class support vector machine (SVM)

Since R2026a

• 

Libraries:
Statistics and Machine Learning Toolbox / Anomaly Detection

Description

The One-Class SVM Anomaly Detector block finds anomalies in data using a trained one-class support vector machine (SVM) model object.

Import a one-class SVM model object (OneClassSVM) into the block by specifying the name of a workspace variable that contains the object. The input port x receives a data stream for which anomalies are evaluated. The output port IsAnomaly returns values indicating if anomalies are detected, and the output port score returns the anomaly scores.

Examples

Detect Anomalies Using One-Class SVM Model

Train a one-class support vector machine (SVM) model for anomaly detection using the ocsvm function. Then detect anomalies in new data by passing the new data to the One-Class SVM Anomaly Detector block.

Load the sample data set NYCHousing2015.

load NYCHousing2015

The data set includes 10 variables with information on the sales of properties in New York City in 2015. Remove the NEIGHBORHOOD variable, which has 254 categories, and the BUILDINGCLASSCATEGORY variable, which is not numeric.

NYCHousing2015.NEIGHBORHOOD = [];
NYCHousing2015.BUILDINGCLASSCATEGORY = [];

The SALEDATE variable is a datetime array, which is not supported by ocsvm. Create variables for the month and day numbers of the datetime values, and then delete the SALEDATE variable.

[~,NYCHousing2015.MM,NYCHousing2015.DD] = ymd(NYCHousing2015.SALEDATE);
NYCHousing2015.SALEDATE = [];

Shuffle the order of the observations and convert the table into a matrix.

rng(0,"twister") % For reproducibility
NYCHousing2015 = NYCHousing2015(randperm(height(NYCHousing2015)),:);
NYCHousing2015 = table2array(NYCHousing2015);

Create a training data set using the first 40,000 observations, and a test data set using the next 5000 observations.

n_train = 40000;
n_test = 5000;
X_train = NYCHousing2015(1:n_train,:);
X_test = NYCHousing2015(n_train+1:n_train+n_test,:);

Train a one-class SVM model using the training data. Assume that the outlier fraction in the training data is 0.5%. Because the first variable (BOROUGH) is not ordinal, treat it as categorical.

[ocMdl,tf,scores_train] = ocsvm(X_train,ContaminationFraction=0.005,CategoricalPredictors=1);

ocMdl is a OneClassSVM model object. The ocsvm function also returns the anomaly indicators tf and anomaly scores scores_train for the training data.

Plot a histogram of the anomaly score values. Create a vertical dashed line at the score threshold corresponding to the specified outlier fraction.

histogram(scores_train)
xlabel("Anomaly Score")
xline(ocMdl.ScoreThreshold,"r--",["Threshold" ocMdl.ScoreThreshold])

Convert the test data into a time series object to load into the Simulink model.

t = 0:size(X_test,1)-1;
X_ts = timeseries(X_test,t,InterpretSingleRowDataAs3D=true);

This example provides the Simulink model slexOCSVMAnomalyDetector.slx, shown in the figure below. The model is configured to use ocMdl as the initial model for the One-Class SVM Anomaly Detector block. You can double-click the block to access the Block Parameters dialog box.

slName = "slexOCSVMAnomalyDetector";
open_system(slName);

Simulate the Simulink model to perform anomaly detection on the test data. At each iteration, the One-Class SVM Anomaly Detector block flags an observation as an anomaly if its anomaly score is above the threshold.

simOut = sim(slName,"StopTime",num2str(numel(t)-1));

Export the simulation outputs to the workspace. You can use the Simulation Data Inspector (Simulink) to view the logged data of an Outport block.

% Extract IsAnomaly values
IsAnomaly_sig = simOut.yout.getElement(1);
IsAnomaly_sl = squeeze(IsAnomaly_sig.Values.Data);

% Extract score values
score_sig = simOut.yout.getElement(2);
score_sl = squeeze(score_sig.Values.Data);

Plot the anomaly scores and indicate the anomalous observations with red circle markers. Create a dashed line at the score threshold.

figure
plot(score_sl,".")
ylabel("Anomaly Score")
xlabel("Observation Number")
hold on
idx = find(IsAnomaly_sl == 1);
plot(idx,score_sl(idx),"ro")
yline(ocMdl.ScoreThreshold,"r--")
hold off

Compute the fraction of anomalous observations in the test data set.

frac = sum(IsAnomaly_sl/n_test)

frac = 
0.0070

The anomaly fraction (0.7%) is similar to the anomaly fraction in the training data set.

Ports

Input

x — Input data

numeric matrix

Input data, specified as a numeric matrix. The software assumes that the observations in the predictor data are oriented along the rows of x.

Data Types: single | double | half | int8 | int16 | int32 | int64 | uint8 | uint16 | uint32 | uint64 | Boolean | fixed point

Output

IsAnomaly — Anomaly indicators

logical vector

Anomaly indicators, returned as a logical vector. If an observation has an anomaly score greater than the threshold in the anomaly detection model (or the custom threshold, if specified), then the corresponding anomaly indicator value is true.

Data Types: Boolean

score — Anomaly scores

vector of numeric scalars in the range (–Inf,Inf)

Anomaly scores, returned as a vector of numeric scalars in the range (–Inf,Inf). A negative score value with large magnitude indicates a normal observation, and a large positive value indicates an anomaly.

Dependencies

To enable this port, select the check box for Add output port for anomaly scores on the Main tab of the Block Parameters dialog box.

Data Types: single | double | half | int8 | int16 | int32 | int64 | uint8 | uint16 | uint32 | uint64 | fixed point

Parameters

Main

Select anomaly detection model — One-class SVM model for anomaly detection

anomalyMdl (default) | OneClassSVM object

Specify the name of a workspace variable that contains a OneClassSVM model object.

Programmatic Use

Block Parameter: AnomalyLearner

Type: workspace variable

Values: OneClassSVM object

Default: "anomalyMdl"

Add output port for anomaly scores — Add second output port for anomaly scores

off (default) | on

Select the check box to include the second output port score in the One-Class SVM Anomaly Detector block.

Programmatic Use

Block Parameter: ShowOutputScore

Type: character vector or string

Values: "off" | "on"

Default: "off"

Custom threshold for anomaly score — Threshold for anomaly score

[] (default) | numeric scalar

Specify the threshold for the anomaly score. If an observation has an anomaly score above the threshold, the software identifies the observation as an anomaly.

Programmatic Use

Block Parameter: ScoreThreshold

Type: character vector or string

Values: "[]" | numeric scalar

Default: "[]"

Sample time (–1 for inherited) — Option to specify sample time

–1 (default) | scalar

Specify the discrete interval between sample time hits or specify another type of sample time, such as continuous (0) or inherited (–1). For more options, see Types of Sample Time (Simulink).

By default, the One-Class SVM Anomaly Detector block inherits sample time based on the context of the block within the model.

Programmatic Use

Block Parameter: SystemSampleTime

Type: string scalar or character vector

Values: scalar

Default: "–1"

Data Types

Fixed-Point Operational Parameters

Integer rounding mode — Rounding mode for fixed-point operations

Floor (default) | Ceiling | Convergent | Nearest | Round | Simplest | Zero

Specify the rounding mode for fixed-point operations. For more information, see Rounding Modes (Fixed-Point Designer).

Block parameters always round to the nearest representable value. To control the rounding of a block parameter, enter an expression into the mask field using a MATLAB^® rounding function.

Programmatic Use

Block Parameter: RndMeth

Type: character vector

Values: "Ceiling" | "Convergent" | "Floor" | "Nearest" | "Round" | "Simplest" | "Zero"

Default: "Floor"

Saturate on integer overflow — Method of overflow action

off (default) | on

Specify whether overflows saturate or wrap.

Action	Rationale	Impact on Overflows	Example
Select this check box (on).	Your model has possible overflow, and you want explicit saturation protection in the generated code.	Overflows saturate to either the minimum or maximum value that the data type can represent.	The maximum value that the int8 (signed 8-bit integer) data type can represent is 127. Any block operation result greater than this maximum value causes overflow of the 8-bit integer. With the check box selected, the block output saturates at 127. Similarly, the block output saturates at a minimum output value of –128.
Clear this check box (off).	You want to optimize the efficiency of your generated code. You want to avoid overspecifying how a block handles out-of-range signals. For more information, see Troubleshoot Signal Range Errors (Simulink).	Overflows wrap to the appropriate value that the data type can represent.	The maximum value that the int8 (signed 8-bit integer) data type can represent is 127. Any block operation result greater than this maximum value causes overflow of the 8-bit integer. With the check box cleared, the software interprets the value causing the overflow as int8, which can produce an unintended result. For example, a block result of 130 (binary 1000 0010) expressed as int8 is –126.

Programmatic Use

Block Parameter: SaturateOnIntegerOverflow

Type: character vector

Values: "off" | "on"

Default: "off"

Lock output data type setting against changes by the fixed-point tools — Prevention of fixed-point tools from overriding data type

off (default) | on

Select this parameter to prevent the fixed-point tools from overriding the data type you specify for the block. For more information, see Use Lock Output Data Type Setting (Fixed-Point Designer).

Programmatic Use

Block Parameter: LockScale

Type: character vector

Values: "off" | "on"

Default: "off"

Data Type

Score data type — Data type of score output

Inherit: auto (default) | double | single | half | int8 | uint8 | int16 | uint16 | int32 | uint32 | int64 | uint64 | fixdt(1,16,0) | fixdt(1,16,2^0,0) | <data type expression>

Specify the data type for the score output. The type can be inherited, specified directly, or expressed as a data type object such as Simulink.NumericType.

When you select Inherit: auto, the block uses a rule that inherits a data type.

For more information about data types, see Control Data Types of Signals (Simulink).

Click the Show data type assistant button to display the Data Type Assistant, which helps you set the data type attributes. For more information, see Specify Data Types Using Data Type Assistant (Simulink).

Programmatic Use

Block Parameter: ScoreDataTypeStr

Type: character vector or string

Values: "Inherit: auto" | "double" | "single" | "half" | "int8" | "uint8" | "int16" | "uint16" | "int32" | "uint32" | "int64" | "uint64" | "fixdt(1,16,0)" | "fixdt(1,16,2^0,0)" | "<data type expression>"

Default: "Inherit: auto"

Score data type Minimum — Minimum value of score output for range checking

[] (default) | scalar

Specify the lower value of the score output range that Simulink^® checks.

Simulink uses the minimum value to perform:

• Parameter range checking for some blocks (see Specify Minimum and Maximum Values for Block Parameters (Simulink)).

• Simulation range checking (see Specify Signal Ranges (Simulink) and Enable Simulation Range Checking (Simulink)).

• Optimization of the code that you generate from the model. This optimization can remove algorithmic code and affect the results of some simulation modes, such as software-in-the-loop (SIL) mode or external mode. For more information, see Optimize using the specified minimum and maximum values (Embedded Coder).

Note

The Score data type Minimum parameter does not saturate or clip the actual score output. To do so, use the Saturation (Simulink) block instead.

Programmatic Use

Block Parameter: ScoreOutMin

Type: character vector

Values: "[]" | scalar

Default: "[]"

Score data type Maximum — Maximum value of score output for range checking

[] (default) | scalar

Specify the upper value of the score output range that Simulink checks.

Simulink uses the maximum value to perform:

• Parameter range checking for some blocks (see Specify Minimum and Maximum Values for Block Parameters (Simulink)).

• Simulation range checking (see Specify Signal Ranges (Simulink) and Enable Simulation Range Checking (Simulink)).

• Optimization of the code that you generate from the model. This optimization can remove algorithmic code and affect the results of some simulation modes, such as SIL or external mode. For more information, see Optimize using the specified minimum and maximum values (Embedded Coder).

Note

The Score data type Maximum parameter does not saturate or clip the actual score output. To do so, use the Saturation (Simulink) block instead.

Programmatic Use

Block Parameter: ScoreOutMax

Type: character vector

Values: "[]" | scalar

Default: "[]"

Kernel data type — Kernel computation data type

double (default) | single | half | int8 | uint8 | int16 | uint16 | int32 | int64 | uint64 | uint32 | fixdt(1,16,0) | fixdt(1,16,2^0,0) | <data type expression>

Specify the data type of a parameter for kernel computation. The type can be specified directly or expressed as a data type object such as Simulink.NumericType.

The Kernel data type parameter specifies the data type of a different parameter depending on the type of kernel function used in the SVM model. You specify the KernelFunction name-value argument when training the SVM model.

'KernelFunction' Value	Data Type
"gaussian" or "rbf"	Kernel data type specifies the data type of the squared distance $$D^2={\Vert x-s\Vert }^2$$ for the Gaussian kernel $$G\left(x,s\right)=\exp \left(-D^2\right)$$, where x is the predictor data for an observation and s is a support vector.
"linear"	Kernel data type specifies the data type for the output of the linear kernel function $$G\left(x,s\right)=xs\text{'}$$, where x is the predictor data for an observation and s is a support vector.
"polynomial"	Kernel data type specifies the data type for the output of the polynomial kernel function $$G\left(x,s\right)={\left(1+xs\text{'}\right)}^p$$, where x is the predictor data for an observation, s is a support vector, and p is a polynomial kernel function order.

For more information about data types, see Control Data Types of Signals (Simulink).

Click the Show data type assistant button to display the Data Type Assistant, which helps you set the data type attributes. For more information, see Specify Data Types Using Data Type Assistant (Simulink).

Programmatic Use

Block Parameter: KernelDataTypeStr

Type: character vector

Values: "double" | "single" | "half" | "int8" | "uint8" | "int16" | "uint16" | "int32" | "uint32" | "uint64" | "int64" || "fixdt(1,16,0)" | "fixdt(1,16,2^0,0)" | "<data type expression>"

Default: "double"

Kernel data type Minimum — Minimum kernel computation value for range checking

[] (default) | scalar

Specify the lower value of the kernel computation internal variable range that Simulink checks.

Simulink uses the minimum value to perform:

• Parameter range checking for some blocks (see Specify Minimum and Maximum Values for Block Parameters (Simulink)).

• Simulation range checking (see Specify Signal Ranges (Simulink) and Enable Simulation Range Checking (Simulink)).

• Optimization of the code that you generate from the model. This optimization can remove algorithmic code and affect the results of some simulation modes, such as software-in-the-loop (SIL) mode or external mode. For more information, see Optimize using the specified minimum and maximum values (Embedded Coder).

Note

The Kernel data type Minimum parameter does not saturate or clip the actual kernel computation value signal.

Programmatic Use

Block Parameter: KernelOutMin

Type: character vector

Values: '[]' | scalar

Default: '[]'

Kernel data type Maximum — Maximum kernel computation value for range checking

[] (default) | scalar

Specify the upper value of the kernel computation internal variable range that Simulink checks.

Simulink uses the maximum value to perform:

• Parameter range checking for some blocks (see Specify Minimum and Maximum Values for Block Parameters (Simulink)).

• Simulation range checking (see Specify Signal Ranges (Simulink) and Enable Simulation Range Checking (Simulink)).

• Optimization of the code that you generate from the model. This optimization can remove algorithmic code and affect the results of some simulation modes, such as SIL or external mode. For more information, see Optimize using the specified minimum and maximum values (Embedded Coder).

Note

The Kernel data type Maximum parameter does not saturate or clip the actual kernel computation value signal.

Programmatic Use

Block Parameter: KernelOutMax

Type: character vector

Values: '[]' | scalar

Default: '[]'

Block Characteristics

Data Types	Boolean | double | fixed point | half | integer | single
Direct Feedthrough	yes
Multidimensional Signals	no
Variable-Size Signals	no
Zero-Crossing Detection	no

Extended Capabilities

C/C++ Code Generation
Generate C and C++ code using Simulink® Coder™.

Fixed-Point Conversion
Design and simulate fixed-point systems using Fixed-Point Designer™.

Version History

Introduced in R2026a