How to Detect Anomalies with One-Class SVM in Oracle

Anomaly detection finds rows that do not fit the pattern of the rest, without labeled examples of what is wrong. In Oracle Machine Learning, a support vector machine trained as a classification model without a target becomes a one-class model: it learns what normal looks like and scores how unusual each row is.

Code for This Guide

The main examples are in the examples/machine-learning folder of the Oracle Database 26ai code repository on GitHub, each with its output. They use NIMBUS, the sample schema of a fictional airline, which you can install with the scripts in the setup/nimbus folder.

They come from Oracle Database 26ai SQL and PL/SQL Book.

Syntax

v_settings('ALGO_NAME') := 'ALGO_SUPPORT_VECTOR_MACHINES';
dbms_data_mining.create_model2(model, 'CLASSIFICATION', data_query, v_settings,
                               case_id_column, null);      -- no target column

prediction(model using *)                       -- 1 normal, 0 anomaly
prediction_probability(model, 0 using *)        -- how likely an anomaly

The example uses the ML_TICKETS view from How to Explain Predictions with PREDICTION_DETAILS in Oracle.

Find Unusual Bookings

Example:

declare
  v_settings dbms_data_mining.setting_list;
begin
  v_settings('ALGO_NAME') := 'ALGO_SUPPORT_VECTOR_MACHINES';
  v_settings('PREP_AUTO') := 'ON';
  dbms_data_mining.create_model2('ODD_BOOKINGS', 'CLASSIFICATION',
    'select ticket_id, days_ahead, distance_km, points, legs from ml_tickets',
    v_settings, 'TICKET_ID', null);          -- no target: a one-class model
end;
/
select ticket_id, days_ahead, distance_km, points,
       round(prediction_probability(odd_bookings, 0 using *), 3) as p_anomaly
from   ml_tickets
order  by prediction_probability(odd_bookings, 0 using *) desc
fetch  first 4 rows only;

Output:

PL/SQL procedure successfully completed.

   TICKET_ID    DAYS_AHEAD    DISTANCE_KM    POINTS    P_ANOMALY
____________ _____________ ______________ _________ ____________
         621            13           2183    222444        0.607
         995             4           1926    156380        0.576
         809            18           2183    223601        0.573
         934             1           5239    222444        0.568

The model learns from days booked ahead, distance, loyalty points, and legs. The most unusual tickets belong to travellers with over 150,000 points, far above the rest, some booked only a few days ahead. Each comes with its probability of being an anomaly.

Things to Know

• Anomalies are unusual, not necessarily wrong: review the top-scored rows before acting on them.
• The setting SVMS_OUTLIER_RATE sets the expected share of anomalies, which moves the 0 and 1 boundary.
• Drop the model with DBMS_DATA_MINING.DROP_MODEL('ODD_BOOKINGS') when done.

Related Guides

• AI for Anomaly Detection in Database: A Technical Guide
• How to Extract Features with FEATURE_ID in Oracle

Conclusion

A support vector machine trained without a target is a one-class model that scores how unusual each row is. Rank rows by PREDICTION_PROBABILITY for class 0 to review the most unusual ones first.