An Efficient One-Class SVM for Anomaly Detection in the Internet of
  Things
  Insecure Internet of things (IoT) devices pose significant threats to
critical infrastructure and the Internet at large; detecting anomalous behavior
from these devices remains of critical importance, but fast, efficient,
accurate anomaly detection (also called "novelty detection") for these classes
of devices remains elusive. One-Class Support Vector Machines (OCSVM) are one
of the state-of-the-art approaches for novelty detection (or anomaly detection)
in machine learning, due to their flexibility in fitting complex nonlinear
boundaries between {normal} and {novel} data. IoT devices in smart homes and
cities and connected building infrastructure present a compelling use case for
novelty detection with OCSVM due to the variety of devices, traffic patterns,
and types of anomalies that can manifest in such environments. Much previous
research has thus applied OCSVM to novelty detection for IoT. Unfortunately,
conventional OCSVMs introduce significant memory requirements and are
computationally expensive at prediction time as the size of the train set
grows, requiring space and time that scales with the number of training points.
These memory and computational constraints can be prohibitive in practical,
real-world deployments, where large training sets are typically needed to
develop accurate models when fitting complex decision boundaries. In this work,
we extend so-called Nystr\"om and (Gaussian) Sketching approaches to OCSVM, by
combining these methods with clustering and Gaussian mixture models to achieve
significant speedups in prediction time and space in various IoT settings,
without sacrificing detection accuracy.
