# An Efficient One-Class SVM for Anomaly Detection in the Internet of Things

arXiv: https://arxiv.org/abs/2104.11146 · HTML: https://mlsanity.com/paper/2104.11146/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 33 references that are in the map.
- First posted on arXiv 22 Apr 2021.

## Builds on (most cited first, 6 of 6)

- [Less is More: Nystr"om Computational Regularization](https://mlsanity.com/paper/1507.04717/) (2015)
- [Randomized sketches for kernels: Fast and optimal non-parametric regression](https://mlsanity.com/paper/1501.06195/) (2015)
- [Machine learning for Internet of Things data analysis: A survey](https://mlsanity.com/paper/1802.06305/) (2018)
- [Quickshift++: Provably Good Initializations for Sample-Based Mean Shift](https://mlsanity.com/paper/1805.07909/) (2018)
- [Statistical and Computational Trade-Offs in Kernel K-Means](https://mlsanity.com/paper/1908.10284/) (2019)
- [Gaussian Sketching yields a J-L Lemma in RKHS](https://mlsanity.com/paper/1908.05818/) (2019)

## Built on by (most cited first, 3 of 3)

- [Time-RA: Towards Time Series Reasoning for Anomaly Diagnosis with LLM Feedback](https://mlsanity.com/paper/2507.15066/) (2025)
- [Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats](https://mlsanity.com/paper/2204.03433/) (2022)
- [Real-Time Machine Learning for Embedded Anomaly Detection](https://mlsanity.com/paper/2512.19383/) (2025)

## Abstract (arXiv)

Insecure Internet of things (IoT) devices pose significant threats to critical infrastructure and the Internet at large; detecting anomalous behavior from these devices remains of critical importance, but fast, efficient, accurate anomaly detection (also called "novelty detection") for these classes of devices remains elusive. One-Class Support Vector Machines (OCSVM) are one of the state-of-the-art approaches for novelty detection (or anomaly detection) in machine learning, due to their flexibility in fitting complex nonlinear boundaries between normal and novel data. IoT devices in smart homes and cities and connected building infrastructure present a compelling use case for novelty detection with OCSVM due to the variety of devices, traffic patterns, and types of anomalies that can manifest in such environments. Much previous research has thus applied OCSVM to novelty detection for IoT. Unfortunately, conventional OCSVMs introduce significant memory requirements and are computationally expensive at prediction time as the size of the train set grows, requiring space and time that scales with the number of training points. These memory and computational constraints can be prohibitive in practical, real-world deployments, where large training sets are typically needed to develop accurate models when fitting complex decision boundaries. In this work, we extend so-called Nystr"om and (Gaussian) Sketching approaches to OCSVM, by combining these methods with clustering and Gaussian mixture models to achieve significant speedups in prediction time and space in various IoT settings, without sacrificing detection accuracy.