## 1 Introduction
It delineates a \"simple\" subset of the input space through functions expressed in terms of kernel expansions and controls the length of the weight vector in feature space through regularization, ensuring that the probability of test points drawn from the underlying probability distribution falling outside this subset is predetermined. This method is a natural extension of the Support Vector Machine (SVM) for cases with unlabeled data, efficiently optimizing the constrained minimization problem using the Sequential Minimal Optimization (SMO) algorithm. [PERSON] et al. [12] proposed an unsupervised algorithm based on Gaussian Process Regression and OC-SVM for detecting network attacks in microgrids. This method specifically targets false data injection (FDI) attacks, which manipulate the frequency of distributed generator (DG) inverters to affect microgrid stability. By combining a Gaussian process model to predict DG frequency, and using the prediction error and estimated variance as inputs to the OC-SVM, the accuracy of attack detection was improved. This algorithm does not rely on pre-labeled anomalous data, making it suitable for detecting unknown and unpredictable network attacks. [PERSON] et al. [13] introduced Support Vector Data Description (SVDD), a method inspired by Support Vector Classifiers, for data domain description. SVDD is capable of providing a spherical boundary for datasets and increasing flexibility by using other kernel functions while leveraging negative examples to tighten the description and enhance the detection of outliers and anomalies. This method has played an important role in unsupervised or semi-supervised learning. [PERSON] et al. [14] proposed an integrated approach combining statistical analysis, clustering techniques, and outlier detection methods for identifying data anomalies in operational measurements. This method demonstrates excellent performance in terms of detection accuracy and Precision while being less reliant on hyperparameter tuning. [PERSON] et al. [15] proposed a data-driven photovoltaic (PV) system state monitoring technique. Using voltage sensors and current sensors for each PV string, they modeled the DC power of PV generators through Gaussian Process Regression (GPR) for nonlinear approximation and calculated the residuals to detect faults. The residuals were processed using an exponentially weighted moving average filter, and fault detection was performedusing Kernel Density Estimation (KDE), with fault diagnosis completed through univariate residual analysis. Although these algorithms demonstrate strong capabilities in identifying local or global characteristics of data, they often struggle to capture temporal correlations when handling time-series data. Additionally, they tend to be sensitive to hyperparameters and have limited ability to process noisy or multi-dimensional data, restricting their direct application in dynamic environments. In recent years, with the increasing power of deep learning in representation learning, neural network-based models have made significant progress in anomaly detection accuracy and generalization performance. Specifically, [PERSON] et al. [16] proposed a Stochastic Recurrent Neural Network (OmniAnomaly) for multivariate time-series anomaly detection. This model learns robust representations of time series through a Stochastic Recurrent Neural Network (SRNN), then reconstructs the input data using these representations, and determines anomalies based on the reconstruction probability. [PERSON] et al. [17] introduced a Time Hierarchical One-Class Network (THOC), a time-series anomaly detection model based on one-class classification. It captures temporal dynamics at different scales using a Dilated Recurrent Neural Network (Dilated RNN) with skip connections and defines multi-scale vector data descriptions through hyper-spheres obtained from hierarchical clustering, improving the model's ability to capture time dynamics.