# One-Class LSTM Network for Anomalous Network Traffic Detection
## 2 Background and Related Work
### One-Class Classification  
One-class classification refers to the classification learning model that only provides samples belonging to a certain class [14]. In contrast with the task of multiclass classification, which learns distinguishing features by comparing multiple samples of different classes, the key problem of one-class classification is how to effectively capture features related to a single class [15]. The one-class classification problem is described below. For a given training sample \(x\) from class \(A\), the purpose is to learn the scoring function \(f(x):x\to R\). In \(R\), a higher value indicates that the sample \(x\) is more likely to belong to class \(A\). Therefore, for the test sample \(x^{\prime}\), its score \(f(x^{\prime})\) can be calculated and evaluated to determine whether it belongs to class \(A\). In the one-class classification task, there are sufficient samples belonging to the target category and very few outliers; that is, the negative category sample portion is not available or not present. This property of the given dataset makes decision boundary detection a complex and challenging task [16].  
There has been much work performed on one-class classification, usually focusing on feature fitting or feature mapping. Among them, the OC-SVM [6] is a one-class unsupervised approach that is widely used in document classification, disease diagnosis, fraud detection, etc. Intuitively, in OC-SVM, all data points are treated as instances with positive  
Figure 1: An example of two-dimensional data anomaly detection.  
labels, whereas the origin is treated as the only instance with negative labels, as shown in Figure 2a. Its main idea is to train a model (hyperplane) to achieve the maximum possible separation between the target data and coordinate origin, that is  
\[\begin{array}{l}\min\limits_{\mathbf{\omega},\rho}\frac{1}{2}\|\mathbf{\omega}\|^{2}+ \frac{1}{\vartheta N}\sum\limits_{i=1}^{N}\zeta_{i}-\rho\\ s.t.\ (\mathbf{\omega}\cdot\phi(\mathbf{x}_{i}))\geq\rho-\xi_{i},\ \xi_{i}\geq 0\end{array} \tag{1}\]  
where \(\mathbf{\omega}\) is the weight of the support vector, \(\rho\) is the distance between the hyperplane and the origin of the coordinates, and \(v\in(0,\ 1]\) is used to control the trade-off between the maximum distance from the origin to the hyperplane and the number of data points allowed to cross the hyperplane. Training data \(\mathbf{x}_{n}\in\mathbf{X},i=1,2,\ldots,N\) are mapped to a high-dimensional feature space by the kernel function \(\phi(\cdot)\), and their distance from the classified hyperplane is \(\zeta_{i}/\|\mathbf{\omega}\|\). The decision function in the feature space is similar to the second-class SVM and is described by  
\[f(\mathbf{x}_{i})=\text{sgn}[\mathbf{\omega}\cdot\phi(\mathbf{x}_{i})-\rho] \tag{2}\]  
and most of the training set lies in the region \(f(\mathbf{x})>0\).  
However, the performance of the OC-SVM on complex, high-dimensional datasets is not optimal. Based on the OC-SVM, the support vector data description (SVDD) [7] method was proposed to map an original image to a hypersphere instead of a hyperplane, as shown in Figure 2b. The primal problem in SVDD is  
\[\begin{array}{l}\min\limits_{R,\xi}\ R^{2}+\frac{1}{\vartheta N}\sum\limits _{i=1}^{N}\zeta_{i}\\ s.t.\ \|\phi(\mathbf{x}_{i})-\mathbf{a}\|^{2}\leq R^{2}+\xi_{i},\ \xi_{i}\geq 0\end{array} \tag{3}\]  
where a is the hypersphere center and \(R\) is the hypersphere radius. Again, slack variables \(\xi_{i}\geq 0\) allow for a soft boundary, and a hyperparameter \(v\in(0,\ 1]\) controls the trade-off between the penalties \(\xi_{i}\) and the volume of the sphere. The OC-SVM and SVDD are closely related and are still limited to complex datasets. These kernel-based approaches often fail in high-dimensional, data-rich scenarios due to their poor computational scalability and the curse of dimensionality.