====SVM-Based Anomaly Detectors====

Our more advanced //Generative AI// anomaly detectors don't work for every application - in some cases, the problem is actually too **simple** for gen-AI to be effective.

For these situations, we offer anomaly detection using **support vector machines**.

===What Are They===

SVMs are simple AI models that are //extremely// fast to train and run. They are used mainly to detect outliers in data, which means they're ideally suited to identifying abnormal values.

The only major draw-back with support vector machines is how simple their output is. SVMs simply give a //score// showing you how 'common' the current asset state is. There's no asking //why// its flagging an anomaly - it just tells you that there **is** one.

===Setting a Threshold===

To be used as an anomaly detector, your SVM needs a //threshold//. This is a score that is used to tell the difference between a good value and an anomalous one.

The system will automatically pick a value that it things might be accurate, but you may choose to tune it (ie. by reducing or increasing it slightly) if you find that you're getting false positives. 

**Increasing** the value will make your model //more// sensitive, meaning you'll see more anomalies being detected. **Decreasing** the value will make the system accept more variation in value, reducing the number of detections.

This is done the same way it's done in generative AIs - by pressing the **Thresholds** button and choosing new values.

//NOTE: There's no such thing as a universal threshold value - each unique asset will also have a unique numeric range for its scores, with more training often meaning higher scores. Two assets that look very similar might have wildly different score ranges for their Support Vector Machines.//

===Disadvantages===

SVMs are less likely to handle complex interactions and major differences in system state. In many cases, it's often better **not** to train SVMs on times when your system is stopped.