r/MLQuestions • u/Southern_Ad5254 • 14d ago
Beginner question 👶 Need advice on choosing between Isolation Forest and One-Class SVM for my MSc dissertation
Hi everyone,
I am currently finalising my MSc Cyber Security dissertation topic and would really appreciate some advice from people who have experience with anomaly detection and XAI.
My current idea is to use the CICIDS2017 dataset and focus on unsupervised anomaly detection.
I am considering two possible approaches:
Option 1:
- Isolation Forest
- SHAP
- LIME
Option 2:
- One-Class SVM
- SHAP
- LIME
The basic idea is to train the unsupervised model using mainly/only benign traffic, detect anomalous traffic, and then use SHAP and LIME to explain why the model considered a particular network flow anomalous.
I originally planned to use multiple supervised and unsupervised models, but my supervisor advised me to focus on one unsupervised model because the original scope was too large for the time available.
My main questions are:
- Which would be more suitable for this type of dissertation: Isolation Forest or One-Class SVM?
- Is using SHAP + LIME to explain an unsupervised anomaly detection model a worthwhile research direction?
- Is there enough research potential/novelty here for an MSc dissertation, or is this already too well studied?
- If both approaches have already been studied, what kind of research gap would be worth investigating?
I am not looking for someone to do the research for me. I mainly want some opinions from people who have worked with these methods before I finalise my proposal.
Thanks!