Problematic Projection to the In-Sample Subspace for a Kernelized Anomaly Detector

Abstract

We examine the properties and performance of kernelized anomaly detectors, with an emphasis on the Mahalanobis-distance-based kernel RX (KRX) algorithm. Although the detector generally performs well for high-bandwidth Gaussian kernels, it exhibits problematic (in some cases, catastrophic) performance for distances that are large compared to the bandwidth. By comparing KRX to two other anomaly detectors, we can trace the problem to a projection in feature space, which arises when a pseudoinverse is used on the covariance matrix in that feature space. We show that a regularized variant of KRX overcomes this difficulty and achieves superior performance over a wide range of bandwidths.