Adaptive Anomaly Detection with Kernel Eigenspace Splitting and Merging

Abstract

Kernel principal component analysis and the reconstruction error is an effective anomaly detection technique for non-linear data sets. In an environment where a phenomenon is generating data that is non-stationary, anomaly detection requires a recomputation of the kernel eigenspace in order to represent the current data distribution. Recomputation is a computationally complex operation and reducing computational complexity is therefore a key challenge. In this paper, we propose an algorithm that is able to accurately remove data from a kernel eigenspace without performing a batch recomputation. Coupled with a kernel eigenspace update, we demonstrate that our technique is able to remove and add data to a kernel eigenspace more accurately than existing techniques. An adaptive version determines an appropriately sized sliding window of data and when a model update is necessary. Experimental evaluations on both synthetic and real-world data sets demonstrate the superior performance of the proposed approach in comparison to alternative incremental KPCA approaches and alternative anomaly detection techniques.