Anomaly detection using RPCA and ICA

A computing device comprising:

• a processor;
• and
• a non-transitory computer-readable medium operably coupled to the processor, the computer-readable medium having computer-readable instructions stored thereon that, when executed by the processor, cause the computing device to
• train a machine learning model by
• executing a robust principal components algorithm with a plurality of training observation vectors to compute a low-rank matrix;
• decomposing the low-rank matrix;
• determining a rank of the low-rank matrix;
• determining an orthogonal complement matrix using the decomposed low-rank matrix and the determined rank;
• projecting each observation vector of the plurality of training observation vectors using the determined orthogonal complement matrix;
• and
• executing an independent component analysis algorithm with the projected plurality of training observation vectors to define a demixing matrix;
• and
• apply the trained machine learning model by
• projecting an observation vector using the determined orthogonal complement matrix;
• multiplying the projected observation vector by the defined demixing matrix to define a demixed observation vector;
• computing a detection statistic value from the defined, demixed observation vector;
• and
• when the computed detection statistic value is greater than or equal to a predefined anomaly threshold value, outputting an indicator that the observation vector is an anomaly.

A method of identifying an anomaly among a plurality of observation vectors, the method comprising:

• training, by a computing device, a machine learning model by
• executing a robust principal components algorithm with a plurality of training observation vectors to compute a low-rank matrix;
• decomposing the low-rank matrix;
• determining a rank of the low-rank matrix;
• determining an orthogonal complement matrix using the decomposed low-rank matrix and the determined rank;
• projecting each observation vector of the plurality of training observation vectors using the determined orthogonal complement matrix;
• and
• executing an independent component analysis algorithm with the projected plurality of training observation vectors to define a demixing matrix;
• and
• applying, by the computing device, the trained machine learning model by
• projecting, by the computing device, an observation vector using the determined orthogonal complement matrix;
• multiplying, by the computing device, the projected observation vector by the defined demixing matrix to define a demixed observation vector;
• computing, by the computing device, a detection statistic value from the defined, demixed observation vector;
• and
• when the computed detection statistic value is greater than or equal to a predefined anomaly threshold value, outputting, by the computing device, an indicator that the observation vector is an anomaly.