DBSCAN Clustering

DBSCAN builds clusters using a chaining logic based on direct density reachability.

• A point q is directly density-reachable from a core point p if q is within the ε-neighborhood of p.
• Density-reachable extends this transitively: if you can hop from core point to core point via direct reachability, the final point is reachable from the start.
• Two points are density-connected if there exists a point o from which both are density-reachable. This single rule elegantly merges overlapping dense regions into a single cluster.

This chaining mechanism allows DBSCAN to trace out the complex, non-linear shapes of a modulated signal's constellation diagram in I/Q space without assuming a spherical distribution.

Unlike K-Means, which partitions data into convex, globular clusters by minimizing distance to a centroid, DBSCAN imposes no geometric constraints on cluster shape.

• It can identify concave, elongated, and winding structures simply by following the density gradient.
• This is critical for cyclostationary analysis where signal features may trace complex paths in high-dimensional feature space.
• A frequency-hopping signal that sweeps across the spectrum band over time will form a continuous, snake-like density trail that DBSCAN can capture as a single behavioral cluster, whereas centroid-based methods would fragment it into multiple arbitrary pieces.

The performance of DBSCAN is highly dependent on the selection of ε (the neighborhood radius) and minPts (the minimum points to form a dense region).

• ε too small: Most points become noise; clusters fragment into tiny pieces.
• ε too large: Distinct clusters merge into one; noise gets absorbed into the background.
• minPts: A higher value forces stricter density requirements, filtering out more points as noise. A common heuristic is to set minPts ≥ D+1 where D is the dimensionality of the data.

A practical method for estimating ε is the k-distance graph, which plots the distance to the k-th nearest neighbor for each point in descending order. The 'elbow' in this plot indicates a natural threshold where the density drops off, providing a data-driven starting value.

DBSCAN's explicit noise classification is its defining advantage for anomaly detection. The algorithm does not force every point into a cluster.

• In a spectral kurtosis analysis, impulsive interference appears as short, high-energy bursts that are statistically distinct from Gaussian background noise. DBSCAN isolates these bursts as noise points because they lack sufficient density neighbors.
• This contrasts with algorithms like Gaussian Mixture Models (GMM), which assign a probability of membership to every point, potentially masking low-probability anomalies within a broad distribution.
• For rogue emitter identification, this means an unauthorized transmission with a unique modulation fingerprint will be flagged immediately without requiring a pre-labeled training set of attack signatures.

The standard implementation of DBSCAN has a time complexity of O(n log n) when using a spatial index like an R-tree* or k-d tree for efficient neighborhood queries.

• Without indexing, the brute-force distance calculation is O(n²), which becomes prohibitive for wideband, high-sample-rate spectrum monitoring.
• For online anomaly detection on streaming I/Q data, the standard algorithm is batch-oriented. However, incremental variants like Stream-DBSCAN exist that update clusters as new data arrives without full recomputation.
• In practice, for real-time spectrum occupancy prediction pipelines, DBSCAN is often applied to a sliding window of feature embeddings rather than raw samples to keep the dimensionality and sample count manageable.

A density-based anomaly detection algorithm that measures the local deviation of a data point's density relative to its neighbors. Unlike global methods, LOF identifies points that are outliers within their local context, making it effective for detecting low-power rogue emitters operating near legitimate high-power transmitters. It assigns an outlier score based on the ratio of the local reachability density of a point to that of its k-nearest neighbors.

An ensemble method that explicitly isolates anomalies by randomly partitioning data. The core principle: anomalous points are few and different, requiring fewer random splits to be isolated from the rest of the data. This makes it computationally efficient for high-dimensional I/Q data and effective at detecting transient interference bursts without requiring a pre-built model of normality.

A neural network trained to reconstruct normal spectrum data through a bottleneck layer. The core assumption: the model learns the latent manifold of legitimate signals and will exhibit a high reconstruction error when attempting to reconstruct anomalous inputs. This method excels at detecting subtle waveform deviations that violate the learned structure of authorized transmissions.

A support vector machine algorithm that learns a decision boundary around normal signal features in a high-dimensional kernel space. It maps training data to a feature space and finds the maximal margin hyperplane separating the data from the origin. New points falling outside this boundary are classified as anomalies, making it robust for open-set recognition of unknown signal types.

A statistical measure of the peakedness of a signal's power spectral density. It quantifies the non-Gaussianity of a signal by measuring the fourth-order cumulant. High spectral kurtosis values indicate the presence of impulsive noise, intermittent interference, or non-communication signals that deviate from the Gaussian distribution typical of thermal noise and standard modulated carriers.

A technique exploiting the periodic statistical properties of modulated signals. Most communication signals exhibit cyclostationarity due to carrier frequencies, symbol rates, and guard intervals. Anomalies invisible to standard power spectral density analysis—such as a covert LPI signal mimicking noise—can be detected by analyzing the cyclic autocorrelation function for unexpected periodicities.