Gaussian Mixture Model (GMM)

A GMM models the probability density of normal RF data as a weighted sum of K Gaussian components. Each component represents a cluster of similar signal characteristics (e.g., a specific modulation type at a certain power level). The model learns the mean vector, covariance matrix, and mixing coefficient for each component using the Expectation-Maximization (EM) algorithm. New samples are scored by their likelihood under this learned density; low-probability samples are flagged as anomalies. This provides a soft, probabilistic boundary rather than a hard threshold, which is ideal for the noisy, overlapping nature of spectrum data.

Unlike a single Gaussian, a GMM naturally captures the multi-modal nature of the RF spectrum. A monitored band may contain several distinct but normal signal types simultaneously—such as a narrowband control channel, a wideband data burst, and a continuous wave tone. A GMM assigns a separate Gaussian component to each mode, creating a composite model of the entire 'normal' environment. This prevents the model from flagging a legitimate, frequently occurring signal type as anomalous simply because it differs from the average of all signals.

GMMs are trained using the Expectation-Maximization (EM) algorithm, an iterative two-step process:

• E-Step (Expectation): Calculate the probability that each data point belongs to each Gaussian component, given the current parameters.
• M-Step (Maximization): Update the mean, covariance, and mixing weight of each component to maximize the likelihood of the data, given these probabilities. This process repeats until convergence, guaranteeing a local maximum of the likelihood function. The number of components K is a critical hyperparameter, often selected using the Bayesian Information Criterion (BIC) or Akaike Information Criterion (AIC).

Once trained, a GMM scores new I/Q samples or feature vectors by computing their log-likelihood under the model. The log-likelihood quantifies how well the new data point fits the learned distribution of normality.

• High log-likelihood: The sample is similar to the training data and is considered normal.
• Low log-likelihood: The sample falls in a low-density region of the model and is flagged as a potential anomaly. A threshold on this score is set empirically, often based on a percentile of the training data's likelihood distribution. This direct probabilistic interpretation is a key advantage over distance-based methods.

GMMs perform soft clustering, meaning a single data point is not assigned exclusively to one cluster. Instead, the model calculates a responsibility—the posterior probability that a specific Gaussian component generated that point. For anomaly analysis, this is highly informative. An anomalous signal might have low overall likelihood but also a diffuse responsibility vector (it doesn't clearly belong to any single component), while a normal signal will have a high responsibility for one specific component. This provides granular diagnostic information for spectrum analysts.

The covariance matrix of each Gaussian component defines its shape, volume, and orientation. GMMs offer several covariance constraints to balance model complexity with available data:

• Full: Each component has its own unconstrained covariance matrix. Most flexible, but has many parameters.
• Tied: All components share the same covariance matrix. Reduces parameters, assumes similar shapes.
• Diagonal: Covariance matrices are diagonal, assuming feature independence. Computationally efficient.
• Spherical: A single variance per component, resulting in circular clusters. For high-dimensional RF feature vectors, a diagonal or tied constraint is often preferred to prevent overfitting.