Local Outlier Factor (LOF)

LOF computes an anomaly score by comparing the local reachability density (LRD) of a point to the LRDs of its k-nearest neighbors. A point is flagged as an outlier if its local density is significantly lower than that of its neighbors.

• Score ≈ 1: Point has similar density to neighbors (inlier)
• Score > 1: Point has lower density than neighbors (potential outlier)
• Score >> 1: Strong outlier signal, useful for unknown emitter rejection

The algorithm's reliance on local rather than global density thresholds enables it to detect anomalies within heterogeneous signal environments where legitimate transmitters may naturally form clusters of varying compactness.

The core geometric primitive of LOF is the reachability distance, which smooths statistical fluctuations by replacing direct Euclidean distances with a maximum of the k-distance of the neighbor and the actual distance between points.

• k-distance: The distance from a point to its k-th nearest neighbor
• Reachability distance: max(k-distance of neighbor, actual distance between points)
• This formulation reduces the influence of statistical fluctuations for points within dense neighborhoods

This smoothing property is critical for RF fingerprinting applications where measurement noise and channel effects can introduce variance in feature embeddings, ensuring that minor perturbations do not trigger false anomaly flags.

The choice of k (minimum points) defines the granularity of local density estimation and directly impacts detection performance. The parameter establishes the minimum neighborhood size for density calculations.

• Low k values: Sensitive to local outliers, may flag small clusters as anomalous
• High k values: Identifies only global outliers, may miss subtle device impersonation attempts
• Practical guidance: Set k between 10 and 50 for typical emitter recognition tasks, with the lower bound exceeding the minimum cluster size of legitimate devices

In open set emitter recognition, k should be tuned based on the expected minimum number of transmissions from a legitimate device during the enrollment window, ensuring that sparse but valid transmitters are not incorrectly rejected.

LOF exhibits O(n²) complexity for naive implementations due to pairwise distance calculations across all n data points, making it challenging for real-time spectrum monitoring at scale.

• Brute force: O(n²) distance computations, impractical for large emitter databases
• Spatial indexing: KD-trees or ball trees reduce average complexity to O(n log n)
• Approximate methods: Locality-sensitive hashing (LSH) enables sub-linear queries for streaming RF data

For edge deployment in cognitive radio systems, optimized implementations using incremental LOF variants can update anomaly scores without full recomputation, enabling continuous monitoring of the electromagnetic environment for unknown transmitters.

LOF fundamentally differs from global distance-based and statistical anomaly detection approaches by adapting to local density variations within the feature space.

• vs. Mahalanobis Distance: LOF does not assume a unimodal Gaussian distribution, making it robust to the multi-modal feature distributions common in heterogeneous emitter populations
• vs. Isolation Forest: LOF provides a continuous anomaly score with local context, while Isolation Forest uses random partitioning that may miss subtle density-based anomalies
• vs. One-Class SVM: LOF requires no kernel selection and naturally handles clusters of varying density without hyperparameter tuning for bandwidth

This local adaptability makes LOF the preferred baseline for open set emitter recognition when transmitter populations exhibit natural density variations due to hardware manufacturer clustering.

The identification of new patterns that deviate from a previously established notion of normality. Unlike outlier detection, novelty detection trains solely on normal data and treats any deviation as novel.

• Semi-supervised paradigm: The training set is assumed to be clean and uncontaminated by anomalies
• Core assumption: Novel inputs reside in low-density regions of the training distribution
• LOF distinction: LOF is unsupervised and detects local outliers within a contaminated dataset; novelty detection rejects anything outside a global boundary

The task of identifying input samples that differ semantically and statistically from the training distribution, triggering a rejection mechanism in deployed models.

• Deep learning focus: Often uses softmax confidence scores, energy scores, or Mahalanobis distance in feature space
• Open set link: OOD detection is the binary classification gate that enables open set recognition
• LOF integration: LOF can serve as a post-hoc OOD detector by computing local density scores on learned feature embeddings rather than raw inputs

An ensemble-based anomaly detection algorithm that isolates observations by randomly selecting a feature and split value, exploiting the fact that anomalies are easier to isolate.

• Mechanism: Builds an ensemble of random trees; the average path length to isolate a point serves as the anomaly score
• Computational advantage: Linear time complexity with low memory footprint, making it suitable for high-dimensional streaming RF data
• LOF comparison: Isolation Forest identifies global outliers efficiently but may miss local outliers in clusters of varying density where LOF excels

A support vector algorithm that learns a decision boundary surrounding normal training data in a high-dimensional kernel space to isolate outliers.

• Kernel trick: Uses RBF or polynomial kernels to capture complex, non-linear boundaries around the normal class
• Parameter sensitivity: The nu parameter controls the upper bound on the fraction of training errors and the lower bound on the fraction of support vectors
• LOF synergy: One-Class SVM defines a global boundary; combining it with LOF's local density analysis provides layered defense against both global and local anomalies in emitter fingerprints

Deep Support Vector Data Description trains a neural network to map normal data into a minimal-volume hypersphere, treating points outside the boundary as anomalies.

• End-to-end learning: Jointly learns feature representations and the enclosing hypersphere in a single optimization
• One-class objective: Minimizes the volume of the hypersphere while penalizing points that fall outside its center
• Extension: Deep SAD leverages a small amount of labeled anomaly data to refine the boundary, bridging unsupervised and semi-supervised paradigms

Area Under the Receiver Operating Characteristic curve is the threshold-independent metric for evaluating binary classifiers distinguishing knowns from unknowns.

• Interpretation: AUROC of 1.0 indicates perfect separation; 0.5 indicates random guessing
• Open set protocol: Measures the trade-off between true positive rate (correctly identifying known emitters) and false positive rate (incorrectly accepting unknown emitters)
• Complementary metrics: Often paired with Openness Measure to standardize evaluation difficulty across datasets with varying proportions of unknown classes