$D=\{(x_i):i=1,\dots,n\}$. Hence, problems in this paradigm are concerned with identifying aspects of the joint distribution of observed features rather than predicting a target label. Common techniques include clustering, principal component analysis (PCA), and matrix completion.

In clustering, the data set $D$ is partitioned into a collection $S$ of subsets such that each subset of $S$ contains feature vectors that are close to each other based on a chosen metric or distance. Examples of clustering are the k-means clustering and the Gaussian mixture model. Challenges with this method is determining the numbers of clusters and which clusters are indicative of malicious behavior.

In principal component analysis, the feature vectors $x_i$ of the data set $D$ form the rows of a matrix $A$ of dimension say $m$. The task becomes to find a collection of orthonormal basis vectors of $A$ of size $k<m$. These vectors are the eigenvectors of the matrix $A$ and they correspond to the columns of a basis matrix $B$. Then any feature vector $x_i$ can be reconstructed as $x_i'=VV^Tx_i$, where $T$ denotes the transpose of a matrix. The error can be calculated: $$Error_i=x_i-x_i'=(I-VV^T)x_i,$$ where $I$ is the $m \times m$ identity matrix, and the goal is eventually to 