# Robust PCA for Anomaly Detection in Cyber Networks

arXiv: https://arxiv.org/abs/1801.01571 · HTML: https://mlsanity.com/paper/1801.01571/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Jan 2018.

## Built on by (most cited first, 15 of 15)

- [Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals](https://mlsanity.com/paper/2107.12626/) (2021)
- [mTSBench: Benchmarking Multivariate Time Series Anomaly Detection and Model Selection at Scale](https://mlsanity.com/paper/2506.21550/) (2025)
- [PaAno: Patch-Based Representation Learning for Time-Series Anomaly Detection](https://mlsanity.com/paper/2602.01359/) (2026)
- [xLSTMAD: A Powerful xLSTM-based Method for Anomaly Detection](https://mlsanity.com/paper/2506.22837/) (2025)
- [Matrix Profile for Anomaly Detection on Multidimensional Time Series](https://mlsanity.com/paper/2409.09298/) (2024)
- [Forecast2Anomaly (F2A): Adapting Multivariate Time Series Foundation Models for Anomaly Prediction](https://mlsanity.com/paper/2511.03149/) (2025)
- [SLA2P: Self-supervised Anomaly Detection with Adversarial Perturbation](https://mlsanity.com/paper/2111.12896/) (2021)
- [Try with Simpler -- An Evaluation of Improved Principal Component Analysis in Log-based Anomaly Detection](https://mlsanity.com/paper/2308.12612/) (2023)
- [Accurate and fast anomaly detection in industrial processes and IoT environments](https://mlsanity.com/paper/2404.17925/) (2024)
- [Adaptive Anomaly Detection in Network Flows with Low-Rank Tensor Decompositions and Deep Unrolling](https://mlsanity.com/paper/2409.11529/) (2024)
- [ARTA: Adversarial-Robust Multivariate Time--Series Anomaly Detection via Sparsity-Constrained Perturbations](https://mlsanity.com/paper/2603.25956/) (2026)
- [Anomaly Detection for Electro-Hydrostatic Actuators using LSTM Autoencoder](https://mlsanity.com/paper/2606.05274/) (2026)
- [CAST: Context- and Anomaly Structure-Conditioned Time Series Anomaly Generation](https://mlsanity.com/paper/2609.27825/) (2026)
- [In a Streaming World, Should You Stand Still? A Comprehensive Benchmark of Anomaly Detection in Streams](https://mlsanity.com/paper/2609.39215/) (2026)
- [Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability](https://mlsanity.com/paper/2610.01168/) (2026)

## Abstract (arXiv)

This paper uses network packet capture data to demonstrate how Robust Principal Component Analysis (RPCA) can be used in a new way to detect anomalies which serve as cyber-network attack indicators. The approach requires only a few parameters to be learned using partitioned training data and shows promise of ameliorating the need for an exhaustive set of examples of different types of network attacks. For Lincoln Lab's DARPA intrusion detection data set, the method achieves low false-positive rates while maintaining reasonable true-positive rates on individual packets. In addition, the method correctly detected packet streams in which an attack which was not previously encountered, or trained on, appears.