[graycat]

Consider:

"A Real-Time System-Adapted Anomaly Detector", 'Information Sciences', volume 115, April, 1999, pages 221-259.

It's a distribution-free statistical hypothesis test for multidimensional data. False alarm rate can be adjusted in small steps over a wide range and, then, is achieved exactly.

It has nothing to do with any Gaussian distribution (is distribution-free), principal components analysis, singular value decomposition, etc.

[beejiu]

But it doesn't come with an open source implementation.

[graycat]

How to implement it efficiently is an issue!

If you can figure it out, publish it!

Else when I get time, I will!