Unsupervised learning

Unsupervised learning estimates properties of the input distribution P(X) alone, with no target variable. The main task families are clustering (k-means, hierarchical clustering, DBSCAN, Gaussian mixture models fitted with the EM algorithm), dimensionality reduction (principal component analysis, which projects data onto the directions of greatest variance; t-SNE (van der Maaten and Hinton, 2008) and UMAP (McInnes et al., 2018) for non-linear visualisation), density estimation (kernel density estimates, mixture models, normalising flows) and association rule mining (the Apriori algorithm for market-basket analysis).

Anomaly detection is the most common security use and is what behavioural analytics products (UEBA) typically build on. Methods include isolation forests (Liu, Ting and Zhou, 2008), which isolate points by random splits and score outliers by how few splits they need; one-class SVMs; local outlier factor; and autoencoders, which learn to reconstruct normal data and flag inputs with high reconstruction error. All of these model "normal" from historical data, so an attacker who was already present during the baseline period becomes part of normal, and legitimate change (a new VPN provider, a reorganisation) produces bursts of false positives.

Evaluation is the central difficulty. Without labels there is no ground truth to score against, so practitioners use internal criteria (silhouette score, Davies-Bouldin index, reconstruction error, log-likelihood on held-out data) that measure geometric or statistical fit rather than usefulness. In anomaly detection, a small labelled set of known incidents is often assembled after the fact purely for evaluation. Results are sensitive to feature scaling, distance metric and hyperparameters such as the number of clusters or the contamination rate, and in high dimensions distances concentrate so that nearest and farthest neighbours become hard to distinguish.

The boundary with self-supervised learning is often blurred. Autoencoders and language-model pretraining both learn from unlabelled data, but self-supervised methods construct an explicit prediction target from the data and train with a supervised-style loss, which is why they are now usually treated as a separate category. Unsupervised methods also serve as preprocessing for supervised ones: PCA or learned embeddings reduce dimensionality, and cluster assignments can become features.

In a governance context, unsupervised output is a hypothesis, not a finding. Clusters and anomaly scores need human interpretation before they drive decisions about people, and profiling built on them can still fall under GDPR rules on profiling and automated decision-making (Article 22) when it produces legal or similarly significant effects.