## 2 Methods  
### Anomaly Detection Based on Recursive Density Estimation (RDE)  
RDE is based on the data density, computed recursively as new data become available, used to identify in real time if new data samples differ from previous ones. Data density can be defined as the inverse of the sum of the total distances between all of the data points. It is a measure of the closeness on the n-dimensional feature space of a data sample to all previous data samples at a given time instant. The global data density of the sample \(x_{K}\) available at current time instant K can be defined as a Cauchy-type function, that for the Euclidean distance type can be expressed, as follows:  
\[D(x_{K})=\frac{1}{1+\frac{1}{K}\sum_{i=1}^{K}||x_{K}-x_{i}||^{2}} \tag{1}\]  
This kind of representation allows for an easier recursive calculation, whose formulation can be exactly derived (not in an approximate way) from Equation (1):  
\[D(x_{K})=\frac{1}{1+||x_{K}-\mu_{k}||^{2}+\Sigma_{k}-||\mu_{k}||^{2}} \tag{2}\]  
where \(\mu_{k}\) and \(\Sigma_{k}\) represent the global mean and the scalar product of data sample \(x_{K}\), respectively, at time instant k, which can be calculated recursively, as follows:  
\[\mu_{K}=\frac{K-1}{K}\mu_{K-1}+\frac{1}{K}x_{K},\quad\mu_{1}=x_{1} \tag{3}\]  
\[\Sigma_{K}=\frac{K-1}{K}X_{K-1}+\frac{1}{K}||x_{K}||^{2},\quad\Sigma_{1}=||x_ {1}||^{2} \tag{4}\]The terms \((k-1)/k\) and \(1/k\), which are updated at each iteration, can be seen as weight coefficients of the past and current data samples, respectively. This recursive form allows for the storage in memory of only the meta-parameters \(\mu_{k}\) and \(\Sigma_{k}\), making RDE suitable for online applications. Once the data density has been computed at time instant \(K\) by Equation (2), anomalous data can be detected considering the mean data density \(\overline{D}(x_{k})\) and the variance of the data density \(\sigma_{k}^{2}\), whose static formulation is expressed by Equations (5) and (6), and with the recursive calculation of Equations (7) and (8).  
\[\overline{D}(x_{k})=\frac{1}{k}\sum_{i=1}^{k}D(x_{k}) \tag{5}\]  
\[\sigma_{k}^{2}=\|\overline{D}_{K}-D_{K}\|^{2} \tag{6}\]  
\[\overline{D}_{K}=\frac{K-1}{K}\overline{D}_{K-1}+\frac{1}{K}D_{K},\quad \overline{D}_{1}=D_{1} \tag{7}\]  
\[\sigma_{k}^{2}=\frac{K-1}{K}\sigma_{k-1}^{2}+\frac{1}{K}\big{(}D_{k}- \overline{D}_{K}\big{)}^{2},\quad\sigma_{1}^{2}=1 \tag{8}\]  
In particular, while using Equations (7) and (8), anomalies can be detected by resorting to statistical rules or thresholds. For example, in [24], anomalies are detected based on the following condition  
\[IF\;D_{K}<\overline{D}_{K}-\sigma_{k}^{2}\;THEN\;x_{k}\;is\;an\;outlier \tag{9}\]  
RDE can be successfully applied to fault detection in industrial plants due to its fast responsiveness, computational efficiency, and low memory usage. However, in real applications, where large amounts of data are continuously collected in online mode, it also presents some drawbacks. In particular, when \(K\) grows indefinitely, the term \(1/K\) becomes irrelevant with respect to past data, thus reducing the potential informative content of the current data sample and making the RDE algorithm less sensitive to changes in the data structure.  
To solve these issues, the RDE with forgetting algorithm was introduced and applied to fault detection [25]. In this formulation, the forgetting factor \(\alpha\) replaces the term \((K-1)/K\), and its complement to \(1,1-\alpha\) (learning factor), replaces the term \(1/K\), thus enabling static weights over time. It has been demonstrated that RDE with forgetting is suitable for applications where abrupt changes need to be detected.