What is a Gaussian mixture model?
A Gaussian mixture model (GMM) is an unsupervised, probabilistic model that treats data as a blend of overlapping groups, each following a Gaussian, or normal, distribution. Each group, called a component, has a center, a spread and orientation, and a weight for its share of the data. The expectation-maximization (EM) algorithm fits the model. It estimates how likely each record is to belong to each component, re-estimates the components from those weighted records, and repeats until the answers settle.
Compared with k-means clustering, a GMM allows oval clusters of different sizes and gives soft memberships, so a record can belong mostly to one group and partly to another. Because the model estimates how dense the data is at every point, it can also score how unusual a new record is, which makes it useful for anomaly detection.
Gaussian mixture models in practice
A managed service provider monitors processor load, disk activity, and network traffic on client servers. One normal range does not fit, because a healthy file server behaves differently during business hours, the nightly backup, and a quiet weekend. A GMM fitted to several weeks of each server’s readings learns each mode as a component. Readings that are unlikely under every component open a ticket. Heavy disk writes at midday on a server that is usually idle at that hour are one example, and ransomware encrypting files can cause them. Analysts choose the number of components with the Bayesian information criterion.