One of anomaly detection algorithms is to use multivariate Gaussian to construct a probability density, according to Andrew Ng's coursera lecture.
I previously thought that, the probability density method is supervised learning since we build a probability density and determine the threshold (if smaller, then an outlier) based on the positive samples. But somehow I read somewhere, that anomaly detection could be unsupervised learning by only training negative sample. Or I am totally wrong?
What if data show clustering structures (not a single chunk)? In this case do we resort to unsupervised clustering to construct the density? If yes, how to do it? Are there other systematic ways to discover if such a case exists?