Consider: "A Real-Time System-Adapted Anomaly Detector", 'Information Sciences', volume 115, April, 1999, pages 221-259. It's a distribution-free statistical

Consider: "A Real-Time System-Adapted Anomaly Detector", 'Information Sciences', volume 115, April, 1999, pages 221-259. It's a distribution-free statistical hypothesis test for multidimensional data. False alarm rate can be adjusted in small steps over a wide range and, then, is achieved exactly. It has nothing to do with any Gaussian distribution (is distribution-free), principal components analysis, singular value decomposition, etc.