The threat from nuclear terrorism represents a complex challenge for global governments. Although current systems for detecting threats from illicit materials exist, each have inherent limitations. It is crucial that a system can detect material being transported with malicious intent which is likely to cause health risks and require extensive clean-up operations. One monitoring approach comprises the use of a network(s) of distributed detectors to detect anomalous events. To keep costs low, these networks may be made up primarily or entirely of small volume, handheld, scintillator-based detectors. Utilising algorithms capable of raising the alarm when detecting a threat, but with a low false alarm rate, is vital. For these small-volume and portable systems this can be a challenging task as signal to noise ratios are low. One currently applied method for the detection of radioactive sources uses principal component analysis (PCA) to characterise complex background environments. An implementation of this approach is described by Shokhirev et al. (Shokhirev et al., 2012). From the components found using PCA, incoming spectra can be reconstructed, maximizing the Poisson distributed likelihood. Another approach that additionally creates components from which to reconstruct incoming spectra is non-negative matrix factorization (NMF). NMF has the advantage of being a more physical treatment of the background than PCA as there are no negative components. Both of these source detection methods have been implemented using an existing set of background data from portable scintillator detectors deployed around London. The performance was tested using threats injected into the dataset, generated using GEANT4 and empirically measured detector response parameters. A comparison of the performances of the PCA and NMF-based approaches has been completed and visualised via their receiver operating characteristic curves (ROC curves). Utilising NMF components achieves high sensitivity to threats with a high precision, providing a promising method for nuclear security with small volume gamma detectors.