# Real-Time Anomaly Detection with Subspace Periodic Clustering Approach
### Motivation and Contribution  
Most of the algorithms discussed above have some limitations. For example, some are inefficient at finding anomalies in high-dimensional data, and others are unable to find real-time anomalies. Although there exist many algorithms [7; 8; 9; 15; 18; 29; 34; 42; 38] for efficient detection of real-time anomalies, only a few actually address the periodicity in the real-time data. In real-time data such as sensors, IT monitoring applications generate huge volume of data continuously over a period of time, which is the lifespan of the dataset. Over the lifespan of the dataset, there may be data instances of similar nature that occur periodically. Considering the time attribute associated with such data as calendar dates (year_month_day_hour_minute_second), periodic clusters can be generated where the period of a cluster can be represented as a sequence of lifespans of clusters. In other words, in such a system, it would be interesting to observe whether the clusters or anomalies generated are of a periodic nature or not. This information can be useful for predicting anomalies. In [55], the authors proposed calendar-based periodic patterns from supermarket datasets. With the help of an interval superimposition operation [56; 57; 58], the algorithm finds a match ratio to generate fully, partially, and fuzzy [59] periodic patterns.  
In this article, the problems of high-dimensionality, real-time detection of anomalies, and periodicity have been efficiently addressed--and a method is proposed that can generate fully periodic, partially periodic, and fuzzy periodic clusters. It is named the RADSPCA. The method uses the notion of rough set theory and the \(k\)-means clustering algorithm to generate clusters along with their sequence of lifespans, and then the interval superimposition is applied to the lifespans to generate the periodicity of the clusters. The objective of the paper is as follows:  
Firstly, a dominance relation is defined on the dataset [60].  
Secondly, an interval superimposition operation is defined, and a match ratio in terms of interval superimposition is also defined.  
Finally, a new clustering-based method is proposed to generate periodic, partially periodic, and fuzzy periodic clusters in the subspace of the dataset.  
Thus, the RADSPCA first uses a rough set theoretic approach to find a lower-dimensional space by removing the irrelevant attributes. Then, the dynamic \(k\)-means clustering algorithm is applied to it to find the clusters along with their list of lifespans. At the end of this stage, each cluster will have a list of lifespans describing its period. Then the interval superimposition operation is applied to the list of lifespans to generate superimposed time-intervals along with their match ratio [55; 56]. The match ratio will determine whether the corresponding cluster is fully or partially periodic. Also, by applying a nice method [56; 57] on superimposed intervals, fuzzy time intervals can be generated. This way, from each fully or partially periodic cluster fuzzy periodic clusters can be generated. Then, RADSPCA's complexity is estimated. Lastly, a detailed comparative analysis is conducted with existing well-known clustering-based methods [9; 10; 19; 46; 63; 61; 62; 60; 61] using a MATLAB implementation with first KDDCUP99 [64] and then Kitsune Network Attack [65] datasets. The results effectively validate our technique.  
The structure of the paper is as follows: In Section 2, it is discussed how this field has recently advanced. In Section 3, the problem definition is presented. Section 4 covers the proposal method (RADSPCA). Section 5 discusses the time-complexity. Section 6 of the paper contains the experiments, results, and analysis, and Section 7 of the paper contains the conclusions, limitations, and future directions.