# Detecting IoT Anomalies Using Fuzzy Subspace Clustering Algorithms
## 3 Proposed Methods
### Gustafson-Kessel (GK) Algorithm [42; 47]
The false alarm rates of the aforesaid algorithms for the different dimensions of the KDDCup'99 [50] dataset have respective ranges of 10.3-18.7, 10.01-17.82, 9.32-15.89, 8.14-13.03, 8.02-12.89, 8.01-12.5, 7.9-12.02, 7.7-11.09, 7.56-9.02, and 7.02-7.89, and for the Kitsune dataset [51], respective ranges are 20.9-11.3, 18.92-11.1, 18.59-10.3, 15.33-9.9, 14.69-9.3, 14.3-8.9, 13.2-8.3, 12.09-8.04, 11.03-7.89, and 9.09-7.74, which is evident from Figures 18 and 19. It has been observed that the false alarm rates of all of the algorithms increases with the increase in the dimension of the datasets. However, for the NT-based algorithms, the rate of increase is comparatively slower, and NT-CM-FCM is the slowest. It is also observed that the rates of decrease are from left to right, which shows that NT-CM-FCM is the best among all of the algorithms, whether traditional or NT-based. Furthermore, Figure 14 shows the relationship of the detection rates with the dimensions of KDDCup'99 [50]. It can be seen from Figures 14, 16 and 18 that all of the five traditional fuzzy clustering algorithms, namely FCM, GK, GG, M-FCM, CM-FCM, perform in terms of detection rates, accuracy rates, and false alarm rates very well in the lower dimensional spaces, but performances decrease rapidly with the increase in dimensions. The rate of decrease is very fast initially, though it appears to be a little better later. So, it appears that the traditional fuzzy clustering algorithms show inconsistent behavior with respect to the dimension of the dataset. However, the proposed algorithms, especially NT-CM-FCM, perform uniformly in all parameters. Also, in the case of other NT-based approaches, the results are more or less consistent. This means that the NT-based approaches have consistent relationships with the dimension of the KDDCup'99 [50] datasets. In the case of the Kitsune dataset [51], similar observations can be made. From Figures 15, 17 and 19, similar findings are observed, i.e., the NT-based approaches maintain consistency with the dimensions of both the dataset in all of the performance parameters like accuracy rate, false alarm rate, etc. However, the traditional approaches are non-uniform, and they show multiple linear relationships. The NT-CM-FCM fuzzy clustering algorithm shows the most consistent performance in all of the given parameters. ## 6 Conclusions, Limitations, and Lines for Future Works

### Conclusions

In this article, two-phased methods of fuzzy subspace clustering for anomaly detections were proposed. The input dataset is initially transformed into a set-valued information system using the rough set theoretic approach, which establishes a dominance relation on it. Then, a nano topology, along with its basis, is constructed by removing insignificant attributes of the dataset. The constructed nano topology creates a lower dimensional space of the original dataset. In the second phase, fuzzy clustering algorithms were employed for anomaly detections. For fuzzy clustering, the traditional algorithms like FCM [41], GK [42; 47], GG [43; 47], M-FCM [47], and CM-FCM [47] were used. The proposed algorithms are named NT-FCM, NT-GK, NT-GG, NT-M-FCM, and NT-CM-FCM. Each of the proposed methods supplies a specified number of fuzzy clusters. The data instance not belonging to any of the clusters or belonging to a minimum membership value can be treated as an anomaly. The efficacies of the proposed approaches were studied by experimental analysis on a synthetic dataset, KDDCup'99 [50], and a real-life dataset, Kitsune [51], and comparative studies have been made with the traditional fuzzy clustering approaches and among the proposed approaches. The results showed that the NT-based algorithms outperform the traditional approaches in all of the parameters like detection rate, accuracy rate, false alarm rate, and run-time complexities. Though among all the aforesaid methods, NT-CM-FCM is the best, its traditional algorithm CM-FCM sometimes performs better than the other NT-based fuzzy clustering approaches.