# Detecting IoT Anomalies Using Fuzzy Subspace Clustering Algorithms
## 3 Proposed Methods
### Gustafson-Kessel (GK) Algorithm [42; 47]
With the KDDCup'99 [50], the false alarm rate of the NT-CM-FCM algorithm ranges between 3.78 and 7.89% with respect to the data size range of 1,000,000-4,898,431, and with the Kitsune dataset [51], it ranges from 5.8 to 9.09% with respect to the data size of range 1,000,000-27,170,754. It is also evident from the results that the false alarm rate is more or less uniform with respect to data size, i.e., the relationship is linear. Furthermore, the false alarm rate follows descending order from left to right in the case of both datasets. In Tables 2-4 and Figures 9 and 13, the percentage of different attack parameters (denial of service, remote to local, user to root, and probe) are presented. For example, the percentage of denial of service of the ten algorithms (traditional and NT-based) are, respectively, 69.63, 72.73, 75.02, 78.85, 87.32, 79.73, 83.33, 84.92, 89.95, and 96.22. From these results, some interesting observations can be made; for instance, the traditional CM-FCM performance is better than NT-FCM, NT-GK, and NT-GG. This means that the algorithm CM-FCM, whether traditional or NT-based, outperforms all of the other algorithms, and the NT-CM-FCM algorithm is the best among all. Also, in case of the attack parameter, remote to local, CM-FCM performs better than NT-FCM, and NT-CM-FCM outperforms others. Similar observations can be made for the other two attack parameters (user to rootand probe). From the above discussions, it can be concluded that the dimension reduction has little impact on the attack parameters of the algorithm CM-FCM, as the performances of CM-FCM and NT-CM-FCM are almost the same. From Figures 14 and 15, it can be inferred that for different sizes (the dimensions sizes are taken as 10, 20 and 41) of the dimensions of the KDDCup'99 [50], the detection rate ranges of FCM, GK, GG, M-FCM, CM-FCM, NT-FCM, NT-GK, NT-GG, NT-M-FCM, and NT-CM-FCM are, respectively, 60.3-72.34, 62.06-75.56, 65.3-77.01, 66.03-77.45, 72.08-83.05, 72.1-75.78, 73.05-76.01, 74.1-76.3, 76.02-80.2, and 84.02-85.3, and for the dimensions of 10, 50 and 115, in the Kitsune dataset [51], the ranges are 49.21-68.03, 50.36-68.72, 53.23-69.19, 56.73-70.36, 63.88-71.9, 68.03-72.09, 69.05-74.56, 69.1-75.37, 75.04-78.23, and 83.21-84.89. It can be inferred from the data that for a lower dimensional dataset, most of the algorithms work nicely, even M-FCM and CM-FCM's efficacy of anomaly detection is higher than some of the NT-based approaches like NT-FCM and NT-GK. However, when the dimension increases, the detection rates of all of the traditional fuzzy clustering algorithms fall rapidly and those of the NT-based approaches fall consistently. Thus, the NT-based algorithms perform better comparatively, which also shows that NT-based algorithms are less dependent on the dimension of the datasets. It is to be mentioned here that algorithms NT-M-FCM and NT-CM-FCM's anomaly detection rates are much better than the others. Figures 16 and 17 give the accuracy rates of detection for all the aforesaid ten algorithms e, respectively, as 59.03-70.3, 60.83-70.9, 61.84-71.86, 67.41-74.23, 68.34-75.9, 69.01-76.23, 70.03-76.5, 72.24-79.56, 76.01-80.33, and 80.54-82.79 for the dataset KDDCup'99 [50] (the dimensions sizes are taken as 10, 20, and 41) and as 48.83-58.09, 51.03-66.34, 58.94-69.92, 59.23-70.12, 61.98-70.53, 67.07-72.78, 68.03-74.67, 69.33-75.34, 73.03-76.97, and 75.37-78.77 for the dataset Kitsune [51] (the dimensions sizes are taken as 10, 50, and 115). Since the accuracy ranges more for the traditional fuzzy clustering algorithms than the NT-based algorithms, which in turn, established the fact that later algorithms are less dependent on the sizes of dimensions of the datasets. It is to be mentioned here that NT-CM-FCM is comparatively better than the others in terms of the accuracy rate of anomaly detection.