# Detecting IoT Anomalies Using Fuzzy Subspace Clustering Algorithms
## 3 Proposed Methods
### Gustafson-Kessel (GK) Algorithm [42; 47]
If \(i\) is the number of iterations, the overall time complexity is O \((m^{2}.n+i.\ (c+n.c+c.m^{2}.d^{2}))\) = O \((m^{2}.n+m^{4}.d^{2})\) = O \((m^{2}.n+m^{4}.d^{2})\), where \(I\) = O \((m)\), \(c\) = O \((\)m), and \(d\leq n\leq\) m (in general) is small. Thus, the worst-case time complexity of the algorithm is O \((m^{4}.d^{2})\). The GG fuzzy clustering algorithm uses the maximum likelihood estimation measure which requires O \((m.d)\), as it uses the exponential distance which introduces another level of complexity. The time complexity of the NT-GG clustering algorithm is O \((m^{2}.n+c.\ (m.c.d^{2}.i)\) = O \((m^{2}.n+m^{4}.d^{2})\), where \(I\) = O \((m)\), \(c\) = O \((\)m), and \(d\leq n\leq\) m (in general) is small. Thus, the worst-case time complexity of the algorithm is O \((m^{4}.d^{2})\). The M-FCM computes separate matrices for each cluster, so the time complexity of the NT-M-FCM algorithm is O \((m^{2}.n+i.\ (c+n.c+c.m.d^{2}))\) = O \((m^{2}.n+m^{3}.d^{2})\), where \(i\) = O \((m)\), \(c\) = O \((\)m), and \(d\leq n\leq\) m (in general) is small. Thus, the worst-case time complexity of the algorithm is O \((m^{3}+m^{2}.d^{2})\). ## 5 Experimental Analysis, Results and Discussions

### Experimental Analysis and Results

For testing the efficacy of the approaches employed here, two well-known datasets, namely, the KDDCup'99 Network Anomaly dataset [50] and Kitsune Network Attack dataset [51], are used. The detailed descriptions of the datasets are given below. KDD CUP'99 [50]: It is a synthetic dataset that simulates intrusion in the military network environment. The data are collected for 9 weeks, and its training data consist of 5 million network connections. The attributes can be divided into the classes, viz., normal (unauthorized access to local super user privileges, unauthorized access from a remote machine), dos, and probe. Kitsune [51]: It is a group of nine network attack datasets, each containing millions of network packets and different cyberattacks, which were either gathered from an IP-based commercial surveillance system or a network of IoT devices. The datasets are obtained from the UCI machine repository. The datasets along with their characteristics in summarized form are described in Table 1 below. The experiments were conducted on a standard machine using two datasets described in Table 1. With the KDDCup'99 [50], two datasets, one having different sizes but fixed dimensions and the other having fixed sizes and different dimensions, are constructed. Similarly, with the Kitsune dataset [51], two datasets of similar sizes are constructed. The proposed methods, namely NT-FCM, NT-GK, NT-GG, NT-M-FCM, and NT-CM-FCM, are implemented using MATLAB with the aforesaid four constructed datasets. The comparative analysis of the proposed approaches along with traditional fuzzy clustering algorithms, namely FCM [41], GK [42], GG [43], M-FCM [47], and CM-FCM [47], are conducted. Further, the performances of the proposed methods along with traditional fuzzy clustering algorithms are studied in manifolds, like accuracies in detection rates, the percentage of anomalies obtained, percentage of false alarm rates, etc. The detailed findings of the aforesaid investigations are presented both in tabular form in Tables 2-4 and graphically in Figures 6-19 below. Table 2 gives the performances of the traditional fuzzy clustering algorithms FCM, GK, GG, M-FCM, and CM-FCM with the datasets KDDCup'99 [50] and Kitsune [51]. The dimension of the two datasets is assumed to be constant. The performances are measured using the parameters like detection rate, accuracy rate, false alarm rate, denial of service, remote to local, and probe. It has been observed from the table that the CM-FCM clustering algorithm outperforms others in all the parameters and its performance is the best in the case of the KDDCup'99 [50] dataset. The above figure gives the detection rates of all the five NT-based fuzzy clustering methods with different sizes of the dataset KDDCup'99 [50].