# Detecting IoT Anomalies Using Fuzzy Subspace Clustering Algorithms
## 3 Proposed Methods
### Gustafson-Kessel (GK) Algorithm [42; 47]  
This is an extension of FCM where an adaptive distance norm was used to detect clusters of various shapes from one dataset. Each cluster has its own norm-inducing matrix \(A_{i}\), which produces the inner-product norm given below. \[D_{ikA_{i}}^{2}=\left(x_{k}-v_{i}\right)^{T}\!\!A_{i}(x_{k}-v_{i}) \tag{14}\]  
The matrices \(A_{i}\) are used as optimization variables in the \(c\)-means functional, which allows for each cluster to adapt the distance norm to the local topological structure of the data. The objective function of the GK algorithm is given by  
\[J(X;U,V,\left\{A_{i}\right\})=\sum_{i=1}^{c}\sum_{k=1}^{N}(\mu_{ik})^{m}D_{ikA_ {i}}^{2} \tag{15}\]  
where \(A_{i}=1\,\Sigma_{i}\,^{1/p}\,\Sigma_{i}\,^{-1}\)  
\[\sum_{i}=\left|\sum_{i=1}^{c}\sum_{k=1}^{N}(\mu_{ik})^{m}\,\right|^{-1}\!\! \sum_{i=1}^{c}\sum_{k=1}^{N}\mu_{ik}(x_{k}-v_{i})(x_{k}-v_{i})^{T} \tag{16}\]  
The GK algorithm (Algorithm 3) for fuzzy clustering is given below. ```
Given dataset \(X\), choose the number of cluster \(c\), (\(1<c<N\)), weighting exponent \(m>1\), terminating threshold \(\phi>0\), and cluster volume \(M\). Initialize \(U=U^{(0)}\)// \(U^{(0)}\in F_{fc}\) for each \(j=1\), \(2\),....... step 1 compute cluster mean \(\mathbf{v}_{i}^{(j)}=\frac{\sum_{k=1}^{N}\left(\mu_{ik}^{(j-1)}\right)^{m}\mathbf{x}_ {k}}{\sum_{k=1}^{N}\left(\mu_{ik}^{(j-1)}\right)^{m}}\), \(i=1,2,..c\) step 2 compute the cluster covariance matrices \(\mathbf{C}_{i}=\frac{\sum_{k=1}^{N}\left(\mu_{ik}^{(j-1)}\right)^{m}\left(\mathbf{x}_ {k}-v_{i}^{\prime}\right)\left(\mathbf{x}_{k}-v_{i}^{\prime}\right)^{T}}{\sum_{k= 1}^{N}\left(\mu_{ik}^{(j-1)}\right)^{m}}\), \(i=1,2,..,c\) step 3 compute \(D_{ikA_{i}}^{2}\) (for \(i=1,2\),..., \(c\), \(k=1,2\),..., \(N\)) using Equations (14) and (16) step 4 for \(k=1\), \(2\),..., \(N\)// update partition matrix if \(D_{ikA}>0\), for all \(i=1\), \(2\),..., \(c\) \(\mathbf{n}_{ik}^{(j)}=\frac{1}{\sum_{k=1}^{N}\left(\frac{\mathbf{\mathbf{\beta}}_{ik}}{\mathbf{ \beta}_{ik}}\right)^{2/(m-1)}}\), else \(\mathbf{n}_{ik}^{(j)}=0\) if \(D_{ikA}>0\), \(\mathbf{n}_{ik}^{(j)}\mathbf{e}[\mathbf{0},1]\) with \(\sum_{k=1}^{c}\mathbf{n}_{ik}^{(j)}=1\) until \(1\,\cup U^{(j-1)}\,\cup\,\cup\,\)

### Gath-Geva Algorithm (GG) [43; 47]

[PERSON] [43; 47] proposed an extension of the GK algorithm by introducing maximum likelihood estimates instead of Euclidean distance which can be used to detect clusters of varying shapes, sizes, and densities. The objective function of the algorithm is given by

\[J(X;\mathbf{U},V,\{A_{i}\})=\sum_{i=1}^{c}\sum_{k=1}^{N}(\mathbf{\mu}_{ik})^{m}D_{ikA_{ i}}^{2} \tag{17}\]

where \(D_{ikA_{i}}^{2}\) is the Gauss distance between \(x_{\rm k}\) and the cluster mean \(v_{\rm i}\) and is given by

\[D_{ikA_{i}}^{2}=\frac{\left(2\pi\right)^{N/2}\sqrt{|A_{i}|}}{\alpha_{i}}\exp \left(\frac{1}{2}(x_{k}-v_{i})^{T}A_{i}^{-1}(x_{k}-v_{i})\right) \tag{18}\]

and

\[A_{i}=\frac{\sum_{k=1}^{N}\left(\mu_{ik}\right)^{m}(x_{k}-v_{i})(x_{k}-v_{i}) ^{T}}{\sum_{k=1}^{N}(\mu_{ik})^{m}},\ i=1,\ 2,\ldots,c \tag{19}\]

Also, \(\alpha_{\rm i}\) is the a priori probability of \(x_{\rm k}\) belonging to the \(i\)th cluster and is given by

\[\mathbf{\alpha}_{i}=\frac{\sum_{k=1}^{N}(\mathbf{\mu}_{ik})^{m}}{N} \tag{20}\]

The objective function (17) is minimized by the following equations:

\[\mathbf{\mu}_{ik}=\frac{1}{\sum_{l=1}^{c}\left(\frac{D_{ikA_{i}}}{D_{ikA_{j}}} \right)^{1/(m-1)}},\ 1\leq j\leq c,\ 1\leq k\leq N \tag{21}\]

and

\[v_{i}=\frac{\sum_{k=1}^{N}\left(\mathbf{\mu}_{ik}\right)^{m}\mathbf{x}_{k}}{\sum_{k=1 }^{N}(\mathbf{\mu}_{ik})^{m}} \tag{22}\]

As the algorithm uses the exponential distance norm, it requires a good initialization (Algorithm 4). ```
Given dataset \(X\), choose the number of cluster \(c\), (\(1<c<N\)), and terminating threshold \(\phi>0\).