# A Clustering Algorithm for Evolving Data Streams Using Temporal Spatial Hyper Cube
## 3 Methodology
### Developed Algorithms
#### 3.4.4 BOCEDS Micro-Cluster Update
\begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Dataset Name** & \begin{tabular}{l} **Number of** \\ **Records** \\ \end{tabular} & \begin{tabular}{l} **Number of Classes** \\ **Number of** \\ **Features** \\ \end{tabular} & \begin{tabular}{l} **Number of** \\ **Type** \\ \end{tabular} & \
\begin{tabular}{l} **Range** \\ \end{tabular} \\ \hline \multirow{3}{*}{DNA\_mat} & \multirow{3}{*}{6006} & \multirow{3}{*}{2} & 1 & double & \([0.1,1]\) \\ \cline{3-5}  & & & 2 & double & \([0,1]\) \\ \cline{3-5}  & & & 1 & double & \([-0.4,1]\) \\ \cline{3-5}  & & & 2 & double & \([-0.4,0.6]\) \\ \hline \multirow{3}{*}{LandSat} & \multirow{3}{*}{Number} & \multirow{3}{*}{Meaning} &
\begin{tabular}{l} Number of \\ records \\ \end{tabular} & \multirow{3}{*}{Type} & \multirow{3}{*}{Range} \\ \cline{3-5}  & & 1 & red soil & 1072 & \\ \cline{1-1} \cline{3-5}  & & 2 & cotton crop & 479 & \\ \cline{1-1} \cline{3-5}  & & 3 & grey soil & 961 & \\ \cline{1-1} \cline{3-5}  & & 4 & damp grey soil & 415 & \\ \cline{1-1} \cline{3-5}  & & 5 & soil with vegetation & \multirow{2}{*}{470} & \\ \cline{1-1} \cline{3-5}  & & & stubble & & \\ \cline{1-1} \cline{3-5}  & & 6 & very damp grey soil & 1038 & \\ \hline \multirow{3}{*}{KDD} & \multirow{3}{*}{Number of records} & \multirow{3}{*}{Attributes} & \multirow{3}{*}{Type of Attacks} \\ \cline{1-1} \cline{3-5}  & & & & \\ \cline{1-1} \cline{3-5}  & & & & \\ \cline{1-1} \cline{3-5}  & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Datasets Characteristics. ### Quality Evaluation

#### 4.1.1 Anomaly Detection Ratio (ADR)

This measure is calculated based on the number of correct anomalies detected samples over the total number of anomaly samples. ARD has been used in evaluating the anomaly detection ratio in studies such as [28]. \[ADR=\frac{CAS}{Total\ Anomaly\ Samples} \tag{9}\]

where \(CAS\) indicates the correct anomaly detected samples. The results of the anomaly detection ratio are presented for the various datasets in Figure 4. As it is shown in the figure, TSHC has accomplished high values for a median of ADR, nearly 1.00 for both KDD datasets which were superior to the benchmark, and a median close to 0.95 for traffic data which is equivalent to the benchmark of BOCEDS and BOCEDS inc. The only two datasets that caused an inferior performance of TSHC are DNA and Landsat. This shows a general superiority of TSHC in terms of ADR. The reason for some cases where the benchmarks were superior is the nature of the data. For example, in LandSat the results of ADR were low for all algorithms of BOCEDS, and TSHC, while CEDAS and MuDi-Stream have accomplished around 0.4 of ADR which is interpreted by the type of anomaly of LandSat which is not detectable by the buffer-based structure of BOCEDAS and our developed algorithms. On the other side, the anomaly of DNA was detectable by BOCEDS with a level higher than 0.8 but their nature did not require the dynamic awareness that exists in TSHC which makes the prediction slightly lower than BOCEDAS and BOCEDS Inc.

#### 4.1.2 Rand Index (RI)

The Rand index is a widely used indicator that is primarily used to evaluate clustering. Additionally, it is used to assess density-based data stream clustering algorithms [16]. It quantifies the agreement between two partitions, i.e., how similar the clustering results are to the ground truth. The Rand index is defined as the following: [16; 29; 30]. \[\text{Rand Index}\ =\frac{|TP|+|TN|}{|TP|+|TN|+|FP|+|FN|} \tag{10}\]

RI is one of the most known indices for measuring the similarity between two partitions and has been widely used in various studies. Figure 4: Anomaly Detection Ratio Comparison Using KDDCup’99, Landsat, Spiral, DNA, and Traffic Datasets. The rand index outcomes for several datasets are visualized in Figure 5. As it is presented in the figure, the median of RI for TSHC in both DNA and spiral datasets is 0.62 and 0.64 respectively, which are higher than the benchmarks. The only two datasets that caused an inferior performance of TSHC are KDD and Landsat.