# Real-Time Anomaly Detection with Subspace Periodic Clustering Approach
## 4 Proposed Algorithm  
For detecting anomalies, a partitioning subspace clustering approach is employed. The method first uses a rough set theoretic approach for attribute or dimension reduction and then uses a dynamic \(k\)-means clustering approach for finding clusters along with their lifespans. Each cluster will have a sequence of time intervals representing its lifespan. Then, an interval superimposition-based approach is employed to find the periodic clusters along with the noises. The proposed method is described as follows. Here the dataset \(S=(U,A)\) is an information system consisting of both conditional attributes and decision attributes. First of all, the data pre-processing techniques are employed to convert the information system into a set-valued ordered information system. Then, a dominance relation is generated on the ordered information system. With reference to the dominance relation, a nano topology and its basis is generated. Then the criterion reduction process is used to generate CORE(\(A\)) as a subset of attribute set \(A\) and the new information system \(E=(U,\) CORE(\(A\))) on \(U\) is formed, which is a lower dimensional space. The pseudocode of the Algorithm 1 for the criterion reduction is given below. ```
Input: \((U,A)\): the information system, where the attribute set \(A\) is divided into \(C\)-conditional attributes and \(D\)-decision attributes, consisting of \(n\) objects, Output: Subspace of \((U,A)\)  Step 1. Generate a dominance relation \(R^{\geq}_{C}\) on \(U\) corresponding to \(C\) and \(X\subseteq U\). Step 2. Generate the nano topology \(\tau^{\geq}_{C}(X)\) and its basis \(\beta^{\geq}_{C}(X)\)  Step 3. for each \(x\in C\), find \(\tau^{\geq}_{C-\{x\}}(X)\) and \(\beta^{\geq}_{C-\{x\}}(X)\)  Step 4. if \((\beta^{\geq}_{C}(X)=\beta^{\geq}_{C-\{x\}}(X)\) )  Step 5. then drop \(x\) from \(C\),  Step 6. else form criterion reduction  Step 7. endfor  Step 8. generate CORE(\(C\)) = \(\cap\) {criterion reductions}  Step 9. Generate subspace of the given information system. ```  
**Algorithm 1**Subspace Generation  
The above algorithm supplies the CORE of the attribute set by removing insignificant attributes which gives us a subspace \(E=(U,\) CORE(\(A\))) of the given information system \(S=(U,\)\(A)\). Then a dynamic \(k\)-means is applied to \(E\). The following is an explanation of the algorithm: First of all, it randomly picks first \(k\)-data instances from the CORE(A) as \(k\)-clusters-centroids with associated timestamps (times of generation) as the _start-time_of their lifespans. For each cluster, a _last-time_ and a list are maintained to keep the last timestamp and lifespan of each cluster, respectively. Initially _start-time_ = _last-time_. If a data instance is added to a cluster based on how far away from the cluster centroid it is, its current time-stamp (_current-time_) is added to the lifespan to obtain an updated life span, provided that the time gap between the cluster's _last-time_ and the data instance _current-time_ is within a predetermined range, such as \(t_{\text{max}}\). Otherwise, a new life-span will start by setting the _current-time_ as a _start-time_ and the previous life-span of the cluster will be closed with _last-time_ as the end of the life-span. The lifespan of the cluster will be put on the list maintained for it if its length is greater than a specified length (say \(t_{\text{min}}\)). The lifespans of the earlier and later clusters are updated if a data instance switches from one cluster to another during the execution process. For instance, if the time stamp on the outgoing data instance is either the _start-time_ or _end-time_ of the preceding cluster, the lifespan of the prior cluster is updated by using the next or previous cluster time-stamps respectively. Updates are made to the cluster-centroids as well. Again, the lifespans of the former and later clusters will not change if the time stamp of the outgoing data instance falls within those lifespans, but the cluster centroids will be modified.