# Detecting IoT Anomalies Using Fuzzy Subspace Clustering Algorithms
## 3 Proposed Methods
### Gustafson-Kessel (GK) Algorithm [42; 47]
For the different experiments, the dimensions of the dataset are taken as 10, 20, and 41. The methods are executed as many times as the set of dimensions of the dataset, and the corresponding results in terms of false alarm rates are recorded and displayed graphically in Figure 8:4

The above figure presents the false alarm rates of both traditional as well as NT-based fuzzy clustering methods with respect to the dimensions of the Kitsune dataset [51]. For the different experiments, the dimensions of the dataset are taken as 10, 50, and 115. The methods are executed as many times as the set of dimensions of the dataset, and the corresponding results in terms of false alarm rates are recorded and displayed graphically in Figure 8:5

### Discussions

The following inferences can be drawn from the obtained results. Table 2 presents the detection rates, the accuracy rates, the false alarm rates, and all the four attack parameters (denial of service, remote to local, user to root, and probe) of FCM, GK, GG, M-FCM, and CM-FCM with the two datasets, KDDCup'99 [50] and Kitsune [51]. It is evident from Table 2 that among all the aforesaid traditional fuzzy clustering algorithms, the CM-FCM performs the best, and performances follow the following order: CM-FCM, M.FCM, GG, GK, and FCM. It is evident from the results of the Kitsune dataset [51], which is much larger than KDDCup'99 [50], that the performances of the above algorithms reduce rapidly when a comparatively larger dataset is considered, which means that the performances of the traditional fuzzy clustering algorithms depend both on the size and dimension of the dataset. The bar diagrams in Figures 6 and 10 represent the detection rates of the five NT-based fuzzy clustering algorithms for KDDCup'99 [50] and Kitsune [51], respectively. It can be seen in the bar diagram that the anomaly detection rates of all of the algorithms improve if the NT-based subspace clustering approach is considered. With KDDCup'99 [50], the NT-CM-FCM performs best with the detection rate of 91.3%, and NT-FCM performs worst with 82.6%, which is far better than the traditional CM-FCM's detection rate (72.08%). Similarly, with the comparatively larger dataset of Kitsune [51], the NT-CM-FCM performs best with the detection rate of 90.8%, and NT-FCM performs the worst with 78.5%. A similar observation can be made for other NT-based methods. Also, the detection rate decreases with the increase in the size of the dataset, but the rate of decrease is much slower. Both results show that the detection rates of NT-based approaches depend little on the sizes and the dimensions of the datasets. The detection rates of NT-based algorithms follow the order NT-CM-FCM, NT-M-FCM, GG, GK, and FCM. Also, there exists a linear relationship between the detection rate of each NT-based approach and the dataset size. As far as the accuracy of anomaly detection is concerned, Figures 7 and 11 and their descriptions show that the NT-based approach of the fuzzy clustering algorithms performs impressively in comparison to the traditional fuzzy clustering approaches. Similar to the detection rate, the accuracy rate decreases visibly less with respect to the increment of the dataset size, which means that there is a linear relationship between the accuracy rate of each NT-based approach and the dataset size. The NT-CM--FCM is found to be comparatively better as its accuracy of anomaly detection ranges from 80.54% to 86.5% for the KDDCup'99 [50] dataset and from 75.37% to 82.6% for the Kitsune dataset [51]. The accuracy rate follows ascending order from left to right in the case of both datasets. From Figures 8 and 12, it is evident that the false alarm rates of NT-based algorithms are quite lesser than the traditional fuzzy clustering algorithms, and also the false alarm rate of NT-CM-FCM is comparatively much better than the others.