# Real-Time Anomaly Detection with Subspace Periodic Clustering Approach
## 4 Proposed Algorithm
Similar to this, if the time stamp of a data instance migrating from one cluster to another falls outside the later cluster's lifespan, the cluster-centroid is updated and the later cluster's life-span is updated as well, provided that the time gap between the two clusters is within a certain limit (\(t_{\text{max}}\)). The pseudocode of the algorithm is given below. Here each output cluster in the final output cluster set has a sequence of time intervals describing its lifespan. It should be noted that only clusters with lifespans of at least \(t_{\text{min}}\) are provided by Algorithm 2. ```
Input:\(E\): Information system consisting \(n\) objects and attribute set CORE(A) \(\subseteq\)\(A\), \(t_{\text{max}}\): the maximum time-gap of consecutive time-stamp, \(t_{\text{min}}\): the minimum length of lifespan. Output: Set of clusters where each cluster is associated with a sequence of time intervals as its lifespans. Step 1. Given \(d_{1}\)-dimensional dataset CORE(\(A\)) Step 2. Select \(C[i]=[x[i],\text{tp}[i]]\); \(i=1,2,\,\ldots,\,k\), where \(x[i]\) be the data instances or means of clusters, \(\text{tp}[i]\) points to list of time-intervals each maintained for every cluster contains time-stamps (_start-time_) of \(x[i]\) and _start-time_ = _last-time_ initially Step 3. for each incoming data instance \(x\) with current time-stamp current-time Step 3. {if d(x, \(C_{i}\)) \(\leq\) d(x, \(C_{i}\)), \(i\
eq j\); \(i=1,2,\,\ldots,\,k\) Step 4. {Add x to \(C_{i}\)} Step 5. Update mean(\(C_{i}\)) Step 6. if \(|\)\(current-time-last-time[j]|\leq t_{\text{max}}\) Step 7. {if(_last-time[j]|\leq current-time_) Step 8. extend lifespan(\(C_{i}\)) by setting _last-time[j]_ = _current-time Step 9. else go to Step 3 10. ] Step 11. else if \(|\)\(last-time[j]-start-time|\geq t_{\text{min}}\) Step 12. {Add [_start-time[j]_, last-time[j]| to tp[j] Step 13. set _last-time[j]_ = _start-time[j]_ = _current-time Step 14. ] Step 15. ] Step 16. ] Step 17. if (assign does not occur) go to step 19 Step 18. else go to Step 3 19. Output cluster set
```  
**Algorithm 2**Dynamic \(k\)-means clustering algorithm  
For each cluster with a sufficient number of time intervals as its lifespans, the following procedure is applied to find periodic clusters from the interval list. The interval superimposition operation is to keep the information about the periods (time interval associated with a cluster). The interval superimposition is used only if the intervals have overlappingor non-empty intersections. Throughout Algorithm 3 execution, a list of superimposed time intervals is maintained. The total number of time intervals of any clusters is taken as \(n\) (number of Years/Months etc.). To determine whether a new crisp time-interval can be superimposed on an already superimposed time-interval or not. it is checked whether the interval has a non-empty intersection with the core of the superimposed time interval or not (the definition of core is given in Section 3). If it has, then the superimposition process is computed to get a new superimposed time interval and membership values are reconstructed accordingly. The list of superimposed time intervals is initially empty. A full pass through the time interval list of a cluster is conducted during Algorithm 3 execution. When it switches to a new time interval, it determines if it can be superimposed on any of the previously obtained superimposed intervals. If so, the superimposition process is performed, which updates the relevant superimposed time interval. This time interval is added as a new entry to the list if it is not superimposed with any of the previously acquired superimposed time intervals (kept as a list). Finally, each superimposed time interval is examined to determine the number of time intervals superimposed in one place and kept using a counter (\(m\)). At the beginning of the superimposition process of a time interval, the value of \(m\) is taken as 1. If a time interval is superimposed on the time interval, then \(m\) is updated by adding 1 to it.