# Real-Time Anomaly Detection with Subspace Periodic Clustering Approach
## 3 Problem Definitions
Furthermore, CORE(\(C\)) = \(\left\{\mathbf{a}\mathbf{e}\mathbf{C}:\mathbf{\beta}_{C}^{\geq}\
eq\mathbf{\beta}_{C-\{\mathbf{a}\}}^{ \geq}\right\}\) = \(\cap\) red(\(C\)) where red(\(C\)) denotes the criterion reduction._  
**Definition 10. **_Consider an information system \(S=\{U,\,A,\,V,\,f\}\) consisting of m entities or objects \(a_{1}\), \(a_{2}\),..., \(a_{m}\). Let the attribute set \(A\) have n members. Then, \(S\) is expressed as an m\(\times\)n matrix with rows as objects and columns as attributes. Attributes can be designated as dimensions and each \(a_{i}=(a_{1i},\,a_{i2},\,\ldots,\,a_{in})\); \(i=1,\,2,\,\ldots,\,m\) will be a point in \(n\)-dimensional space \(S\)._  
**Definition 11. **_Let us consider \(a_{i}=(a_{i1},\,a_{i2},\,\ldots,\,a_{in})\), being the points in n-dimensional space, then the distance \(d(a_{i},\,C_{j})\) between \(a_{i}\); \(i=1,\,2,\,...,\,n\) and cluster \(C_{j}\,j=1,\,2,\,\ldots,\,k\) is defined as follows._  
\[d(a_{i},\,C_{j})=\frac{||a_{i}-c_{j}||^{2}}{\sum\limits_{t=1}^{k}||a_{i}-c_{ t}||^{2}} \tag{6}\]  
_where \(c_{j}\) is the \(C_{j}\),'s centroid and \(d(a_{i},C_{j})\in\{0,\,1\}\)._  
**Definition 12. **_Support and core of a fuzzy set. The support of a fuzzy set \(A\) in \(X\) is the crisp set containing every element of \(X\) with membership grades greater than zero in \(A\) and is denoted by \(S(A)=\{x\in X;\,\mu_{A}(x)>0\}\), whereas the core of \(A\) in \(X\) is the crisp set containing every element of \(X\) with membership grades equal to 1 in \(A\) [see e.g., [59]]. Obviously, core [\(t_{1},\,t_{2}\)] = [\(t_{1},\,t_{2}\)], since a closed interval [\(t_{1},\,t_{2}\)] is an equi-fuzzy interval with membership 1 [see e.g., [56; 57; 58; 59]]._  
**Definition 13. **_Set Superimposition. Set superimposition (\(S\)), an operation, was proposed in [56] as follows;_  
\[A_{1}\,(S)\,A_{2}=(A_{1}-A_{2})^{(1/2)}\,(+)\,(A_{1}\cap A_{2})^{(1)}\,(+)(A_{2}- A_{1})^{(1/2)} \tag{7}\]_where \((A_{1}-A_{2})^{(1/2)}\) and \((A_{2}-A_{1})^{(1/2)}\) are fuzzy sets [57; 59] with constant membership value (1/2), and (+) signifies a union of disjoint sets. To elaborate it, let \(A_{1}=[s_{1},t_{1}]\) and \(A_{2}=[s_{2},t_{2}]\) are two real intervals such that when \(A_{1}\cap A_{2}\
eq\phi\), we will obtain a superimposed part. When two intervals are superimposed, each interval contributes half of its value to the superimposed interval, so from Equation (7) we obtain:_  
\[[s_{1},t_{1}](S)[s_{2},t_{2}]=[s_{(1)},t_{(2)}]^{(1/2)}\ (+)\ [s_{(2)},t_{(1)}]^{(1)}\ (+)\ (s_{(1)},t_{(2)}]^{(1/2)} \tag{8}\]  
_where \(s_{(1)}=\text{min}(s_{1},s_{2})\), \(s_{(2)}=\text{max}(s_{1},s_{2})\), \(t_{(1)}=\text{min}(t_{1},t_{2})\), and \(t_{(2)}=\text{max}(t_{1},t_{2})\). The superimposition process is presented using Figures 1-3 below._  
_Similarly, three intervals \([s_{1},t_{1}]\), \([s_{2},t_{2}]\), and \([s_{3},t_{3}]\), (with non-empty intersection) are superimposed to obtain the following expression._  
\[[s_{1},t_{1}](S)[s_{2},t_{2}](S)[s_{3},t_{3}]=[s_{(1)}s_{(2)}]^{(1/3)}\ (+)[s_{(2)},s_{(3)}]^{(2/3)}\ (+)\ [s_{(3)},t_{(1)}]^{(1)}\ (+)\ [t_{(1)},t_{(2)}]^{(2/3)}\ (+)[t_{(2)},t_{(3)}]^{(1/3)} \tag{9}\]  
_where the sequence \(\{s_{(i)};\ i=1,\ 2,\ 3\}\) is arranged from \(\{s_{i};\ i=1,\ 2,\ 3\}\) in an increasing order of magnitude and \(\{t_{(i)};\ i=1,\ 2,\ 3\}\) is also arranged from \(\{t_{i};\ i=1,\ 2,\ 3\}\) in the similar fashion. Let \(\{s_{i},\ t_{i}\}\), \(i=1,2,\ \ldots\ n\), be \(n\) real intervals with \(\underset{i=1}{n}^{n}[s_{i},t_{i}]\
eq\phi\).