# Detecting IoT Anomalies Using Fuzzy Subspace Clustering Algorithms
## 3 Proposed Methods
### Gustafson-Kessel (GK) Algorithm [42; 47]
It is an extension of the NT-GK algorithm which uses maximum likelihood estimates instead of Euclidean distance and is used to detect clusters of varying shapes, sizes, and densities. All other steps of the algorithm are similar to NT-FCM and NT-GK fuzzy clustering algorithms. As usual, the method supplies a set of fuzzy clusters in the lower dimensional space. A flowchart of the Nano topology and Mahalanobis Distance-based Fuzzy C-Means algorithm (NT-M-FCM) is given in Figure 4 below. Figure 1: Flowchart of the NT-FCM clustering algorithm. Figure 4 represents the NT-M-FCM fuzzy clustering algorithm which uses Mahalanobis distance to enhance its performance, particularly in the scenarios where the data distribution is non-spherical or exhibits correlations among variables. It is useful in the situations where the assumption of equal variance in different dimensions may not hold. All other steps of the algorithm are similar to all the previous fuzzy clustering algorithms. Like all the previous methods, it also supplies a set of fuzzy clusters in the lower dimensional space. Figure 2: Flowchart of the NT-GK clustering algorithm. Figure 3: Flowchart of the NT-GG clustering algorithm. A flowchart of the Nano topology and Common Mahalanobis Distance-based Fuzzy C-Means algorithm (NT-CM-FCM) is given in Figure 5 below. Figure 4: Flowchart of the NT-M-FCM clustering algorithm. The above Figure gives a concise view of the NT-CM-FCM clustering algorithm. It uses a common covariance matrix instead of different covariance matrices in the objective function. It is an extension of the NT-M-FCM clustering algorithm which incorporates a common Mahalanobis distance metric to account for the correlation between variables in the dataset. Like all the previous methods, it also supplies a set of fuzzy clusters in the lower dimensional space. The approaches employed in this article consist of various combinations of the algorithms of the form (Algorithm 1 + Algorithm 2), (Algorithm 1 + Algorithm 3), (Algorithm 1 + Algorithm 4), (Algorithm 1 + Algorithm 5), and (Algorithm 1 + Algorithm 6), where Algorithm 1 (common to all) is used for dimension reduction and the others are used for clustering. The methods supply a specified number of fuzzy clusters in the lower dimensional space. Figure 5: Flowchart of the NT-CM-FCM clustering algorithm. -dimensional space. The anomalous items are those IoT data instances which either do not belong or belong to clusters with minimum membership values. ## 4 Complexity Analysis

If \(\mid U\mid=m\), and \(\mid C\mid=n\), the worst-case time-complexity Algorithm 1 is O (\(m^{2}.n\)). Since FCM uses the norm-inducing matrix, the time complexity of the distance function of fuzzy clusters is O \((c.(c-1).d/2)=\) O \((c^{2}.d)\). The worst-case complexity of FCM is O \((m.c^{2}.d.i)\) = O \((m.n.m^{2}.i)\) = O \((m^{3}.n.i)\), where \(d\) (\(\leq\)n) is the dimension of the subspace generated by Algorithm 1, \(c\) (\(\leq m\)) is the number of fuzzy clusters, and I is the number of iterations. The overall time complexity of NT-FCM is O \((m^{2}.n+m^{3}.d.i)\). Obviously, \(i\leq m\) and d \(\leq\) n are small and can be neglected, and therefore, the overall worst-case time complexity of NT-FCM is O \((m^{2}.n+m^{4})\), which shows that it is linear with respect to the dimension of the dataset. In general, \(n\leq m\), which gives the worst-case complexity as O \((m^{4})\). In finding the computational complexity of the NT-GK clustering algorithm, the complexity of NT is the same as O \((m^{2}.n)\). For finding a new cluster and fuzzy c-means membership, the algorithm needs O I and O \((n.c)\), which are same as FCM. In this algorithm, the most important task is that each cluster has its own norm-inducing matrix, which produces the inner product norm and the time complexity of such for \(c\) clusters is O \((k\ (m.d.m.d))\) = O \((m^{2}.d^{2})\), where \(k\) is the constant time required for computing \(A_{1}\).