# A Mixed Clustering Approach for Real-Time Anomaly Detection
###### Abstract
Problems similar to the above have been addressed by different researchers. In [19], the authors proposed an anomaly detection method that includes components based on entropy analysis, signature analysis and machine learning using fractal and recurrence analysis. [PERSON] et al. [20] proposed a fuzzy aggregation approach to design an efficient IDS to be deployed in an enterprise gateway. In [21], the authors conducted a comparative study of five-time series anomaly detection models: InterFusion, RANSynCoder, GDN, LSTM-ED and USAD. In [22], the authors introduced a neighborhood rough-set-based classification approach for the anomaly detection of mixed data. Similar works were reported in [23; 24; 25; 26; 27]. In [28], the authors introduced a time-series data cube as a new data structure in handling multi-dimensional data for anomaly detection. [PERSON] et al. [29] conducted a detailed study on anomaly detection of strictly temporal data for both discrete and continuous cases. In [30], the authors presented a classification-based method of online detection of anomalies from highly unreliable data. In [31], an efficient online anomaly detection algorithm for data streams was proposed, which takes into consideration the temporal proximity of the data instances. In [32], the authors provided a foundational framework for cyber risk assessment for operational technology (OT) systems. In [33], the authors proposed how to address the insider threat posing significant cyber security challenges in industrial control systems. [PERSON] et al. [34] introduced a random forest-based approach for online anomaly detection. In [35; 36; 37], the authors proposed fuzzy based methods for real-time anomaly detections. In [38], the authors proposed a fuzzy neural network method for anomaly detection in large-scale cyberattacks. In [39], the authors proposed an efficient clustering-based real-time anomaly detection algorithm and demonstrated the efficacy of their algorithm when tested against some well-known algorithms using the datasets: DARPA, MACCDC and DEFCON. Most of the aforesaid methods have handled the time attribute associated with the dataset like any other attribute. However, considering the time attribute separately, interesting time-dependent clusters can be generated. In this article, a clustering-based anomaly detection algorithm is proposed for real-time data with mixed attributes. The algorithm follows both a partitioning and an agglomerative hierarchical approach and each cluster produced by the algorithm will have an associated fuzzy time interval as its lifetime. The algorithm starts with a partitioning approach then follows an agglomerative hierarchical approach. As the datasets are real time such as data stream, the time of generation (time-stamp) of every data instance is important and the algorithm also takes this into account. The objective of this article is as follows. * First of all, the data instance-cluster distance measure [7; 14] is defined in terms of both numeric and categorical attribute-cluster distance. * Secondly, the similarity measure of a pair of clusters is expressed in an equivalent manner and a merge function is defined in terms of it. * Finally, a two-phase method for anomaly detection is proposed. In the phase one, the first \(k\)-data instances are kept in \(k\)-different clusters along with their time stamps (time of generation) as cluster creation times or start time of the lifetimes. If a new data instance comes to any of the \(k\)-clusters, the lifetime of the cluster is extended by the current time stamp (the time-stamp associated with the data instance). Then, the cluster's categorical attribute's frequency and the mean of numeric values are updated. At the end of phase one, each cluster is having an associated lifetime. Then, the agglomerative hierarchical approach starts. In this phase, a merge function based on similarity measure is applied to merge two highly similar clusters if their lifetimes overlap.