# A Mixed Clustering Approach for Real-Time Anomaly Detection
## 6 Experimental Analysis and Results  
For conducting the experimental study, five different clustering-based anomaly detection algorithms namely \(k\)-means [5], PCM [14], ACA [39], IF [39], onCAD [31] were chosen. The datasets used for analysis were (i) KDD Cup'99 Network anomaly dataset [44]: It is one of the most commonly used synthetic datasets for designing network intrusion detector, a predictive model to detect intrusions or attacks, from normal connections, and (ii) Kitsune Network Attack dataset [45]: It is a collection of nine network attack datasets that were obtained from either an IP-based commercial surveillance system or a network of IoT devices, each of which contained millions of network packets and various cyberattacks. The datasets were obtained via the UCI machine repository. A concise view of the dataset explaining their characteristics, the attribute's characteristics, the number of attributes, and the number of data instances is presented in Table 1.  
The experiments were conducted using MATLAB on an Intel Core i7-2600 machine with 3.4 GHz, 8 M Cache, 8 GB RAM, 500 GB Hard disc running Windows 10. Using KDDCUP'99 [44], a stream of datasets of different sizes with fixed dimension was generated, with 37 numeric, 3 categorical and 1 temporal attributes (time-stamp). The noises were kept from 0 to 5%. Similarly, using Kitsune Network attach dataset [45], another stream of datasets of different sizes was generated. The weight of each attribute was assumed to be same. The aforesaid algorithms along with the proposed one was implemented and results were recorded. The comparative analysis is presented in both tabular form and graphically in Tables 2-6, Figures 2-7. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset Size**} & \multicolumn{6}{c}{**Anomalies**} \\ \cline{2-7}  & \(k\)**-Means** & **PCM [14]** & **ACA** & **IF Model** & **OnCAD** & **Proposed Method** \\ \hline
100,000 & 4750 & 4300 & 4100 & 4200 & 4850 & 4900 \\ \hline
200,000 & 9500 & 8600 & 4200 & 8400 & 9700 & 9800 \\ \hline
300,000 & 14,250 & 12,900 & 12,300 & 12,600 & 14,550 & 14,700 \\ \hline
400,000 & 19,000 & 17,200 & 16,400 & 16,800 & 19,400 & 19,600 \\ \hline
500,000 & 23,750 & 21,500 & 20,500 & 21,000 & 24,250 & 24,500 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparative analysis of anomalies using KDDCUP’99. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset Size**} & \multicolumn{6}{c}{**No. of Clusters Obtained (for \(k\) = 12 Initially)**} \\ \cline{2-7}  & \(k\)**-Means** & **PCM [14]** & **ACA** & **IF Model** & **OnCAD** & **Proposed Method** \\ \hline
100,000 & 12 & 7 & 4 & 12 & 12 & 3 \\ \hline
200,000 & 12 & 7 & 5 & 12 & 12 & 5 \\ \hline
300,000 & 12 & 7 & 8 & 12 & 12 & 7 \\ \hline
400,000 & 12 & 7 & 10 & 12 & 12 & 8 \\ \hline
500,000 & 12 & 7 & 7 & 12 & 12 & 8 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparative analysis of output clusters using KDDCUP’99. Figure 2: Comparative analysis of output clusters using KDDCUP’99. The following inferences can be drawn from the obtained results. Firstly, the proposed algorithm outperforms the \(k\)-means [5], PCM (Partitioning clustering with merging) [14], ACA (agglomerative clustering algorithm) [39], IF (IsolationForest) [39], and OnCAD [31] as per as accuracy, sensitivity, and specificity are concern. However, in case of Kitsune Network attack dataset [45] the proposed method's accuracy is 90% which is little bit lower in case of KDDCUP'99 [44]. The reason behind this is that the Kitsune Network attack dataset is a high-dimensional dataset with 115 attributes and no feature selection method had been used here. However, the proposed algorithm's performance was better than the others. Secondly, the aforesaid algorithms have limitations in handling categorical attributes which the proposed algorithm does not as it uses a unified metric which can work nicely on both numeric and categorical attributes.