# Detecting Out-of-Distribution Samples in Complex IoT Traffic Based on Distance Loss
## 3 Proposed Approach
### Class Mean Clustering  
Decision boundaries are less effective in complex IoT traffic scenarios due to diverse device types, similar class characteristics, and severe class imbalance. In particular, minority class samples are prone to misclassification as OOD due to insufficient training, as shown in Figure 3. To mitigate this issue, we introduce class mean clustering [20], which reduces class-wise decision complexity by grouping similar classes, thereby minimizing mutual interference and improving OOD detection robustness.  
Our method computes the mean feature vector for each class and performs supervised clustering in the feature space, as shown in Algorithm 1. By merging similar classes into groups, we reduce decision boundary complexity and minimize feature overlap between groups. This helps integrate minority class samples into more representative groups, improving feature generalization. Unlike conventional unsupervised clustering, we adopt class mean clustering with supervision, leveraging class labels to guide the grouping process [21]. Through this approach, we introduce group labels and intra-group category labels, where group labels represent a higher-level aggregation of similar classes, and intra-group class labels reflect the internal structure of each group.  
Furthermore, our approach partitions the feature space of a specific model layer into distinct groups based on the clustering results. This partitioning allows us to focus on  
Figure 3: Comparison of OOD score distributions. Boxplots of OOD scores produced by MSP and our proposed method for in-distribution (ID) samples, out-of-distribution (OOD) samples, a minority class, and a majority class. (**a**) shows the distribution under MSP, which tends to misclassify minority classes as OOD and fails to detect some true OOD samples. (**b**) shows the distribution under our method, which more effectively separates ID and OOD samples despite class imbalance.  
Figure 2: Workflow of ODDL. The model clusters training data based on class means and applies a feature distance loss to optimize penultimate-layer representations, enhancing intra-group compactness and inter-group separability. At inference, Mahalanobis distances to each group are computed, and the maximum distance is used as the OOD score. An adaptive threshold is selected using KDE by locating local minima in the score distribution. Samples exceeding this threshold are classified as OOD.  
optimizing different subspaces of features, each with its own specific characteristics. By splitting the features of a layer into groups, we can allocate different feature dimensions to each group, ensuring that each group captures the most relevant features for its particular class or feature set. This helps in addressing feature imbalance and heterogeneity, as different groups may focus on different aspects of the feature space, leading to a more balanced and discriminative feature representation.  
```
0: Training set \(X_{\text{train}}\), training label set \(Y_{\text{train}}\)
0: Clustered groups for OOD detection
1:for\(i=1\) to \(C\)do
2: Compute class mean for each class \(i\):
3:\(\text{class\_mean}_{i}\leftarrow\frac{1}{|X_{\text{train}}|}\sum_{x\in X_{ \text{train}},i}x\)
4:endfor
5: Perform hierarchical clustering on class means:
6:\(group_{c}\leftarrow\text{HierarchicalClustering(class\_mean)}\)
7: Initialize group counters:
8:\(\text{class\_group}\leftarrow\textbf{0}_{G}\)
9:for\(i=1\) to \(C\)do
10: Initialize group label array as a zero vector:
11:\(\text{label\_group}\leftarrow\textbf{0}_{G}\)
12: Assign class \(i\) to corresponding group:
13:\(\text{label\_group}[\text{group}_{i}]\leftarrow\text{class\_group}[\text{ group}_{i}]\)
14: Update group counter:
15:\(\text{class\_group}[\text{group}_{i}]\leftarrow\text{class\_group}[\text{ group}_{i}]+1\)
16:endfor
```  
**Algorithm 1** Hierarchical class mean clustering algorithm