# Online Detection and Fuzzy Clustering of Anomalies in Non-Stationary Time Series +
## 5 Offline Anomaly Clustering
### Known Cluster Numbers  
We deploy these combinations to cluster anomalies detected from running NARX-SCAPA on the simulated data, with the constraint that they should find 16 clusters. We compare performance across methods via the Rand index [37] which counts the proportion of points allocated to the 'correct' cluster for their anomaly type. While the true anomaly type for each anomalous point is known to us, the clustering algorithms approach the problem as an unsupervised one and there are false positives among the anomalous points. Thus, to compute a performance measure, such as the Rand index, we must associate each cluster obtained with an anomaly type 1-16. This is achieved via a linear assignment algorithm [38] which chooses an anomaly type to associate with each cluster, based on the proportions of each anomaly type therein. The clustering algorithms take vectorised distribution summaries as their input, rather than the (variably sized) sets of residuals within each collective anomaly. We consider a histogram (or bin-wise frequency) summary and a discretised empirical cumulative distribution function (ECDF). Within the clustering algorithms, we compare two distance measures: the Jensen-Shannon divergence and the Euclidean distance. Under the hierarchical clustering, the histogram method achieves a Rand index of 0.51 with the Jensen-Shannon divergence and 0.43 with the Euclidean distance, and the ECDF method has a Rand index of 0.49 with Jensen-Shannon divergence and 0.44 with Euclidean distance. We therefore argue that with hierarchical clustering, compared to Euclidean distance, Jensen-Shannon divergence is a more suitable measurement for the similarity of two probability distributions. We did however find that it was more sensitive to the granularity of the discretisation, with overly coarse choices leading to unreliable results, while the algorithm using Euclidean distance remained more robust. Furthermore, due to the complexity of differentiation within the expectation-maximisation iteration, Jensen-Shannon divergence cannot be directly combined with partitioning-based clustering algorithms, e.g., k-means clustering and fuzzy c-means clustering. Meanwhile, we see in Table 4 that the ECDF works better than histogram with various clustering methods in distinguishing different types of collective anomalies in time series. Next, we have compared the performances of three commonly used clustering algorithms with Euclidean distance: hierarchical clustering, k-means clustering and fuzzy c-means clustering. K-means clustering is a well-known spatial clustering algorithm that bases on the expectation-maximisation iteration to compute k clusters with all data points assigned to their nearest cluster centroids [39]. Hierarchical clustering builds on the hierarchy of clusters that either merge or split data points with dendrograms [40]. In addition, we have also applied two state-of-the-art clustering methods that were specifically designed for time series clustering: EPEmeans and HMCluster. EPEmeans is a non-parametric clustering approach \begin{table}
\begin{tabular}{l c c c c} \hline \hline  & **Hierarchical** & **K-Means** & **Fuzzy c-Means** & **EPEmeans** & **HMCluster** \\ \hline Histogram & 0.43 & 0.59 & 0.56 & & \\ ECDF & 0.44 & 0.62 & 0.68 & 0.62 & \\ Spectral & & & & & 0.18 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Rand index comparison of distribution summaries and clustering methods. that combines the Earth Mover's Distance and k-means clustering for clustering probability distribution based on empirical cumulative distribution function (ECDF) [41]. HMCluster is a spectral theory-based hierarchical method for identifying time series with total variation distance [42]. The clustering performances using different distribution summaries and clustering methods are summarised with the Rand index in Table 4.  
The partitioning-based clustering methods--k-means clustering, fuzzy c-means clustering and EPmeans--have outperformed the tree-based clustering methods--hierarchical clustering and HMCluster.