# A Mixed Clustering Approach for Real-Time Anomaly Detection
## 3 Problem Definitions
: _Similarity of the Cluster Pair._  
_Let C\({}_{i}\) and C\({}_{j}\); {i, j = 1, 2, \(\ldots\) k and i \(\
eq\) j be two clusters obtained by partitioning phase, and c\({}_{i}\) and c\({}_{j}\) be their centroids, then the similarity measure [14] S(C\({}_{i}\), C\({}_{j}\)) between C\({}_{i}\) and C\({}_{j}\) is expressed as,_  
\[d(x_{ip}\,,C_{j})=\frac{\left|C_{j}(A_{p}=\ x_{ip})\right|}{\left|C_{j}(A_{p} \
eq\ \varphi)\right|} \tag{2}\]4  
_where S\({}_{n}(C_{i},C_{j})\) = the similarity in numeric attributes_  
\[d(x_{ip}\,,C_{j})=\frac{\left|C_{j}(A_{p}=\ x_{ip})\right|}{\left|C_{j}(A_{p} \
eq\ \varphi)\right|} \tag{2}\]5  
_and S\({}_{c}\)(C\({}_{i}\), C\({}_{j}\)) = the similarity of C\({}_{i}\) and C\({}_{j}\) on categorical attributes [14]_  
\[d(x_{ip}\,,C_{j})=\frac{\left|C_{j}(A_{p}=\ x_{ip})\right|}{\left|C_{j}(A_{p} \
eq\ \varphi)\right|} \tag{2}\]6  
_Using Equations (13)-(15) becomes_  
\[d(x_{ip}\,,C_{j})=\frac{\left|C_{j}(A_{p}=\ x_{ip})\right|}{\left|C_{j}(A_{p} \
eq\ \varphi)\right|} \tag{2}\]7  
_In Equation (16), we subtract the similarity in categorical attributes from \(1\) to make the measure onto same scale as that of numeric attributes. Since S\({}_{n}\) (C\({}_{i}\), C\({}_{j}\)) \(\in\) [0, 1] and S\({}_{c}\)(C\({}_{i}\), C\({}_{j}\)) \(\in\) [0, 1], it follows that S(C\({}_{i}\), C\({}_{j}\)) \(\in\) [0, 1]. For identical cluster pairs, S(C\({}_{i}\), C\({}_{j}\)) \(=\) 0, and S(C\({}_{i}\), C\({}_{j}\)) \(=\) 1, for completely dissimilar pairs._  
**Definition 6**. : _Fuzzy Set._  
_A fuzzy set \(A\) in a universe of discourse \(X\) is characterized by its membership function \(\mu_{A}(x)\in[0,1]\), \(x\in X\) where \(\mu_{A}(x)\) represents the grade of membership of \(x\) in \(A\). (see e.g., (43))._  
**Definition 7**. : _Convex Normal Fuzzy Set._  
_A fuzzy set \(A\) is termed as normal (43) if \(\exists\) at least one \(x\in X\), for which \(\mu_{A}(x)=1\). For a fuzzy set \(A\), an \(\alpha\)-cut \(A_{\alpha}\)(43) is represented by \(A_{\alpha}=\{x\in X\); \(\mu_{A}(x)\geq\alpha\}\). If all the \(\alpha\)-cuts of \(A\) are convex sets then \(A\) is said to be convex (43)._  
**Definition 8**. : _Fuzzy Number._  
_A convex normal fuzzy set \(A\)(43) on the real line \(R\) with the property that \(\exists\) an \(x_{0}\in R\) such that \(\mu_{A}(x_{0})=1\), and \(\mu_{A}(x)\) is piecewise continuous is called fuzzy number._  
**Definition 9**. : _Fuzzy Interval._  
_Fuzzy intervals (43) are types of fuzzy numbers such that \(\exists\)\([a,\,b]\subset R\) such that \(\mu_{A}(x_{0})=1\) for all \(x_{0}\in[a,\,b]\), and \(\mu_{A}(x)\) is piecewise continuous._  
**Definition 10**. : _Support and core of a fuzzy set._  
_The support of a fuzzy set \(A\) in \(X\) is the crisp set containing every element of \(X\) with membership grades greater than zero in \(A\) and is notified by \(S(A)=\{x\in X\); \(\mu_{A}(x)>0\}\), whereas the core of \(A\) in \(X\) is the crisp set containing every element of \(X\) with membership grades \(1\) in \(A\) (see e.g., (43)). Obviously core \([t_{1},\,t_{2}]=[t_{1},\,t_{2}]\), since a closed interval \([t_{1},\,t_{2}]\) is an equi-fuzzy interval with membership \(1\) (see e.g., (41))._  
**Definition 11**. : _Set Superimposition._  
_In (40) an operation named superimposition (S) was proposed as follows._  
\[d(x_{ip}\,,C_{j})=\frac{\left|C_{j}(A_{p}=\ x_{ip})\right|}{\left|C_{j}(A_{p} \
eq\ \varphi)\right|} \tag{2}\]8  
_where \((A_{1}-A_{2})^{(1/2)}\) and \((A_{2}-A_{1})^{(1/2)}\) are fuzzy sets having fixed membership \((1/2)\), and \((+)\) denotes union of disjoint sets. To elaborate it, let \(A_{1}=[x_{1},\,y_{1}]\) and \(A_{2}=[x_{2},\,y_{2}]\) are two real intervals such that \(A_{1}\cap A_{2}\
eq\phi\), we would obtain a superimposed portion.