# A Mixed Clustering Approach for Real-Time Anomaly Detection
###### Abstract  
Anomaly detection in real-time data is accepted as a vital area of research. Clustering techniques have effectively been applied for the detection of anomalies several times. As the datasets are real time, the time of data generation is important. Most of the existing clustering-based methods either follow a partitioning or a hierarchical approach without addressing time attributes of the dataset distinctly. In this article, a mixed clustering approach is introduced for this purpose, which also takes time attributes into consideration. It is a two-phase method that first follows a partitioning approach, then an agglomerative hierarchical approach. The dataset can have mixed attributes. In phase one, a unified metric is used that is defined based on mixed attributes. The same metric is also used for merging similar clusters in phase two. Tracking of the time stamp associated with each data instance is conducted simultaneously, producing clusters with different lifetimes in phase one. Then, in phase two, the similar clusters are merged along with their lifetimes. While merging the similar clusters, the lifetimes of the corresponding clusters with overlapping cores are merged using superimposition operation, producing a fuzzy time interval. This way, each cluster will have an associated fuzzy lifetime. The data instances either belonging to sparse clusters, not belonging to any of the clusters or falling in the fuzzy lifetimes with low membership values can be treated as anomalies. The efficacy of the algorithms can be established using both complexity analysis as well as experimental studies. The experimental results with a real world dataset and a synthetic dataset show that the proposed algorithm can detect the anomalies with 90% and 98% accuracy, respectively. data instances; real-time systems; \(k\)-means algorithm; agglomerative hierarchical algorithm; similarity measure; merge function +
Footnote †: journal: Medical  
detection recently. There are several algorithms developed for this purpose, namely \(k\)-means, _ROCK_, _CACTUS_, _DBSCAN_ and hierarchical agglomerative algorithms [5; 6; 7]. Another two important classes of clustering approaches are static clustering and dynamic clustering. Static clustering mostly deals with static datasets that are ready before the use of the algorithm. However, some applications such as wireless sensor networks, IoT, cloud computing, finance and stock markets, where data are real time, demand dynamic clustering. In [8], the authors proposed a hierarchical algorithm that can be used for both static as well as dynamic datasets. In [9], the authors proposed several incremental clustering algorithms that can process new records or data instances as they are added to the dataset. In [10], the authors employed the Elzaki disintegration strategy for solving non-linear equations of Emden-Fowler models. In [11], a fractional order was used for the glioblastoma multiform (GBM) and IS interaction models. As mentioned earlier, clustering has been widely employed in many areas of anomaly detection. In [12], an algorithm was proposed, which can detect anomalies from datasets with mixed attributes. Using distance and dissimilarity functions, a fuzzy \(c\)-means-based clustering method was discussed in [13], which works nicely on both numeric and categorical attributes. In [14], an approach for anomaly detection of a mixed-attribute-dataset was proposed, which adopts both partitioning and hierarchical approaches. Although most of the above-mentioned works were on static datasets, a few addressed the dynamicity of datasets. Anomaly detection from real-time data is interesting and has caught the attention of many researchers. In [15], the authors proposed an anomaly detection technique for the aforesaid data, which can be applicable to both multi-dimensional as well as categorical data. Similar works were presented in [16; 17; 18]. Since the data generated by real-time systems are real time, there is a need to detect the anomalies at the time of the data generation.