<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.0 20120330//EN" "JATS-archivearticle1.dtd">
<article xmlns:xlink="http://www.w3.org/1999/xlink">
  <front>
    <journal-meta />
    <article-meta>
      <title-group>
        <article-title>Unsupervised Hybrid Fuzzy Clustering Algorithm for Anomaly Detection</article-title>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <string-name>Akanksha Toshniwal</string-name>
          <xref ref-type="aff" rid="aff1">1</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Kavi Mahesh</string-name>
          <xref ref-type="aff" rid="aff1">1</xref>
        </contrib>
        <contrib contrib-type="author">
          <string-name>Jayashree R</string-name>
          <xref ref-type="aff" rid="aff0">0</xref>
        </contrib>
        <aff id="aff0">
          <label>0</label>
          <institution>Indian Institute of Information Technology</institution>
          ,
          <addr-line>Dharwad, KA580009</addr-line>
          ,
          <country country="IN">India</country>
        </aff>
        <aff id="aff1">
          <label>1</label>
          <institution>PES University</institution>
          ,
          <addr-line>Bangalore, KA560085</addr-line>
          ,
          <country country="IN">India</country>
        </aff>
      </contrib-group>
      <fpage>140</fpage>
      <lpage>147</lpage>
      <abstract>
        <p>Now a days every industry no matter what domain has customer service associates. Organizations with large number of customers have lot of data and events with respect to customer services. There are some unwanted events which causes customer dissatisfaction or customer attrition. These may be the rare events which may be unfavorable to the business and remain unidentified in huge data. For example, customer calls to the customer service associate and waiting in a long waiting queue, or transferred to multiple departments etc. This manuscript provides the real time algorithm to prioritize the inbound calls (inbound calls are from customer-to-customer service associate) in order to improve customer satisfaction and engagement experience by learning their behavior and detecting anomalous inbound calls. While working on fast increasing volumetric real-life data, it is impossible to tag each observation for modelling. This manuscript proposes an unsupervised machine learning algorithm for real time behavior learning and anomaly detection in inbound call data records. This is an unsupervised hybrid fuzzy algorithm which supports the real time untagged data.</p>
      </abstract>
      <kwd-group>
        <kwd>1 Anomaly Detection</kwd>
        <kwd>Fuzzy Membership Function</kwd>
        <kwd>Unsupervised Machine Learning</kwd>
        <kwd>Hybrid Algorithm</kwd>
      </kwd-group>
    </article-meta>
  </front>
  <body>
    <sec id="sec-1">
      <title>1. Introduction</title>
      <p>In most of the business organization the biggest stakeholders are customers and it is very important
to maintain the stakeholder’s interest and engagement in business. One of the biggest customer
communication department is customer service department. Customer Service representatives/associates are
responsible to grow, retain and improve customer experience and engagements. Call data records is one
of the channels where customer directly communicate to business representatives and if something goes
wrong here will result in customer dissatisfaction customer attrition. It is important to understand the
call records behavior in order to ensure customer satisfaction either by prioritizing or by attend customer
without delay in real time. We assume that there are rare call records which are lets say are in waiting
in extremely long queue, or kept on hold for long time, call drops immediately after connection etc. The
aim to detect these rare records.</p>
      <p>With the fast growing data in every field, the possibilities of unusual activities within the data
increases. These activities remain unidentified in huge data and may affect the system in long term. If the
system is business, then these unusual events could cause business a huge loss. Hence, it is important
to find out these rare activities.</p>
      <p>The rare or unusual activity in the dataset is called as an anomaly. The phenomena of detecting the
rare event or observation from a dataset is called as anomaly detection. To perform anomaly detection,
it is required to learn the patterns of the activities.</p>
      <p>This paper proposes a machine learning hybrid unsupervised Fuzzy Clustering algorithm for
anomaly detection, which detects the unusual behavior of the inbound calls based on the various factors occur
in call like hold time, queue time, department to which call was made, number of transfers within a call,
whether it is a weekday/weekend, whether the time of call is day/night etc.</p>
    </sec>
    <sec id="sec-2">
      <title>2. Previous Work</title>
      <p>
        The anomaly detection algorithms provide the rare events which occurred in groups, as
point/singular event or with context
        <xref ref-type="bibr" rid="ref5">(Toshniwal, 2020)</xref>
        ,
        <xref ref-type="bibr" rid="ref7">(Varun Chandola, 2009)</xref>
        .
        <xref ref-type="bibr" rid="ref8">(Zadeh, 1965)</xref>
        was the founder
and first person to work on fuzzy sets. In article by
        <xref ref-type="bibr" rid="ref1">(Dey, 2009)</xref>
        the method to detect anomalous users
and their communication patterns is proposed using fuzzy function. The communication graph is
extracted with call mapping among nodes and frequency mapping as thickness to edges.
        <xref ref-type="bibr" rid="ref3">(Kumar, 2018)</xref>
        proposes improved fuzzy membership function for feature selection for anomaly detection classification
problem on KDD data, that shows the performance on low frequent classes as compared to SVM, KNN,
CANN. The limitation to
        <xref ref-type="bibr" rid="ref3">(Kumar, 2018)</xref>
        is that it is a supervised approach where labelled dataset is
available but in case of the absence of the labels this algorithm fails.
3.
      </p>
    </sec>
    <sec id="sec-3">
      <title>Methodology</title>
      <p>The input to the algorithm includes all the features in call data records. A synthetic dataset with 100k
records was used to implement the algorithm. The advantage of using this methodology is that the
freedom to go to granular level. For example: the hierarchy like, day of week, time of the day,
department where call has been made and so on. The hierarchy is maintained for each call record and the
output to the hybrid algorithm are a tagged record, where each record is tagged as anomalous or normal
call. The methodology is the hybrid approach where the first step is to compute the continuous features
approximate threshold values among the hierarchies and the second step is to tag the record as
anomalous or normal.</p>
    </sec>
    <sec id="sec-4">
      <title>3.1. Fuzzy Systems</title>
      <p>A fuzzy membership function characterizes fuzziness in a fuzzy set, (whether the elements in the set
are discrete or continuous) in a graphical form for eventual use in the mathematical formalisms of fuzzy
set theory.</p>
      <p>The Fuzzy Inference System (FIS) is composition of fuzzification, defuzzification member
functions. Figure 1 is the high-level block diagram of Fuzzy Inference System. Fuzzy Inference System is
the process of formulating input/output mappings using fuzzy logic.</p>
      <p>
        Fuzzy Membership Function (FMF)
        <xref ref-type="bibr" rid="ref2">(Fuzzy Logic - Membership Function, 2020)</xref>
        is defined as the
process of generating fuzzy membership values from crisp set (fuzzification) and transforming this
fuzzy output of fuzzy inference system into crisp values (defuzzification). Formal definition of fuzzy
membership function is given below:
Let us consider fuzzy set A,
=
, µ
| Є
where µA(x) is called the membership function for the fuzzy set A. X is referred to as the universe
of discourse. The membership function associates each element x Є X with a value in the interval 0,1 .
In fuzzy sets, each elements is mapped to 0,1 by membership function. That is,
      </p>
      <p>: Є 0,1
where 0,1 means real numbers between 0 and 1 (including 0,1).</p>
      <p>There are multiple variations of fuzzy membership function. Few of them are:
……Equation (1)
…..Equation (2)
a. Triangular
b. Trapezoidal
c. S-function fuzzy membership
d. Z-function fuzzy membership
e. Gaussian fuzzy membership
This is the first step of the hybrid algorithm for anomaly detection. This module consumes and produce
the real-world continuous values also called as crisp values.</p>
      <p>•</p>
      <p>
        Fuzzification: This step takes crisp-values or the real value as the input, and returns the real
numbers between 0 and 1, see equation 1 and 2. This algorithm is implemented using the
equation 3, which denotes the S-function fuzzy membership in Figure 2.
centroid based defuzzification
        <xref ref-type="bibr" rid="ref6">(Van Leekwijck, 1999)</xref>
        function and equation 4 denotes the
computation of centroid defuzzification function.
      </p>
      <p>=
−
−
0, &lt;
, ≤</p>
      <p>≤
1, &gt;
……Equation (3)
……Equation (4)
&gt;16 /: ) **+ 2 &amp; '( 7 11+ = 0.15
ℎ5)</p>
      <p>To understand the Fuzzy Membership function, let’s have a look to an example.</p>
      <p>Figure 4 depicts a fuzzy rule which defines vehicle speed based on the temperature and climate.
Fuzzy membership function of type z, type s and triangular are used to define different temperature
rules in Figure 4 (a) and fuzzy membership function of type z and triangular are used to define different
weather rules in Figure 4 (b) for fuzzification and fuzzy membership function of type z and type s are
used to define different speed rules in Figure 4 (c) for defuzzification. Given a temperature as 16℃ and
weather as sunny 25% these rules define the speed of the vehicle is 38 M/hr. An example to understand
fuzzy membership function is given in Figure 4:
Fuzzy membership function:
% &amp;'( ) **+,-. /-01 ) **+ 2 &amp; '(
% &amp;': 7 11+ 408'5 93 :';6
3',, *-,-. /-01 45-(6 2 &amp; '(
&lt;0/ ) (/ 76''=
&gt;16 /: 45-(6 2 &amp; ':';6'5 / 5' = 16℃ , A /6 /: ) **+ 2 &amp; ' 400&amp; = 0.3&lt;0/ = 0.6
&gt;16 /: 45-(6 2 &amp; '7 11+ = 25% , A /6 /: ) **+ 2 &amp; ' 7 11+ = 0.154&amp;0 =+ = 0.35
93 &lt;0/ = 0.6 , A /6 /: 45-(6 2 &amp; '( 76''= = 38 G/</p>
    </sec>
    <sec id="sec-5">
      <title>3.2. Cluster Formation</title>
      <p>Cluster formation is the second step of the hybrid machine learning algorithm. This module
consumes the output from the fuzzy membership function and creates a hyper spherical cluster of radius
‘r’. This parameter is a hyperparameter in the algorithm, which is assigned as any real value. The
evaluation of the instances is done based on the location of the instance in multi-dimensional space. In other
words, the tagging is performed by analysing the location of the instances in multi-dimensional space.
There are following steps to identify an anomalous instance which is also shown in Figure 5:</p>
      <p>Any new instance which lies in hyper spherical cluster or on the cluster’s circumference is tagged
as anomalous instance.</p>
      <p>Any instance which lies outside the hyper spherical cluster and in quadrant Q1 are anomalous
instances, see figure 5.</p>
      <p>Any instance which lies outside the hyper spherical cluster and in quadrant Q2 is anomalous with
respect to feature vector on Y-axis.</p>
      <p>Any instance which lies outside the hyper spherical cluster and in quadrant Q4 is anomalous with
respect to feature vector on X-axis.</p>
      <p>Any instance which lies outside the hyper spherical cluster and in Quadrant Q3 are tagged as
normal instances.</p>
      <p>Due to the graphical limitations 3-dimenstional space and tagging in 2-dimensional plane is shown
instead of multidimensional space in Figure 5. Figure 5 shows the cluster with centroid (x, y, z) with
some radius ‘r’, 4-quadrants. The centroid of the hyper-spherical cluster is computed by Fuzzy
Membership Function.</p>
    </sec>
    <sec id="sec-6">
      <title>3.3. Evaluation</title>
      <p>This hybrid model was implemented on synthetic Call Data Records for Customer service dataset.
The inference of the results was done manually because it is an unsupervised machine learning
algorithm and tagged dataset is unavailable. This technique is efficient for large data while working with
granular hierarchies. Granular level represents day, time and department when the call was made, call
transfer, queue time, hold time in the hierarchy order. Hence suitable for industrial solutions. Since the
real tags are unavailable in the dataset, the results generated by proposed hybrid fuzzy-clustering
algorithm is compared with another hybrid algorithm (clustering and xg-boost). Where it has been observed
that tags associated with 99,928 records out of 100k records matched and tags associated with only 72
records out of 100k records mismatched. Which means that they both generated tagged results with
0.07% of the difference in tagging.</p>
    </sec>
    <sec id="sec-7">
      <title>4. Dataset</title>
      <p>A synthetic dataset of size 3 million rows was created. A random sample of 100k records was used
for this experiment. There are mixed featuresin dataset. The sample dataset is provided in table 1.</p>
    </sec>
    <sec id="sec-8">
      <title>5. Results</title>
      <p>This technique was implemented on the synthetic dataset for seven days of the week of size 100k
size and findings are as follows:
1. On manual inference it has been observed that there are no false alarms for anomalous class.
2. The ratio of anomaly vs nominal is exceedingly small 0.001% that shows class imbalance which
is quite challenging with supervised learning.
3. After comparing the proposed fuzzy-cluster based algorithm and another novel clustering-xg
Boost algorithm it was observed that the rate of differences gradually decreases with increase in
size of the dataset.
4. However, while implemented on granularity level, it was observed that this approach performs
better with huge data.
5. Since the dataset is unlabelled, the inference is possible by comparing or by manual
interpretations.</p>
      <p>6. The real time solution is to train supervised probabilistic model with the resulting tagged data.</p>
    </sec>
    <sec id="sec-9">
      <title>6. Conclusion</title>
      <p>Novel proposed hybrid fuzzy-clustering machine learning algorithm has potential in multiple
domains like anomalies in telecom, astronomy, automotive vehicles, performance measure of an
application on a platform, call service centres etc. and industries like medical, business, airlines, logistics etc.
This manuscript explains what anomalies are and anomalies can occur in everyday life like covid19
pandemic, attacks, wars, information security, servers, IT, vehicles, nature, weather etc.</p>
      <p>This experiment has shown one real life application for behavior learning and anomaly detection.
The proposed approach shows a potential machine learning solution to business gaps in industries.
There is no existing robust solution for this gap. The fuzzy-clustering algorithm is completely
unsupervised and hence is suitable for unlabelled real-life data. The advantages to this approach are it maintains
the hierarchy and tags the instances as normal or anomalous among the hierarchy, proposed approach
performs best on big data. There are two steps to this approach the first module uses fuzzy membership
function, and the second module uses clustering.</p>
      <p>The limitation to this approach is it does not perform well on small dataset and one should be careful
while assigning the hyperparameters.</p>
    </sec>
    <sec id="sec-10">
      <title>7. References</title>
    </sec>
  </body>
  <back>
    <ref-list>
      <ref id="ref1">
        <mixed-citation>
          [1]
          <string-name>
            <surname>Dey</surname>
            ,
            <given-names>L.</given-names>
          </string-name>
          (
          <year>2009</year>
          ).
          <article-title>Anomaly detection from call data records</article-title>
          .
          <source>International Conference on Pattern Recognition and Machine Intelligence</source>
          . Berlin, Heidelberg.: Springer.
        </mixed-citation>
      </ref>
      <ref id="ref2">
        <mixed-citation>
          [2]
          <string-name>
            <given-names>Fuzzy</given-names>
            <surname>Logic - Membership Function</surname>
          </string-name>
          . (
          <year>2020</year>
          , November). Retrieved from tutorialspoint: https://www.tutorialspoint.com/fuzzy_logic/fuzzy_logic_membership_function.htm
        </mixed-citation>
      </ref>
      <ref id="ref3">
        <mixed-citation>
          [3]
          <string-name>
            <surname>Kumar</surname>
            ,
            <given-names>G. R.</given-names>
          </string-name>
          (
          <year>2018</year>
          ).
          <article-title>Feature Clustering for Anomaly Detection Using Improved Fuzzy Membership Function.</article-title>
          .
          <source>In Proceedings of the Fourth International Conference on Engineering &amp; MIS</source>
          <year>2018</year>
          (pp.
          <fpage>1</fpage>
          -
          <lpage>9</lpage>
          ). MIS.
        </mixed-citation>
      </ref>
      <ref id="ref4">
        <mixed-citation>
          [4]
          <string-name>
            <surname>Samanta</surname>
            ,
            <given-names>D. (n.d.). Defuzzification</given-names>
          </string-name>
          <string-name>
            <surname>Methods</surname>
          </string-name>
          . Retrieved from Indian Institute of Technology Kharagpur: https://cse.iitkgp.ac.in/~dsamanta/courses/archive/sca/Archives/Chapter%205%
          <article-title>20Defuzzificatio n%20Methods</article-title>
          .pdf
        </mixed-citation>
      </ref>
      <ref id="ref5">
        <mixed-citation>
          [5]
          <string-name>
            <surname>Toshniwal</surname>
            ,
            <given-names>A. K.</given-names>
          </string-name>
          (
          <year>2020</year>
          ).
          <article-title>Overview of Anomaly Detection techniques in Machine Learning. 2020 Fourth International Conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud)(ISMAC)</article-title>
          . IEEE.
        </mixed-citation>
      </ref>
      <ref id="ref6">
        <mixed-citation>
          [6]
          <string-name>
            <given-names>Van</given-names>
            <surname>Leekwijck</surname>
          </string-name>
          ,
          <string-name>
            <surname>W. a.</surname>
          </string-name>
          (
          <year>1999</year>
          ).
          <article-title>Defuzzification: criteria and classification</article-title>
          .
          <source>Fuzzy sets and systems</source>
          , (pp.
          <fpage>159</fpage>
          -
          <lpage>178</lpage>
          ).
        </mixed-citation>
      </ref>
      <ref id="ref7">
        <mixed-citation>
          [7]
          <string-name>
            <given-names>Varun</given-names>
            <surname>Chandola</surname>
          </string-name>
          ,
          <string-name>
            <surname>A. B.</surname>
          </string-name>
          (
          <year>2009</year>
          ,
          <article-title>July)</article-title>
          .
          <source>Anomaly Detection: A Survey. ACM Computing Surveys (CSUR)</source>
          ,
          <volume>41</volume>
          ,
          <fpage>1</fpage>
          -
          <lpage>58</lpage>
          .
        </mixed-citation>
      </ref>
      <ref id="ref8">
        <mixed-citation>
          [8]
          <string-name>
            <surname>Zadeh</surname>
            ,
            <given-names>L. A.</given-names>
          </string-name>
          (
          <year>1965</year>
          ).
          <article-title>Zadeh, Fuzzy sets</article-title>
          .
          <source>Inform Control</source>
          ,
          <volume>8</volume>
          ,
          <fpage>338</fpage>
          -
          <lpage>353</lpage>
          .
        </mixed-citation>
      </ref>
    </ref-list>
  </back>
</article>