A Hybrid Clustering Approach Based on Fuzzy Logic and Evolutionary Computation for Anomaly Detection

Abstract

In this study, a new approach for novelty and anomaly detection, called HPFuzzNDA, is introduced. It is similar to the Possibilistic Fuzzy multi-class Novelty Detector (PFuzzND), which was originally developed for data streams. Both algorithms initially use a portion of labelled data from known classes to divide them into a given number of clusters, and then attempt to determine if the new instances, which may be unlabelled, belong to the known or novel classes or if they are anomalies, namely if they are extreme values that deviate from other observations, indicating noise or errors in measurement. However, for each class in HPFuzzNDA clusters are designed by using the new evolutionary algorithm NL-SHADE-RSP, the latter is a modification of the well-known L-SHADE approach. Additionally, the number of clusters for all classes is automatically adjusted in each step of HPFuzzNDA to improve its efficiency. The performance of the HPFuzzNDA approach was evaluated on a set of benchmark problems, specifically generated for novelty and anomaly detection. Experimental results demonstrated the workability and usefulness of the proposed approach as it was able to detect extensions of the known classes and to find new classes in addition to the anomalies. Moreover, numerical results showed that it outperformed PFuzzND. This was exhibited by the new mechanism proposed for cluster adjustments allowing HPFuzzNDA to achieve better classification accuracy in addition to better results in terms of macro F-score metric.

1. Introduction

Novelty detection has been presented as a one-class problem where the main goal is to discriminate examples from the normal class and everything else that does not fit into the current understanding of normalcy. The learning phase for the novelty detection problem, formalized in such a way, is based only on examples from one class, which is also referred to as the normal concept. Therefore, in the application phase, the stream of new unlabelled examples can be classified as either normal (instance belongs to the normal concept, which was learned during the training phase) or unknown (instance does not belong to the normal concept). The unknown examples can indicate the presence of a new class, known as novelty, which was not learned in the training phase, or they can be anomalous data not belonging to any class. The latter can result from measurement errors, noise or other factors.

In this study, novelty detection is treated as a multi-class task, to be more specific, it is assumed that the normal concept may be composed not by one but by multiple classes. Moreover, new instances or test examples can also form multiple novel classes, or they can indicate new features of the known classes, or, lastly, they can be anomalies. It should be noted that the new classes result in a concept evolution [1], while new features of the known classes are the subject of the concept drift [2]. Thus, the decision model should be able to evolve to represent the new emergent classes or patterns.

Let us examine continuous data produced according to some probability distribution, which can change over time. These data are also denoted as data streams, and with data streams not only can novel concepts appear, but the known concepts can also evolve [3]. Thus, the dynamic nature of the normal and novel classes renders novelty detection a challenging task [4].

In this study, we propose a new algorithm, named HPFuzzNDA (Hybrid Possibilisitic Fuzzy approach with Automatically adjusted number of clusters), which is a modification of the Possibilistic Fuzzy multi-class Novelty Detector for continuous multi-class data stream problems [5]. The new approach employs the NL-SHADE-RSP algorithm [6], which is a modification of the well-known evolutionary algorithm L-SHADE [7]. Namely, NL-SHADE-RSP is used to design clusters for each known class and to determine the number of these clusters. It should be noted that the objective function for the NL-SHADE-RSP approach was the same as that proposed for the Possibilistic Fuzzy C-Means (PFCM) method [8]. Additionally, a new mechanism based on the fuzzy clustering similarity metric [9], the generalized soft C index metric [10] and mini-batch approach, is proposed to reduce the number of designed clusters where necessary.

Thus, the main contributions of this paper are as follows:

• NL-SHADE-RSP is able to design a more appropriate number of clusters for each class, normal or novel, which is supported by the experimental results, thus, the NL-SHADE-RSP algorithm presents a more flexible approach for clustering as it is not limited by a predefined number of clusters unlike the PFCM approach used for PFuzzND.
• For each class, the number of clusters is not fixed and can increase or decrease over time, so the final decision model can be simplified and vice versa, depending on the given dataset, and as a result, better classification results can be achieved.
• A new additional mechanism, proposed for the automated adjustment of the number of clusters, helps to increase the classification accuracy as the “borders” of clusters of different classes, and consequently, the “borders” of these classes, are better distinguished compared to the PFuzzND approach.
• The proposed algorithm is able to learn novel concepts or extensions of the known concepts as well as to detect anomalies that do not belong to any of the classes (known or novel) better than the original PFuzzND method, in terms of classification accuracy, macro F-score metric and the unknown rate measure [11], which is confirmed by the experimental results.

Thus, the paper is organized as follows. The main subjects of the related works are briefly explained in Section 2. The problem statement and our approach are presented in Section 3. The experimental methodology and setup as well as numerical results, obtained for different benchmark datasets, are described in Section 4. Finally, the discussion and conclusions (as well as the possibilities of future work) are given in Section 5 and Section 6, respectively.

2. Related Work

As was mentioned, in this paper, a new approach for novelty and anomaly detection is introduced. However, firstly, the distinction between these two terms should be given, and for this purpose the definitions presented in [12] are used.

In [12], two novelty detection learning scenarios were distinguished, namely the static and the dynamic scenarios. In the static scenario [13,14,15], the novelty detection problem is considered as a binary classification problem. Thus, a given dataset is composed by only one class and the designed model should be able to identify whether the newly arrived instance is normal or not, as the latter means that the novelty was detected [16,17].

The dynamic novelty detection, also known as evolving classes, future classes or novel class detection [11,18,19], can be formalized as a classification problem with an unknown number of labels. Therefore, the classifier has to determine whether the new instance belongs to one of the currently known classes or not. To be more specific, if the classifier is not sure whether the considered instance belongs to one of the known classes, then this instance should be stored in some external buffer [20,21]. The instances stored in the mentioned buffer are clustered when their number is sufficient, and later the obtained validated clusters are evaluated as either extensions of some known classes or novelties.

It should be noted that as the classes change over time, the classifier must be updated to be able to detect these changes. Thus, there are two possible outcomes of applying a given model for the dynamic novelty detection problem: concept evolution [4] and concept drift [22]. Concept evolution refers to the appearance of novel classes in dynamically updated datasets. Novel concepts should be determined as soon as they appear in data so that they can also be assimilated into the underlying concept for further detection of recurring novel class instances. The term concept drift refers to changes in the conditional distribution of the output or, in other words, target variable given the input features, while the distribution of the input features may stay unchanged [22]. Concept drift indicates that there are extensions of previously established classes, which should be considered for new incoming data instances.

In the case of anomaly detection, the data are labelled in two categories, namely the normal and anomalous categories, for example, in studies [23,24] patients with cancer and fraudulent credit-card transactions were considered as anomalies, respectively. It is assumed that anomalous instances are scarce due to the unbalanced distribution between normal and anomaly classes [25] and, thus, the anomaly detection learning scenario can be formalized as an unbalanced supervised classification problem.

Overall, the methods developed for novelty and anomaly detection can be divided into four groups:

• probabilistic methods [26,27,28,29];
• distance-based methods [30,31,32];
• reconstruction-based methods [33,34,35,36];
• deep learning methods [37,38,39,40].

Probabilistic novelty detection approaches are based on the idea that a statistical model can be designed using the training data, and then this model can be applied to estimate whether a new instance (or test sample) belongs to the same distribution or not. There are two basic models to follow when designing a statistical novelty detector: parametric and non-parametric models.

Parametric methods assume that the data come from a family of known distributions or are generated from an underlying parametric distribution [41,42,43]. The most commonly used form of distribution for continuous data is the Gaussian, but a mixture of other distributions, such as gamma, Poisson or Student’s t, can be used for more complex forms of data distribution modelling. For high dimensional data, the type of distribution has to be determined not only for one parameter, but for several interdependent parameters, thus, methods of parametric statistical novelty detection are of little use for these datasets [44]. Some well-known examples of parametric approaches include the Gaussian Mixture Models (GMM) [45] and Hidden Markov Models (HMM) [46].

Non-parametric methods do not make assumptions about the data distribution, and instead rely on estimating a distribution based on the data itself [47,48,49]. Non-parametric methods tend to be very powerful for problems that require adaptability, and those where the underlying distribution is naturally unknown. One of the most well-known non-parametric probabilistic approaches is the Parzen Windows estimator [50]. This method has been used for novelty detection in applications such as network intrusion detection [51], oil flow data [52], and mammography image analysis [53].

Distance-based methods, including clustering [54,55] or nearest-neighbour methods [56,57], represent other types of techniques that can be used for performing a task equivalent to that of estimating the probability density function of data. These methods rely on well-defined distance metrics to compute the distance or similarity measure between two data points. There are various works dedicated to this subject, for example, in [58] the authors proposed a Distance-based Angular Clustering Algorithm (DACA) for wireless networks, in [32] a novel two-phase heuristic approach for solving the problem of transporting vehicles equipped with (CVRP) was introduced. Moreover, in some cases, distance-based methods are used to pre-process data, namely, to determine the feature vectors, which are then used for other classifiers [59], etc.

Reconstruction-based approaches are frequently used in safety-critical applications for regression or classification purposes [36,60]. These types of methods can autonomously model the underlying data, and when new instances are presented to the system, the reconstruction error, defined as the distance between these instances and the output of the system, can be related to the novelty score.

Finally, deep learning for novelty and anomaly detection aims at learning feature representations or novelty/anomaly scores, respectively, via neural networks. A large number of deep learning methods have been introduced for novelty detection and they demonstrate significantly better performance than conventional approaches in addressing challenging detection problems in a variety of real-world applications [61,62,63,64,65]. Deep methods help largely improve the utilization of labelled normal data or some labelled anomaly data regardless of the data type, reducing the need for large-scale labelled data as in fully supervised settings [66]. This subsequently leads to more informed models and, thus, better recall rates. Deep methods are known for their ability to learn structures and relations from diverse types of data, such as high-dimensional tabular data, images, video, graphs, etc. However, deep learning approaches for novelty detection also have multiple disadvantages and weaknesses, which are explained in detail in the review [66].

A short summary of the various works related to the novelty and anomaly detection is presented in

Table 1. Summary of the related work: novelty and anomaly detection approaches.

		Examples in Scientific Literature
Probabilistic Methods	Parametric Methods	[14,26,27,28,41,42,43,44,45,46]
	Non-parametric Methods	[29,47,48,49,50,51,52,53]
Distance-Based Methods		[30,31,32,54,55,56,57,58,59]
Reconstruction-Based Methods		[33,34,35,36,60]
Deep Learning Methods		[37,38,39,40,61,62,63,64,65,66]

.

Overall, previous research shows that most of the currently existing methods treat novelty and anomaly detection problems within the framework of one-class classification [67], in which one class (the specified normal or positive class) has to be distinguished from all other possibilities. However, there are some works that consider novelty detection as a multi-class task [68,69,70], but assume that more than one new class cannot appear interchangeably. In [11],, a short review of works related to anomalies and novelties in the context of dynamic multi-class settings is given. Thus, in this study, we introduce an approach that is able to treat the dynamic novelty detection learning scenario as a multi-class task as it performs classification on partially labelled data. During the examination of the unlabelled data, the proposed algorithm determines whether they form new classes or extensions of the known classes while being simultaneously able to distinguish anomalies that should be removed from a given dataset.

3. Proposed Approach

In this section, the proposed approach is described in detail. To do so, we have to explain how several algorithms work as they were used as the starting point for the new HPFuzzNDA method. Firstly, the description of the PFCM approach [8] is given as its objective function was used by the NL-SHADE-RSP [6] algorithm to design clusters for each class known at the time. Additionally, the main principles of the original PFuzzND algorithm [5] and our modification of the L-SHADE algorithm are presented.

3.1. Possibilistic Fuzzy C-Means Method

Let us consider clustering of a given dataset $X=\left\{x_1,x_2,...,x_N\right\}\in {\mathbb{R}}^p$ (where $x_i$ is the i-th data instance and p is the number of features describing instances) as a partitioning of X into $1<c<N$ subgroups such that each subgroup represents "natural" substructure in X. In [8], this partition of X, denoted as M, is a set of $2\times c\times N$ values that can be conveniently arrayed as two matrices $U={\left(u_{ij}\right)}_{c\times N}$ and $T={\left(t_{ij}\right)}_{c\times N}$:

$$\begin{array}{c}\hfill M=\left\{T\in {\mathbb{R}}^{c\times N}:0\le t_{ij}\le 1\forall i,j;\forall j\exists i:t_{ij}>0\right\}\cup \\ \hfill \cup \left\{U\in {\mathbb{R}}^{c\times N}:0\le u_{ij}\le 1\forall i,j;\sum _{i=1}^c{u}_{ij}=1\forall j;\sum _{j=1}^N{u}_{ij}>0\forall i\right\}.\end{array}$$

(1)

Equation (1) defines the set of possibilistic fuzzy partition of X. Here, U is the fuzzy matrix while T is the possibilistic one. Both matrices are mathematically identical, having entries between 0 and 1. These matrices are interpreted according to their entries. For the fuzzy matrix, U, each entry $u_{ij}$ is taken as the membership of $x_j$ in the i-th cluster of M, and for the probabilistic matrix each entry $t_{ij}$ is usually the (posterior) probability $p\left(i\right|x_j)$ that, given $x_j$, it came from cluster i. It should be noted that $t_{ij}$ is a measure that shows how typical a given entry is for i-th cluster.

In [71], the authors explained why both possibilistic and fuzzy matrices should be used for clustering and in [8] they also listed the disadvantages of both Fuzzy C-Means (FCM) [72] and Possibilistic C-Means (PCM) [73] methods. Originally, there was a constraint on the typicality values (the sum of the typicality values over all data points in a particular cluster was set to 1). Thus, in [8] the authors relax this constraint, namely, in their algorithm, the row sum of typicality values is equal to 1, but the column constraint on the membership values is retained. This leads to the following optimization problem:

$$\underset{\left(U,T,V\right)}{min}J(U,T,V;X)=\underset{\left(U,T,V\right)}{min}\sum _{j=1}^N\sum _{i=1}^c(a{u}_{ij}^m+b{t}_{ij}^{\eta })\times \left|\right|x_j-v_i{\left|\right|}^2+\sum _{i=1}^c{\gamma }_i\sum _{j=1}^N{(1-t_{ij})}^{\eta },$$

(2)

$$\sum _{i=1}^c{u}_{ij}=1\forall j,$$

(3)

$$0\le u_{ij},t_{ij}\le 1\forall i=\overline{1,c},j=\overline{1,N},$$

(4)

where $V=\left\{v_i,i=\overline{1,c}\right\}$ is the set of cluster centres, $a>0$, $b>0$, $m>1$ and $\eta >1$ are algorithm’s parameters chosen by the end-user, $\left|\right|.\left|\right|$ is the standard Euclidean distance, and ${\gamma }_i$ ($i=\overline{1,c}$) is also a user-defined constant. In (2) $u_{ij}$, $i=\overline{1,c}$, $j=\overline{1,N}$, have the same meaning as membership values in FCM, and $t_{ij}$, $i=\overline{1,c}$, $j=\overline{1,N}$, have the same interpretation as typicality values in PCM. The PFCM approach is iterative, and U, T and V are updated over each iteration according to the rules presented in [8].

3.2. Possibilistic Fuzzy Multi-Class Novelty Detector

The PFuzzND approach [5] is used for the dynamic novelty detection learning scenario. It is an improved version of the Fuzzy multi-class Novelty Detector for data streams [74], which is a fuzzy generalization of the offline–online framework presented in [11] for the MINAS approach. All the mentioned algorithms can be divided into two stages. During the first stage, called offline, the model is built using a labelled training dataset. The second stage, during which new classes may emerge and disappear and the old classes may also drift, is referred to as the online or the prediction stage.

In the offline step of the PFuzzND algorithm, a decision model is learned from a labelled set of examples using the PFCM clustering method. To be more specific, for each known class a given number of clusters, $k_{class}$, is designed, and this number is a user-defined parameter that can only increase (differently for each class) during the online stage until it reaches the maximum possible value $c_{max}$. It also should be noted that $k_{class}$ is the same for all known classes during the offline phase, and each class cannot be divided into more than $c_{max}\ge k_{class}$ clusters. Furthermore, the maximum number of clusters, $c_{max}$, that can be created for each class (normal or novel), is another user-defined parameter, which does not change during operation of the algorithm. Finally, it is assumed that generally only the portion $p_{offline}$ of instances from the dataset are labelled, and, thus, they are used during the offline stage.

Thus, let us denote the number of the classes, known at the offline stage, as $L_{kn}$, then at the beginning of the online stage the decision model is defined as the set of $L_{kn}\times k_{class}$ clusters found for all $L_{kn}$ different known classes. Additionally, an empty external set, called short memory, is created at the end of the offline phase. Examples labelled during the online stage as unknown are stored in the short memory for a time period $ts$, after this time limit, these instances are removed from the mentioned set. The latter can occur if it is established that they do not belong to the existing classes, and do not form novel classes either. Thus, these instances are considered as anomalies.

Moreover, there are four additional user-defined parameters for the online phase of the PFuzzND approach:

• The minimum number of instances (denoted as $N_{sm}$) in the short memory to start the novelty detection procedure.
• The initial threshold, ${\theta }_{init}$, to launch the classification process of the unlabelled instances.
• Two adaptation thresholds, ${\theta }_{class}$ and ${\theta }_{adapt}$, used during the classification step.

During the online step, first, for each new instance, $x_j$, its membership and typicality values related to all clusters, known at the moment, are calculated. Typicality values have more influence here as they are used to determine whether the instance $x_j$ will be labelled by one of the existing classes or will be marked as unknown. For this purpose, the highest typicality value of the j-th instance and the corresponding existing class, $y_c$ ($c=\overline{1,L_{kn}}$), are determined. Subsequently, the maximum typicality values are found for all instances considered before the new one arrives (and these instances should belong to the class $y_c$), and the mean value of these typicalities is calculated. Let us denote this mean value as $m_{ct}$, where t is a timestamp, which shows how many instances were processed after the offline stage, and, therefore, is equal to 1 at the beginning of the online stage. If the highest typicality of the new instance, $x_j$, is greater than the difference between the obtained mean value $m_{ct}$ and the adaptation threshold ${\theta }_{adapt}$, then the instance $x_j$ belongs to the class $y_c$ [5]. It should be noted that the highest typicality of the first instance processed after the offline phase is compared to the initial threshold ${\theta }_{init}$.

If the instance $x_j$ is labelled, then its typicality value is used to update $m_{ct}$, while the PFCM approach is used to update the clusters of the class $y_c$. Otherwise, the highest typicality of the new instance $x_j$ is compared to the difference between $m_{ct}$ and the adaptation threshold $\theta class$. If the highest typicality is greater than the mentioned difference, then instance $x_j$ belongs to the class $y_c$, but a new cluster with $x_j$ as its centroid should be created [5]. If instances belonging to the class $y_c$ are already divided into $c_{max}$ clusters, then the oldest cluster is removed and the new cluster with $x_j$ as its centre is generated instead of it.

If neither conditions are met, then the instance $x_j$ will be marked as unknown and stored in the short memory until the novelty detection step will not be executed. The latter happens if the number of instances marked as unknown reaches $N_{sm}$. In this case, firstly, the PFCM approach is applied to all the instances in the short memory and the pre-determined number $k_{short}$ of clusters is designed. After that, for each generated cluster its fuzzy silhouette [75] is calculated and if the obtained value is greater than 0 and the considered cluster is not empty, then this cluster is evaluated as the valid one. All validated clusters of short memory represent new patterns or novelties.

The next step of the novelty detection procedure consists of calculating the similarity between these validated clusters to the ones already existing (clusters belonging to the known classes), which is achieved by using the fuzzy clustering similarity metric introduced in [9]. Thus, the known cluster, that is the most similar to the examined cluster from the short memory, is determined. If the value of the mentioned metric for these two clusters is greater than $\varphi$ (which is another parameter of the PFuzzND approach), then all instances from the examined cluster are labelled the same way as instances of the considered known cluster. Consequently, clusters of the corresponding class are updated by the PFCM algorithm. In this case, the known class has evolved, and we are referring to the concept drift. Otherwise, a new class is created, therefore, we should increment $L_{kn}$ by one, and instances from the examined cluster are labelled as belonging to the new class.

If one of the short memory clusters is not validated, then it is discarded and its instances remain in the short memory until the model executes the novelty detection procedure again or decides to remove them all, which can happen if these instances are in the short memory for $ts$ iterations.

3.3. Evolutionary Algorithms

Differential Evolution or DE is a well-known population-based algorithm introduced in [76] for real-valued optimization problems. DE maintains a population of solutions (also called individuals or target vectors) during the search process and the key idea of this algorithm comprises the usage of difference vectors calculated between the individuals in the current populations. These difference vectors are applied to the members of the population to generate mutant solutions. DE contains only three parameters, namely the population size $NP$, scaling factor for mutation F and crossover probability $Cr$.

Generally, the initialization step is performed by randomly generating $NP$ points $v_{ij}$, $i=\overline{1,NP}$, $j=\overline{1,P}$, in the search space with uniform distribution within $\left[vmi{n}_j,vma{x}_j\right]$. Here, P is the dimensionality of the search space. Mutation, crossover and selection operators are then iteratively applied to the generated population. Originally, DE used the rand/1 mutation strategy [76]; however, most recent DE approaches, including L-SHADE [7], often use the current-to-pbest/1 strategy, which was initially proposed for the JADE algorithm [77]. The current-to-pbest strategy works as follows:

$${\tilde{v}}_{ij}=v_{ij}+F\times (v_{pbestj}-v_{ij})+F\times (v_{kj}-v_{lj}),$$

(5)

where $pbest$ is an index of one of the best individuals (the quality of individuals is estimated by their fitness values), k and l are randomly chosen indexes from the population, and scaling factor F is usually in the range $\left[0,1\right]$. Indexes $pbest$, k and l are generated in such a way that they are mutually different and are not equal to i.

The crossover operation is performed after mutation to generate a trial vector by combining the information contained in the target and mutant vectors. Specifically, during the crossover, the trial vector ${\widehat{v}}_i$, $i=\overline{1,NP}$, receives randomly chosen components from the mutant vector ${\tilde{v}}_i$ with probability $Cr\in \left[0,1\right]$ as follows:

$${\widehat{v}}_{ij}=\left\{\begin{array}{cc}{\tilde{v}}_{ij},\hfill & rand(0,1)<Cr\mathrm{or}j=jrand\hfill \\ v_{ij},\hfill & \mathrm{otherwise}\hfill \end{array}\right.,$$

(6)

where $jrand$ is a randomly chosen index from $\left[1,P\right]$, which is required to ensure that the trial vector is different from the target vector to avoid unnecessary fitness calculations.

After generating the trial vector ${\widehat{v}}_i$, the bound constraint handling method is applied. Finally, the selection step is performed after calculating the fitness function value $f\left(u\right)$ in the following way: if the trial vector ${\widehat{v}}_i$ outperforms or is equal to the parent $v_i$ in terms of fitness, then the target vector $v_i$ in the population is replaced by the trial vector ${\widehat{v}}_i$.

3.3.1. L-SHADE Algorithm

The L-SHADE approach is a modification of the DE algorithm, firstly introduced in [7]. As previously mentioned, DE has three main parameters, and deciding upon which parameter to employ presents a difficult task, as they have an impact on the algorithm’s speed and efficiency. The L-SHADE algorithm uses a set of $H=5$ historical memory cells containing values $(M_{F,q};M_{Cr,q})$ to generate new parameter values F and $Cr$ for every mutation and crossover procedure. Mentioned parameter values are sampled using a randomly chosen memory index $q\in \left[1,H\right]$ as follows:

$$F=randc(M_{F,q},0.1),$$

(7)

$$Cr=randn(M_{Cr,q},0.1),$$

(8)

where $randc(M_{F,q},0.1)$ and $randn(M_{Cr,q},0.1)$ are random numbers generated by Cauchy and normal distributions, respectively. The $Cr$ value is set to 0 or 1 if it spans outside the range $\left[0,1\right]$, and the F value is set to 1 if $F>1$ or is generated again if $F<0$. The values of F and $Cr$, which caused an improvement to an individual, are saved into two arrays, $S_F$ and $S_{Cr}$, together with the difference of the fitness value $\Delta f$.

The memory cell with index h, incrementing from 1 to H every generation, is updated as follows:

$$\Delta f_i=|f\left({\widehat{v}}_i\right)-f\left(v_i\right)|,$$

(9)

$${\omega }_i=\frac{\Delta f_i}{{\sum }_{k=1}^{\left|S\right|}\Delta f_k},$$

(10)

$$mea{n}_{\omega L}=\frac{{\sum }_{i=1}^{\left|S\right|}{\omega }_i\times S_i^2}{{\sum }_{i=1}^{\left|S\right|}{\omega }_i\times S_i},$$

(11)

where S is either $S_{Cr}$ or $S_F$. Then, the previous parameter values are used to set the new ones in the following way:

$$M_{F,q}^{g+1}=c\times M_{F,q}^g+(1-c)\times mea{n}_{\omega L}\left(F\right),$$

(12)

$$M_{Cr,q}^{g+1}=c\times M_{Cr,q}^g+(1-c)\times mea{n}_{\omega L}\left(Cr\right).$$

(13)

In the last two formulas, c is an update parameter set to $0.5$, and g is the current iteration number.

The L-SHADE algorithm uses the Linear Population Size Reduction (LPSR) approach to adjust the population size $NP$. To be more specific, it is recalculated at the end of each iteration, and the worst individuals are removed from the population. The new number of individuals depends on the available computational resources:

$$N{P}_{g+1}=round\left(\frac{N{P}_{min}-N{P}_{max}}{NF{E}_{max}}\times NFE+N{P}_{max}\right),$$

(14)

where $N{P}_{min}=4$ and $N{P}_{max}$ are the minimal and initial population sizes, respectively, $NFE$ is the current number of function evaluations, while $NF{E}_{max}$ is the maximal number of function evaluations.

Finally, L-SHADE uses an external archive A of inferior solutions. The archive, A, contains parent solutions rejected during selection operation, and is filled until its size reaches the predefined value $NA$. Once the archive is full, new solutions replace randomly selected ones in A. The current-to-pbest mutation (5) is changed to use the individuals from the archive so that the l index is taken either from the population or the archive A with a probability of $0.5$. Additionally, the archive size, $NA$, decreases together with the population size in the same manner.

3.3.2. NL-SHADE-RSP Algorithm

The NL-SHADE-RSP algorithm is a modification of the L-SHADE approach, first introduced in [6]. It is a further development of the L-SHADE-RSP algorithm, presented in [78], which uses selective pressure for the mutation procedure. The effect of the selective pressure was studied in detail in [79]. The mutation strategy proposed for the L-SHADE-RSP approach is called current-to-pbest/r, and it is different from the original current-to-pbest strategy only with regard to the choosing of indexes k and l. To be more specific, for each individual i the probability $p{r}_i$ is calculated in the following way:

$$R_i={exp}^{\frac{-i}{NP}},$$

(15)

$$p{r}_i=\frac{R_i}{{\sum }_{j=1}^{NP}{R}_j},$$

(16)

where $R_i$ is the rank of the i-th individual. In addition, ranks $R_i$, $i=\overline{1,NP}$, were set as indexes of individuals in an array sorted by the fitness values, with largest ranks assigned to the best individuals. Finally, indexes k and l were chosen with the corresponding probabilities. In NL-SHADE-RSP, the same current-to-pbest/r strategy is used, however, the rank-based selective pressure is applied only to the index l, and only if it is chosen from the population, while the index k is chosen uniformly.

In contrast to the L-SHADE and L-SHADE-RSP approaches, in NL-SHADE-RSP the population size is reduced in a non-linear manner:

$$N{P}_{g+1}=round\left(\left(N{P}_{min}-N{P}_{max}\right)NF{E}_r^{1-NF{E}_r}+N{P}_{max}\right),$$

(17)

where $NF{E}_r=\frac{NFE}{NF{E}_{max}}$ is the ratio of the current number of fitness evaluations.

The external archive A is used for the index l in the current-to-pbest/r mutation procedure with probability $p_A$, and in the NL-SHADE-RSP algorithm this probability is automatically adjusted. The latter is achieved by implementing the adaptation strategy, originally proposed for the IMODE algorithm [80]. Firstly, the probability $p_A$ should be within the range $\left[0.1,0.9\right]$, and initially it is set to $0.5$, unless the archive is empty. Then, the probability $p_A$ is calculated in the following way:

$$p_A=\frac{\frac{\Delta f_A}{n_A}}{\frac{\Delta f_A}{n_A}+\frac{\Delta f_{wA}}{1-n_A}},$$

(18)

where $n_A$ is the amount of archive usage, which is incremented every time an offspring is generated using archive A, $\Delta f_A$ and $\Delta f_{wA}$ are the fitness improvements achieved with and without archive, respectively. It should be noted that the new value of $p_A$ is checked to be within the range $\left[0.1,0.9\right]$ by applying the following rule:

$$p_A=min\left(0.9;max\left(0.1;p_A\right)\right).$$

(19)

In NL-SHADE-RSP, both binomial and exponential crossover operators are used with a probability of $0.5$. The description of the exponential crossover is given in [6]. For exponential crossover, the Success-History Adaptation (SHA) is applied, but at the beginning of the generation, the crossover rates $C{r}_i$ generated for each individual i are sorted according to fitness values, so that smaller crossover rate values are assigned to better individuals. For the binomial crossover, value $C{r}_b$ is calculated in the following way:

$$C{r}_b=\left\{\begin{array}{cc}0,\hfill & \mathrm{if}NFE<0.5\times NF{E}_{max}\hfill \\ 2\times \frac{NFE-0.5}{NF{E}_{max}},\hfill & \mathrm{otherwise}\hfill \end{array}\right..$$

(20)

Finally, the $pbest$ value for current-to-pbest/r mutation in NL-SHADE-RSP is controlled in the same way as in the jSO algorithm [81]:

$$pbest=\frac{pbes{t}_{max}-pbes{t}_{min}}{NF{E}_{max}}\times NFE+pbes{t}_{min}.$$

(21)

Note that the following user-defined parameters were used: $pbes{t}_{max}=0.4$ and $pbes{t}_{min}=0.2$. Furthermore, the $pbest$ parameter linearly decreases as it is performed in jSO.Detailed pseudo-code of the NL-SHADE-RSP algorithm is presented in [6].

3.4. The HFuzzNDA Approach

The HFuzzNDA algorithm, in contrast to the PFuzzND approach, has an additional parameter, namely the maximum possible number of clusters per class, denoted as $c_{max}$. This parameter changes over time and is initially set to a minimal value (to be more specific, it is equal to 2). To calculate the new $c_{max}$ value, the following notations are used:

• First, we check how many instances are classified (this number is denoted as $N_{in}$); after the offline stage this number is equal to $p_{offline}$, and grows incrementally during the online stage (one new instance per iteration).
• Two new parameters are introduced, namely $p_{in}$ and $p_{cmax}$; $p_{in}$ controls the speed at which the $c_{max}$ value grows, and $p_{cmax}$ shows how much $c_{max}$ grows over each iteration.
• A given number of considered instances, denoted as $N_{old}$, is saved after some number of iterations, $N_{old}=p_{offline}$ right after the offline stage.

Thus, $c_{max}$ is updated as shown in Algorithm 1 (note that in Algorithm 1 the temporary variable $c_{max}^{unr}$ only grows).

Algorithm 1 $c_{max}$ update procedure

1: After the offline stage set $p_{in}=0.1$, $p_{cmax}=0.01$, $c_{max}^{unr}=c_{max}$ 2: while online stage do 3:     if $\left(N_{in}-N_{old}\right)==round\left(p_{in}\times N_{old}\right)$ then 4:         $N_{old}=N_{in}$ 5:         $c_{max}^{unr}=\left(1+p_{cmax}\right)\times c_{max}^{unr}$ 6:         $c_{max}=round\left(\left(1+p_{cmax}\right)\times c_{max}^{unr}\right)$ 7:     end if 8: end while

Evolutionary and biology-inspired optimization algorithms are popular among researchers and are frequently used for anomaly and/or novelty detection. For example, in [82] the hybrid algorithm based on Fruit Fly Algorithm (FFA) and Ant Lion Optimizer (ALO), and in [83] the Farmland Fertility Algorithm were used, respectively, for feature selection to reduce the dimensionality of the data. Data, pre-processed in such a way, were later classified as normal or anomalous by using some well-known machine learning approaches (support vector machines, decision trees, k nearest neighbours). In this study, we did not apply an evolutionary algorithm as a pre-processing technique, instead it was used for clustering, namely, clusters’ centres were determined by the NL-SHADE-RSP algorithm. To be more specific, NL-SHADE-RSP determined centres of clusters belonging to each class and each individual represented the whole set of clusters’ centres; and no feature selection was applied. Thus, during the offline stage, the NL-SHADE-RSP approach is used to divide each known class into two clusters. For this purpose, function (2) is optimized and each individual represents the centres of the clusters. After that, the PFCM algorithm is used to obtain the membership U and typicality T matrices for these classes. The “age” of all clusters, designed during the offline stage, is recorded (they are considered as the oldest clusters).

The online stage starts with Algorithm 1 and then proceeds to check conditions, described for the PFuzzND approach, for each new instance iteratively. However, some changes were implemented to the online procedure. To be more specific, a new merging technique is applied to clusters to check if there is a need to decrease their number, and the NL-SHADE-RSP approach is used to refine clusters belonging to each class. The pseudo-code for the online stage is presented in Algorithm 2. Note that in Algorithm 2 $Ncu{r}_{sm}$ is the current number of instances stored in short memory. Furthermore, the NL-SHADE-RSP approach can change the final number of clusters belonging to the considered class. To be more specific, it is executed for all possible variants of the $k_{class}$ for a given class from 2 to the current value of $k_{class}$, and the best variant is chosen at the end of the optimization process.

Algorithm 2 One iteration of the online phase

1: Set ${\theta }_{init}$, ${\theta }_{adapt}$, ${\theta }_{class}$, $c_{max}=2$, $N_{in}=p_{offline}$, $N_{old}=p_{offline}$, $t=0$, $Ncu{r}_{sm}=0$ 2: for each new j-th instance do 3:     $t=t+1$ 4:     $N_{in}=N_{in}+1$ 5:     Calculate the highest typicality value $max{t}_{cj}$ and determine the corresponding existing class $y_c$ 6:     For instances, previously labelled as $y_c$, calculate the mean of the highest typicality values $m_{ct}$ 7:     if $\left(p_{offline}-N_{in}\right)==1$ then 8:         $m_{ct}={\theta }_{init}$ 9:     end if 10:     if $max{t}_{cj}>\left(m_{ct}-{\theta }_{adapt}\right)$ then 11:         The j-th instance belongs to class $y_c$ 12:         Update clusters that belong to the class $y_c$ by using PFCM 13:         if The number of clusters is greater than 2 then 14:            Execute the merging procedure 15:         end if 16:     else if $max{t}_{cj}>\left(m_{ct}-{\theta }_{class}\right)$ then 17:         The j-th instance belongs to class $y_c$ 18:         if The number of clusters that belong to class $y_c$ is less than $c_{m}ax$ then 19:            Increment the number of clusters that belong to class $y_c$ 20:            Create new cluster with j-th instance as its center 21:            Execute NL-SHADE-RSP to refine the clusters 22:            Calculate the membership and typicality matrices for all clusters 23:         else 24:            Determine the oldest cluster that belongs to class $y_c$ 25:            Create new cluster with j-th instance as its center 26:            Execute NL-SHADE-RSP to refine the clusters 27:            Calculate the membership and typicality matrices for all clusters 28:         end if 29:         if The number of clusters is greater than 2 then 30:            Execute the merging procedure 31:         end if 32:     else 33:         if $\left(Ncu{r}_{sm}+1\right)\le N_{sm}$ then 34:            $Ncu{r}_{sm}=Ncu{r}_{sm}+1$ 35:            Store the j-th instance in the short memory 36:         else 37:            Execute the novelty detection procedure 38:            Store the j-th instance in the updated short memory 39:         end if 40:     end if 41: end for

The original PFuzzND algorithm allows an increase in the number of clusters belonging to each class, but not the other way around. Experiments showed that in some cases the instances belonging to the same class might be divided into an excessive number of clusters which can can lead to bad classification results. Thus, in this study, it is proposed to merge clusters belonging to the same class if they are similar to each other, which allows for a decrease in their number.

In [9], fuzzy similarity metric was introduced. It can be described in the following way: firstly, the dispersions of two considered clusters are calculated, then the dissimilarity between these clusters is determined and, finally, the sum of dispersions is divided by the dissimilarity value [9]. Each cluster’s dispersion is the weighted sum of distances between instances belonging to this cluster and its centre, averaged by the number of considered instances. Note that the membership values are used as weights. The dissimilarity between two clusters is the Euclidean distance between their centres.

In our study, the typicality values are used as the weight coefficients for calculating the similarity metric. We find two of the most similar clusters belonging to a given class, and determine if they should be merged by using the generalized soft C index metric [10] (here, we denote it as $f_{merge}$). To use the latter, we have to conduct calculations for all instances that belong to the considered class. However, this can significantly slow the algorithm, so only a part $N_{c,B}$ (here, c is the class number and B is the batch size) of instances participate in calculating the $f_{merge}$ values. The pseudo-code of the proposed merging procedure is demonstrated in Algorithm 3.

Algorithm 3 The merging procedure

1: Denote the current set of clusters belonging to the considered class as $CurSet$ 2: for p-th cluster belonging to the considered class, $p=\overline{1,k_{class}}$do 3:     for q-th cluster belonging to the considered class, $q=\overline{1,k_{class}}$ do 4:         if $p\ne q$ then 5:            Calculate fuzzy similarities $F{S}_{pq}$ between p-th and q-th clusters 6:         end if 7:     end for 8: end for 9: Find the $maxFS=max\{F{S}_{pq},p=\overline{1,k_{class}},q=\overline{1,k_{class}}\}$ 10: Determine centres of the most similar clusters $cnt{r}_1$ and $cnt{r}_2$ corresponding to the $maxFS$ value 11: if$maxFS>0$then 12:     $kne{w}_{class}=k_{class}-1$ 13:     Create a new (empty) set $TempSet$, which can contain $kne{w}_{class}$ clusters 14:     Create new cluster with centre $cntr$ by merging two the most similar clusters 15:     $cntr=0.5\times (cnt{r}_1+cnt{r}_2)$ 16:     Fill set $TempSet$ with newly created cluster and all clusters from $CurSet$ except two the most similar 17:     Execute the PFCM algorithm with new $kne{w}_{class}$ clusters from $TempSet$ to update them 18:     Choose $N_b$ instances belonging to the considered class 19:     For chosen instances and both sets $TempSet$ and $CurSet$ calculate the $f_{merge}$ values 20:     Choose the set of clusters with better $f_{merge}$ value 21: end if

Finally, during the novelty detection phase, instances stored in the short memory are divided into clusters using the NL-SHADE-RSP algorithm. The maximum possible number of short-memory clusters is set to the current value of $c_{max}$. After that, membership and typicality matrices are determined. Then, the standard steps of the novelty detection procedure introduced for the PFuzzND approach are conducted.

The general scheme of the proposed approach is demonstrated in Figure 1.

4. Experimental Results

In order to verify the advantages of the proposed HPFuzzNDA algorithm, it was tested on a set of benchmark datasets, which were specifically generated to evaluate novelty detection algorithms and can be found in the corresponding repository [84]. The results obtained by the HPFuzzNDA approach for the benchmark datasets were compared against the results achieved by the PFuzzND algorithm. Only this comparison was performed for test problems due to the fact that PFuzzND outperformed the original FuzzND approach and the well-known MINAS algorithm, while the latter was the baseline for FuzzND [5].

Thus, firstly, the datasets and the evaluation metrics used in our experiments will be explained. Then, the obtained results and models will be presented.

4.1. Experimental Setup for Benchmark Problems

The performance of the proposed method was evaluated by using nine synthetic datasets named $D{S}_1$,..., $D{S}_9$ [84].

Table 2. Benchmark datasets used in experiments.

Datasets	Instances	Attributes	Classes (offline)	Classes
$D{S}_1$	1000	2	3	4
$D{S}_2$	5500	2	2	3
$D{S}_3$	10,000	2	3	3
$D{S}_4$	11,000	2	2	3
$D{S}_5$	20,000	2	3	3
$D{S}_6$	10,000	2	4	4
$D{S}_7$	10,000	2	3	3
$D{S}_8$	10,000	3	3	3
$D{S}_9$	10,000	2	4	4

presents the details of each dataset:

• Column $Instances$ indicates the total number of examples for each dataset, respectively.
• Column $Attributes$ indicates the number of features for each dataset, respectively.
• Column $Classes\left(offline\right)$ indicates the number of classes known at the offline phase.
• Column $Classes$ indicates the minimum total number of classes for each dataset (the difference between this number and the corresponding value from the column $Classes\left(offline\right)$ is the minimum number of novel classes that algorithms are expected to detect).

Both the PFuzzND and the proposed HPFuzzNDA approaches use possibilistic fuzzy clustering algorithm PFCM during offline and online phases. The parameters of the PFCM algorithm were the same for all conducted experiments and are listed in

Table 3. Parameters of the PFCM algorithm.

Parameter	Value
$expo$	2
$MaxIter$	100
$MinImp$	$0.0005$
a	1
b	4
$nc$	3

. The following notations are used in the table: $expo$ and $nc$ are constants responsible for the membership and the typicality values, a and b are constants that show the influence of the membership and the typicality values during the decision making step, $MaxIter$ is the maximum number of iterations for PFCM to generate a given number of clusters, and $MinImp$ is the minimum difference between the objective function values calculated on two consequential iterations of the PFCM algorithm (if this difference was less than $MinImp$ then calculations stopped).

It should be noted that the PFCM clustering method uses a specific parameter ${\gamma }_i$ for each i-th cluster. All these ${\gamma }_i$ parameters influence the typicality values, which in turn are necessary to determine the clusters’ centres. The ${\gamma }_i$ parameters were introduced for the possibilistic clustering method PCM [73]. In this work, they were user-defined constants, while in [85] the authors proposed to calculate these values on each iteration of the clustering algorithm. In this study, experiments were conducted only for the iteratively calculated ${\gamma }_i$.

The same basic parameters were used during the offline and the online phases (including the novelty detection procedure) for both PFuzzND and HPFuzzNDA algorithms to make the comparison between them fair. As previously mentioned, $c_{max}$ was a constant for the PFuzzND approach, and it changed over time for HPFuzzNDA. All parameters are listed in

Table 4. Basic and newly introduced parameters of the PFuzzND and HPFuzzNDA approaches.

	PFuzzND Parameters	HPFuzzNDA Parameters
Offline Phase	$m=2$	$m=2$
	$c_{max}=8$	initial $c_{max}=2$
	$p_{offline}=10\%$	$p_{offline}=10\%$
	initial $k_{class}=4$
Online Phase	${\theta }_{init}=0.3$	${\theta }_{init}=0.3$
	${\theta }_{class}=0.3$	${\theta }_{class}=0.3$
	${\theta }_{adapt}=0.1$	${\theta }_{adapt}=0.1$
		$p_{in}=0.05$
		$p_{cmax}=0.02$
		$B=40\%$ (of currently examined instances)
Novelty Detection	$m=2$	$m=2$
	$N_{sm}=40$	$N_{sm}=40$
	$ts=500$	$ts=500$
	$phi=0.45$	$phi=0.45$
	$k_{sm}=4$

. In the table, $k_{sm}$ is the number of clusters that should be designed for the short memory; it is a user-defined parameter (constant) for PFuzzND and automatically adjusted for HPFuzzNDA.

Additionally, the NL-SHADE-RSP also contains its own parameters. Most of them were taken from [6] as it was shown that they allow NL-SHADE-RSP to achieve the best optimization results. However, the following parameters were set during our experiments:

• $NF{E}_{max}=c_{max}\times (p-1)\times 100$;
• $P=c_{max}\times (p-1)+1$;
• initial $NP$ = 25;
• $N{P}_{max}=25$.

Here, p is the number of features describing each instance from the dataset, and P is the number of variables optimized by the NL-SHADE-RSP algorithm.

It should be noted that for the original PFuzzND algorithm, parameters $k_{class}$ and $k_{sm}$ are fixed during the offline phase and the novelty detection procedure, namely exactly these numbers of clusters are generated for each known class and short memory, respectively. Thus, initially the number of clusters is the same for all known classes, but can later be different for classes due to the procedures executed during the online phase. Moreover, in this study, the maximum number of clusters created for one class by PFuzzND is limited. Namely, this number cannot exceed 8 or be less than 2. Values for parameters used during the online stage (for both PFuzzND and HPFuzzNDA) were chosen according to the previously conducted experiments.

Experiments were evaluated using the incremental confusion-matrix, which evolves as soon as a new data point is classified [86]. This matrix is composed of rows and columns that represent known classes, concept drift of known classes and new classes (concept evolution), and finally unlabelled data instances (those removed from short memory). So, for each dataset, three values were calculated over 10 program runs: the accuracy, the macro F-score metric and the unknown rate measure $UnkR$ [11]. The accuracy was calculated only for the labelled data instances (new classes were not considered), while the macro F-score values were calculated considering not only the examples classified with already existing labels but also with new class labels, determined by the algorithm during the novelty detection process.

4.2. Numerical Results for Benchmark Problems

The aim of the conducted experiments was to compare the HPFuzzNDA approach with the original PFuzzND algorithm. Thus, both algorithms were executed on all 9 datasets and repeated 10 times. Results obtained on all datasets are presented in

Table 5. Results obtained by PFuzzND and HPFuzzNDA on benchmark problems.

Dataset	Algorithm	$\mathit{Acc}$	$\mathit{MF}$	$\mathit{UnkR}$	Dataset	Algorithm	$\mathit{Acc}$	$\mathit{MF}$	$\mathit{UnkR}$
$D{S}_1$	PFuzzND	95.31	95.47	2.08	$D{S}_2$	PFuzzND	93.67	93.66	0
	HPFuzzNDA	99.32	99.60	2		HPFuzzNDA	92.41	92.37	0
$D{S}_3$	PFuzzND	83.96	83.79	0	$D{S}_4$	PFuzzND	93.90	93.89	0
	HPFuzzNDA	89.31	89.08	0.0075		HPFuzzNDA	93.99	93.98	0
$D{S}_5$	PFuzzND	82.95	82.79	0.0412	$D{S}_6$	PFuzzND	97.74	97.21	4.4276
	HPFuzzNDA	88.73	88.17	0.015		HPFuzzNDA	97.91	97.42	0.725
$D{S}_7$	PFuzzND	97.54	97.53	0	$D{S}_8$	PFuzzND	96.96	96.96	0
	HPFuzzNDA	97.53	97.51	0		HPFuzzNDA	98.32	98.31	0
$D{S}_9$	PFuzzND	93.99	93.96	0
	HPFuzzNDA	95.10	95.07	0

. In these tables, results averaged by the number of program runs are shown, and $Acc$ means accuracy in % while $MF$ denotes the macro F-score metric values (they are also given in %). Additionally, the $UnkR$ values here should be multiplied by ${10}^{-3}$.

Overall, the proposed method was able to detect class extensions at the classification step and adapt the model during the online phase. Moreover, the HPFuzzNDA algorithm could also detect the new classes which emerged along the online phase for datasets that had unlabelled instances (the latter is shown in the column with the unknown measure rate values). Generally, compared to the PFuzzND approach, the new HPFuzzNDA algorithm correctly classified instances more frequently.

Additionally, to compare the efficiency of HPFuzzNDA and PFuzzND the Mann–Whitney rank sum statistical test with significance level $p_{MW}=0.01$ was used. Statistical tests were applied to the accuracy and macro F-score values, and obtained results are demonstrated in

Table 6. Results of the Mann–Whitney rank sum statistical test.

	${\mathit{DS}}_1$	${\mathit{DS}}_2$	${\mathit{DS}}_3$
Accuracy	$1.758$	$-3.250$	$3.704$
	=	−	+
Macro F-score	$1.914$	$-3.326$	$3.704$
	=	−	+
	$D{S}_4$	$D{S}_5$	$D{S}_6$
Accuracy	$-0.265$	$3.780$	$0.529$
	=	+	=
Macro F-score	$-0.227$	$3.780$	$0.529$
	=	+	=
	$D{S}_7$	$D{S}_8$	$D{S}_9$
Accuracy	$-1.022$	$2.685$	$3.780$
	=	+	+
Macro F-score	$-0.983$	$2.646$	$3.779$
	=	+	+

. It should be noted that in Table 6, the following notations are used:

• “+” means that HPFuzzNDA showed significantly better results than PFuzzND on a given problem;
• “−” means that HPFuzzNDA showed significantly poorer results than PFuzzND on a given problem;
• “=” means that there were no significant differences between results of the HPFuzzNDA and PFuzzND approaches for a given problem;

Thus, the HPFuzzNDA algorithm achieved significantly better results for four benchmark datasets and performed worse on only one dataset.

5. Discussion

For the first problem, both algorithms were able to detect the novel 4-th class. However, a portion of the instances originally belonging to the novel 4-th class, were considered as anomalies and discarded by both algorithms. The number of clusters, which were designed by HPFuzzNDA for normal classes, varied from five to nine, while for the novel class this number changed from two to six. In addition, all classes were divided into different numbers of clusters. Meanwhile, all normal and novel classes were divided into eight clusters by the PFuzzND approach, thus, the number of clusters increased to the maximum value and did not change thereafter. Figure 2 shows the example of results obtained on this dataset by both algorithms. Generally, PFuzzND achieves a lower accuracy and higher value of the unknown rate measure on $D{S}_1$. In Figure 2, it is evident that PFuzzND found more anomalies than HPFuzzNDA, but the latter was more successful while determining instances from normal classes.

PFuzzND showed significantly better results compared to HPFuzzNDA only on the second dataset according to the Mann–Whitney test. Both algorithms were able to determine that there are only two normal classes and anomalies (novel classes were not detected, which is correct in the case of this dataset). The number of clusters that were designed by HPFuzzNDA for normal classes varied from 3 to 5, while it stayed at 8 by the end of PFuzzND work. Best results obtained for this dataset by both algorithms are presented in Figure 3. To be more specific, for the example demonstrated in Figure 3, PFuzzND’s accuracy was $94.49\%$, while HPFuzzNDA correctly classified $93.53\%$ of the labelled data. Nevertheless, from this figure, it is clear that HPFuzzNDA was able to determine class extensions better than the PFuzzND approach. This might present a sign that for the second dataset it would perhaps be better to use HPFuzzNDA but with an initially increased number of clusters for classes.

According to the numerical results presented in the previous section, there is no significant difference between results obtained by both algorithms on $D{S}_4$, $D{S}_6$ and $D{S}_7$. The fourth dataset is similar to the second as there are only two normal classes and anomalies. HPFuzzNDA mostly designed models with two clusters for each class, but PFuzzND still increased the number of clusters up to the maximum value causing an unnecessary partition of instances. Example of results obtained for $D{S}_4$ is demonstrated in Figure 4.

The 6-th and the 7-th datasets contain neither anomalies nor novel classes. HPFuzzNDA mostly forms four or five clusters for each normal class, while PFuzzND shows the same behaviour as it did for previously mentioned problems. It should be noted that both algorithms mistakenly marked some instances as anomalies for $D{S}_6$, but the number of “anomalies” found by the PFuzzND approach was much bigger compared to HPFuzzNDA. This fact is highlighted in Table 5, as the value of the unknown rate measure obtained by PFuzzND for $D{S}_6$ is much greater than that obtained by HPFuzzNDA. Furthermore, slightly better accuracy was achieved by HPFuzzNDA on both datasets, $D{S}_{3}6$ and $D{S}_7$, due to the fact that PFuzzND was not always able to determine the “borders” between present classes. The latter can be clearly seen in Figure 5 and Figure 6.

HPFuzzNDA significantly outperformed PFuzzND on $D{S}_3$, $D{S}_5$, $D{S}_8$ and $D{S}_9$ datasets. For $D{S}_3$ the number of clusters varied from 4 to 9 for each class; for $D{S}_5$, $D{S}_8$ and $D{S}_9$ it changed from 2 to 4. It should be noted that PFuzzND constantly increased the number of clusters for each class until it reached the maximum value. Thus, it can be concluded that a lower number of clusters leads to better results for these datasets. The latter can be achieved by the proposed approach due to its flexibility and merging strategies.

According to the results from Table 5 and Table 6, HPFuzzNDA significantly outperformed PFuzzND in terms of accuracy and macro F-score, but unlike PFuzzND, it also had a non-zero unknown rate measure value. Figure 7 shows an example of the results obtained by both algorithms compared on $D{S}_3$. Again, it is obvious that PFuzzND could not determine the “borders” between normal classes, as instances that should have been marked as “green” were instead marked as “orange”. On the other hand, HPFuzzNDA classified a few instances as anomalies which were not present in this dataset. A similar situation can be seen in Figure 8 for $D{S}_5$. However, in the case of this dataset, PFuzzND also incorrectly marked instances as anomalies and the number of these instances was greater compared to the HPFuzzNDA approach.

Examples of results obtained for the datasets $D{S}_8$ and $D{S}_9$ are presented in Figure 9 and Figure 10, respectively. According to results from Table 5 and Table 6, HPFuzzNDA significantly outperformed the original PFuzzND approach in terms of accuracy and macro F-score metric, which is obvious from the demonstrated figures. Moreover, both algorithms were able to determine that there were no anomalies in these datasets.

6. Conclusions and Future Work

In this study, a new HPFuzzNDA approach for novelty detection is introduced. It is able to classify data and determine anomalies better than the original PFuzzND algorithm owing to HPFuzzNDA’s use of an evolutionary algorithm, namely NL-SHADE-RSP, and a specific merging mechanism, which allows a more flexible partition of data instances into clusters. Experimental results demonstrated HPFuzzNDA’s workability and usefulness. The obtained numerical results confirmed the following:

• NL-SHADE-RSP is able to design a more appropriate number of clusters for each class, normal or novel, as it is not limited by the predefined number of clusters like the PFCM approach that is used for PFuzzND.
• The final decision model, designed by the proposed HPFuzzNDA approach, can be simplified or the other way around depending on the given dataset, and consequently, better classification results can be achieved.
• An adaptation strategy, proposed to control the number of clusters belonging to each class, allows increases in classification accuracy as the “borders” of clusters of different classes, and consequently, the “borders” of these classes, are better distinguished compared to the PFuzzND approach.
• The proposed algorithm is able to learn novel concepts or extensions of the known concepts and can better detect anomalies that do belong to any of the classes (known or novel) than the original PFuzzND method in terms of classification accuracy, macro F-score metric and the unknown rate measure.

However, we introduced several new parameters in this study for the HPFuzzNDA approach and did not attempt to adjust them, although it is clear that inadequate parameter choice can lead to poor classification results. Moreover, the new algorithm was tested only on synthetic datasets, which did not contain many features, and is thus not entirely representative of real-world problems. In addition, as previously mentioned in Section 3, the evolutionary algorithm NL-SHADE-RSP is used for determining the centres of all clusters. As a result, NL-SHADE-RSP may suffer from the curse of dimensionality when used for more complex data, as the number of features may increase significantly. Therefore, there is a need for a feature selection technique that should be applied before NL-SHADE-RSP to pre-process data and decrease the number of features describing each data instance.

Thus, the future work should be focused on the following:

• Execution of additional experiments to better understand the influence of each parameter (not only the parameters of the original PFuzzND approach but also the parameters introduced in this study).
• Development of adaptation strategies for the most important parameters determined during the conducted experiments.
• Introduction of the feature selection operator to reduce the dimensionality of the data.
• Application of the proposed algorithm for more complex datasets, for example, image or video data.