Clusters as input for classification

Question

I'm currently performing clustering as a batch job and then in real time I'm assigning new points to cluster whose centroid is closest to new arrived point.

The other approach that I see is to cluster data (since it is unlabeled) and then use it for classification to train a model that I will use in run time to assign new arrived points.

Which of the two approaches is better?

I'm concretely using this for anomaly detection, currently I'm using clustering and if the new arrived point isn't assigned to any of the clusters (it is too far from existing centroids) I pronounce it anomalous. How could I achieve this if I'm using clustering?

Maybe I should mention that I'm considering time series.

I'm having certain number of parameters (let's say six) that represent time series. For example they represent how Temperature, Humidity, etc. change during time.

I'm trying to find anomalies using sliding window. I'm aggregating all the values from the window and that values represent a point that I am clustering. For example, a point could look like this

[Temperature1, Temperature2, Temperature3, Humidity1, Humidity2, Humidity3 ...]

When I cluster points like this I'm expecting that my model will "get a sense" of what is normal. I do that by comparing new measurements with existing centroids.

My new approach would be to use classification on top of clustering, instead of calculating distance to centroids.

I will add more information if needed.

Thanks

Answer 1

See the answer to another post, on using RTEFC or RTMAC at Multivariate time series clustering

This would eliminate the separate batch processing step. You don't really need a separate classifier either - a new condition is either "close enough" to the closest centroid, and declared a member of that cluster, or otherwise it's declared "novel". When a novel new condition is detected, an algorithm like RTEFC would normally start a new cluster centered at the new condition. But really you have a choice: either start a new cluster or don't start a new one. For outlier rejection, just declare the condition as an anomaly and don't start a new cluster or save the data. There may various reasons to start a new cluster centered at the new point: (1) You're still in a training period, (2) you want to label it as an anomaly that might be of interest and repeated in the future (for instance, as a fault condition when fault detection is one purpose of the application) , or (3) treat it as a previously undiscovered normal condition. Unfortunately, for some applications like plant monitoring, it may take years after installation before certain unusual operation conditions occur.

In any case, any cluster can be labeled when you want to introduce the supervised learning component.