I'm trying to implement anomaly detection based on clustering. I'm hopping for confirmation of my approach, and I'm exposing my idea, being aware that I could have miss something in my analysis, so any suggestions would also be very appreciated. I'm a beginner in this area, so any help would be great.
I must also add that the data is in the time series form, and that there is a number of parameters considered.
My approach is next:
Let's say that there are 3 parameters, a, b and c. Since parameters are in time series form, I'm using sliding window, lets assume that size of the window is 4.
My representation of point is
[a1, a2, a3, a4, b1, b2, b3, b4, c1, c2, c3, c4]
[a2, a3, a4, a5, b2, b3, b4, b5, c2, c3, c4, c5]
And so on.
Then I'm using clustering (K means clustering, where I use some kind of automatized elbow method to determine the number of clusters), which gives me centroids that represent what normal signals (normal values of parameters in a window) look like.
Based on that centroids and the distance of points to its nearest centroid (concretely certain number of points farthest from centroid) when a new measurement arrives, I assign it to nearest centroid and its distance to centroid, I determine weather a signal is anomalous.
Is my approach sound, if not, what should I consider to make it work.
I have tried it on data that I have synthesized and got "good" results, by testing on injected anomalies. But I'm still not sure in this approach, because of my lack of experience.
Any comment would be great.
Thanks