I'm currently performing clustering as a batch job and then in real time I'm assigning new points to cluster whose centroid is closest to new arrived point.
The other approach that I see is to cluster data (since it is unlabeled) and then use it for classification to train a model that I will use in run time to assign new arrived points.
Which of the two approaches is better?
I'm concretely using this for anomaly detection, currently I'm using clustering and if the new arrived point isn't assigned to any of the clusters (it is too far from existing centroids) I pronounce it anomalous. How could I achieve this if I'm using clustering?
Maybe I should mention that I'm considering time series.
I'm having certain number of parameters (let's say six) that represent time series. For example they represent how Temperature, Humidity, etc. change during time.
I'm trying to find anomalies using sliding window. I'm aggregating all the values from the window and that values represent a point that I am clustering. For example, a point could look like this
[Temperature1, Temperature2, Temperature3, Humidity1, Humidity2, Humidity3 ...]
When I cluster points like this I'm expecting that my model will "get a sense" of what is normal. I do that by comparing new measurements with existing centroids.
My new approach would be to use classification on top of clustering, instead of calculating distance to centroids.
I will add more information if needed.