Preprocessing Algorithm for K-Means Anomaly Detection on Payment Logs

The payment aggregator system with the single settlement feature enhances transaction efficiency. However, this also poses risks of cyberattacks and system errors. These risks can lead to abnormal events or anomalies. The middleware service records transaction activities in the form of logs. Log data can be analyzed for anomaly detection resulting from cyberattacks or system errors.K-Means clustering is less effective in detecting anomalies in log data because transaction log data is often unstructured, inconsistent, and has varying feature scales.This study develops a preprocessing algorithm to improve data quality before clustering. Transaction log data from July to December 2023 is used, with preprocessing stages including normalization, standardization, and Principal Component Analysis (PCA). K-Means is applied with K-Means++ initialization, and the number of clusters is determined using the kneedle algorithm. The results show that standardization improves segmentation, and PCA enhances anomaly detection effectiveness.