1) predict command uses Kalman's Filter. Refer to documentation.
2) associate command uses Shannon entropy (log base 2). Refer to documentation.
3) cluster command is used to bring similar events together and can be used to identify anomalies. I have not found the details on which algorithm powers it behind the scene, but I have requested Documentation Team couple of times through Splunk Docs feedback.