Network Intrusion Detection with Threat Agent Profiling

Table 10

Clusters and attributes of threat agents with DDoS attribute.

Attributes	WOA ()	WOA ()	WA ()	WA ()	2SWOA	2SWA
Cluster	2	4	Out	Out	2	Out
Count	500	101	—	—	41	—
Perc.	11,04	2,23	—	—	0,91	—
Scanning	40	10	—	—	5	—
DDoS	2	0	—	—	0	—
Duration	37156	7473	—	—	4625	—
MaxId.	540852	253549	—	—	341471	—
MinId.	22649	0	—	—	0	—
ISP	7	2	—	—	2	—
UTargets	22	2	—	—	2	—

Notes. The first column represents attributes. The other six columns correspond to the following profiling approaches: one-stage profiling without analysis of outliers (-means algorithm), one-stage profiling without analysis of outliers (PAM algorithm), one-stage profiling with analysis of outliers (-means algorithm), one-stage profiling with analysis of outliers (PAM algorithm), two-stage profiling without analysis of outliers (-means and PAM algorithms), and two-stage profiling with analysis of outliers (-means and PAM algorithms). The rows correspond to the following attributes: number of clusters, count of threat agents, percentage of threat agents in cluster to all threat agents, Recon.Scanning, availability, duration, max. Iileness, min. idleness, a number of ISP, and a number of unique targets. "Out" means outliers.