Network Intrusion Detection with Threat Agent Profiling

Table 4

Representatives of individual clusters, -means with 2 clusters.

Cl.	Nr.	Perc.	Scan.	DDoS	Durat.	MaxI	MinI	ISP	Targ.
1	4028	88,96	22	0	18137	8341	950	1	7
2	500	11,04	40	2	37156	540852	22649	7	22

Notes. The second and third columns report the number and percentage of threat agents in a specific cluster, respectively. The last seven columns correspond to the following characteristics: Recon.Scanning, Availability.DDoS, duration, max. idleness, min. idleness, a number of ISP, and a number of unique targets.