Network Intrusion Detection with Threat Agent Profiling

Table 5

Representatives of individual clusters, PAM with 7 clusters.

Cl.	Nr.	Perc.	Scan.	DDoS	Durat.	MaxI	MinI	ISP	Targ.
1	3707	81,87	2	0	1466	10	0	1	1
2	214	4,73	5	0	519	57666	1345	3	4
3	39	0,86	21	0	5116	97521	96082	8	21
4	101	2,23	10	0	7473	253549	0	2	2
5	327	7,22	24	0	6047	490830	8159	8	24
6	71	1,57	29	0	7708	494034	89426	10	29
7	69	1,52	11	0	1647	845105	0	4	9

Notes. The second and third columns report the number and percentage of threat agents in a specific cluster, respectively. The last seven columns correspond to the following characteristics: Recon.Scanning, Availability.DDoS, duration, max. idleness, min. idleness, a number of ISP, and a number of unique targets.