Network Intrusion Detection with Threat Agent Profiling

Table 6

Representatives of individual clusters, -means with 2 clusters without outliers.

Cl.	Nr.	Perc.	Scan.	Durat.	MaxI	MinI	ISP	Targ.
1	3945	90,59	5	3482	6398	618	1	2
2	410	9,41	19	7479	500102	15768	7	16

Notes. The second and third columns report the number and percentage of threat agents in a specific cluster, respectively. The last six columns correspond to the following characteristics: Recon.Scanning, duration, max. idleness, min. idleness, a number of ISP, and a number of unique targets.