Network Intrusion Detection with Threat Agent Profiling

Table 7

Representatives of individual clusters without outliers, PAM with 7 clusters.

Cl.	Nr.	Perc.	Scan.	Durat.	MaxI	MinI	ISP	Targ.
1	3692	84,78	2	1466	10	0	1	1
2	184	4,23	5	519	57666	1345	3	4
3	17	0,39	18	4524	97466	78312	7	18
4	87	2,00	10	7473	253549	0	2	2
5	254	5,83	24	6047	490830	8159	8	24
6	43	0,99	22	5672	547353	78251	7	22
7	78	1,79	7	574	608392	−10	3	5

Notes. The second and third columns report the number and percentage of threat agents in a specific cluster, respectively. The last six columns correspond to the following characteristics: Recon.Scanning, duration, max. idleness, min. idleness, a number of ISP, and a number of unique targets.