Network Intrusion Detection with Threat Agent Profiling

Table 8

Representatives of individual clusters, -means and PAM with 7 clusters.

Cl.	Nr.	Perc.	Scan.	DDoS	Durat.	MaxI	MinI	ISP	Targ.
1	4028	88.96	22	0	18137	8341	950	1	7
2	41	0.91	5	0	4625	341471	0	2	2
3	175	3.86	28	0	5829	472121	15893	8	27
4	87	1.92	25	0	5953	542251	6467	10	25
5	74	1.63	2	0	1306	601559	0	2	2
6	73	1.61	29	0	7708	494034	89426	10	29
7	50	1.10	13	0	1803	908578	12326	5	9

Notes. The second and third columns report the number and percentage of threat agents in a specific cluster, respectively. The last seven columns correspond to the following characteristics: Recon.Scanning, Availability.DDoS, duration, max. idleness, min. idleness, a number of ISP, and a number of unique targets.