Network Intrusion Detection with Threat Agent Profiling

Table 9

Representatives of individual clusters without outliers, -means and PAM with 7 clusters.

Cl.	Nr.	Perc.	Scan.	Durat.	MaxI	MinI	ISP	Targ.
1	3945	90,59	5	3482	6398	618	1	2
2	41	0,94	4	2590	325932	0	2	2
3	104	2,39	22	4944	454451	12671	9	22
4	88	2,02	19	4854	490817	8186	6	18
5	76	1,75	25	5953	542251	6467	10	25
6	43	0,99	22	5672	547353	78251	7	22
7	58	1,33	9	1008	609776	−7	2	6

Notes. The second and third columns report the number and percentage of threat agents in a specific cluster, respectively. The last six columns correspond to the following characteristics: Recon.Scanning, duration, max. idleness, min. idleness, a number of ISP, and a number of unique targets.