Efficient Extraction of Network Event Types from NetFlows

Figure 3

Using the greedy endpoint-based clustering process on the incoming sequence of flows ordered by the time of collection (left) will result (right) into specific clustering (green) while missing another possible valid cluster (red).