Efficient Extraction of Network Event Types from NetFlows

Figure 7

Unidentified behavior flows resulting from Camnep clustering, identified by the new method to belong into selected types of events. The displayed numbers of these events represent clear domination in recall over the clustering approach.