# Detecting Cyber Threats in UWF-ZeekDataFall22 Using K-Means Clustering in the Big Data Environment
## 5 K-Means Clustering Results and Discussion
### Finding the Best Set of Features Within the Connection-Based Features
#### 5.5.2 Second Method: Clusters with at Least 25% Attack Data as Attack Clusters  
For the Second Method, that is, for clusters with at least 25% attack data, set 1 contained the same original set of 12 connection-based features and the same techniques for keeping and removing features as was used in the First Method. The feature sets tested in the Second Method are presented in Table 13 and the corresponding performance evaluations for these feature sets are provided in Table 14. The best-performing cluster size of 325 and optimally performing seed value of 200, as shown in Table 9, were used to run the various feature set combinations. Analysis of the Second Method:  
* Effectiveness of Feature Combinations
* Performance was less sensitive to feature selection compared to the First Method, but significant differences were still observed. * Certain sets, such as set 13, provided consistently high results. * Best Performing Feature Sets
* Set 13 achieved the highest precision (99.01%) and recall (99.00%), confirming its effectiveness for the Second Method. * This feature set performed best when \"missed_bytes\", \"dest_port_zeeek\", and \"src_port_zeeek\" were excluded, indicating that removing these features improved the clustering efficiency. * Lower Performing Feature Sets
* Sets 4 and 5 showed lower performance, highlighting the importance of conn_state and proto in maintaining high detection accuracy in the Second Method. * For the Second Method, set 13 (bolded) remained the best-performing feature set, producing stable and high-accuracy results. Hence, the best-performing connection-based features using the Second Method are: duration, resp_pkts, conn_state, proto, orig_ip_bytes, orig_pkts, resp_ip_bytes, orig_bytes, and resp_bytes. Also, set 13 had the lowest memory usage estimation. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline \hline
**Feature** & **Set 1** & **Set 2** & **Set 3** & **Set 4** & **Set 5** & **Set 6** & **Set 7** & **Set 8** & **Set 9** & **Set 10** & **Set 11** & **Set 12** & **Set 13** \\ \hline duration & X & & X & X & X & X & X & X & X & X & X & X & X \\ \hline resp\_pkts & X & X & & X & X & X & X & X & X & X & X & X & X \\ \hline conn\_state & X & X & X & & X & X & X & X & X & X & X & X & X \\ \hline proto & X & X & X & X & & X & X & X & X & X & X & X & X \\ \hline orig\_ip\_bytes & X & X & X & X & X & & X & X & X & X & X & X & X \\ \hline missed\_bytes & X & X & X & X & X & X & & & & & & & \\ \hline orig\_pkts & X & X & X & X & X & X & & & X & X & X & X & X \\ \hline resp\_ip\_bytes & X & X & X & X & X & X & X & X & & X & X & X & X \\ \hline dest\_port\_zeek & X & X & X & X & X & X & X & X & X & & & & \\ \hline orig\_bytes & X & X & X & X & X & X & X & X & X & X & & X & X \\ \hline resp\_bytes & X & X & X & X & X & X & X & X & X & X & & & \\ \hline src\_port\_zeek & X & X & X & X & X & X & X & X & X & X & X & X & \\ \hline Memory & & & & & & & & & & & & & \\ Estimation (MB) & 64.1 & 58.8 & 58.8 & 58.8 & 58.8 & 58.8 & 53.4 & 53.4 & 48.1 & 48.1 & **48.1** \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Performance Across Different Feature Sets (Second Method).