# Detecting Cyber Threats in UWF-ZeekDataFall22 Using K-Means Clustering in the Big Data Environment
## 5 K-Means Clustering Results and Discussion
### Finding the Ideal Number of Clusters
#### 5.3.1. First Method: Clusters with at Least One Attack as Attack Clusters  
Table 5 presents the results for runs with various seed values at 300 clusters, for clusters with at least one attack (First Method).  
Analysis of the First Method:  
* Impact of Seed Value on Clustering Stability
* Certain seed values led to significant fluctuations in precision and recall, while others resulted in stable and consistent clustering results.
* There was no definite pattern with regard to computational time.
* Best Performing Seed Values
* Seed values of 1, 10, 600, and 1000 produced very similar results, with precision and recall exceeding 97%.
* Amongst them, a seed of 600 yielded the highest overall precision (97.26%) and recall (97.10%), slightly outperforming other values. The computational time was also on the lower side at a seed value of 600. These best results are bolded in Table 5.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Clusters** & **Seed** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC** & **Computation Time** & **Confusion Matrix** \\ \hline
300 & 100 & 98.52\% & 98.53\% & 98.52\% & 98.52\% & 98.52\% & 19.35 s & [[342166, 8s173], [2144, 344789]] \\ \hline
300 & 150 & 98.59\% & 98.60\% & 98.59\% & 98.59\% & 98.59\% & 12.39 s & [[342207, 8132], [1713, 345220]] \\ \hline
**300** & **200** & **98.73\%** & **98.75\%** & **98.73\%** & **98.73\%** & **98.73\%** & **13.83 s** & [[341900, 8439], [405, 346528]] \\ \hline
300 & 250 & 98.58\% & 98.60\% & 98.58\% & 98.58\% & 98.59\% & 14.82 s & [[340897, 9442], [2125, 344808]] \\ \hline \hline \end{tabular}
\end{table}
Table 6: _Cont._  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Clusters** & **Seed** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC** & **Computation Time** & **Confusion Matrix** \\ \hline
300 & 1 & 98.59\% & 98.62\% & 98.59\% & 98.59\% & 98.60\% & 14.61 s & [[341036, 9303], [487, 346446]] \\ \hline
300 & 3 & 98.61\% & 98.64\% & 98.61\% & 98.61\% & 98.62\% & 20.60 s & [[341121, 9218], [431, 346502]] \\ \hline
300 & 10 & 98.71\% & 98.74\% & 98.71\% & 98.71\% & 98.72\% & 14.14 s & [[341906, 8433], [501, 346432]] \\ \hline
300 & 50 & 98.13\% & 98.17\% & 98.13\% & 98.13\% & 98.14\% & 12.44 s & [[338774, 11565], [1416, 345517]] \\ \hline
300 & 100 & 98.53\% & 98.54\% & 98.53\% & 98.53\% & 98.53\% & 19.49 s & [[342391, 7948], [2284, 344649]] \\ \hline
**300** & **200** & **98.73\%** & **98.76\%** & **98.73\%** & **98.73\%** & **98.74\%** & **13.74 s** & [[341997, **8342**], [**472, 346461]] \\ \hline
300 & 300 & 98.45\% & 98.47\% & 98.45\% & 98.45\% & 98.46\% & 10.81 s & [[341421, 8918], [1840, 345093]] \\ \hline
300 & 400 & 98.27\% & 98.28\% & 98.27\% & 98.27\% & 98.28\% & 10.82 s & [[342447, 7892], [4104, 342829]] \\ \hline \hline \end{tabular}
\end{table}
Table 7: Performance Across Different Seed Values (Third Method).  
* Summary of First Method with Different Seed Values
* For the First method, a seed of 600 was selected as the ideal seed, as it consistently provided the most balanced and reliable performance. The computational time was also the second lowest, being second to a seed of 300 that had significantly lower statistical performance.