# Detecting Cyber Threats in UWF-ZeekDataFall22 Using K-Means Clustering in the Big Data Environment
## 5 K-Means Clustering Results and Discussion
### Finding the Best Set of Features Within the Connection-Based Features
#### 5.5.3. Third Method: Clusters with at Least 50% Attack Data as Attack Clusters  
For the Third Method, the same feature set combinations were used as were used for the Second Method, that is, Table 13. The respective performance evaluations are presented in Table 15. The best-performing cluster size of 325 and optimally performing seed value of 200, as shown in Table 10, were used to run the various feature set combinations. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Set** & **Clusters** & **Seed** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC** & **Computation Time** & **Confusion Matrix** \\ \hline
1 & 325 & 200 & 98.74\% & 98.77\% & 98.74\% & 98.74\% & 98.75\% & 17.28 s & [[342010, 8329], [398, 346535]] \\ \hline
2 & 325 & 200 & 98.58\% & 98.60\% & 98.58\% & 98.58\% & 98.59\% & 6.96 s & [[342080, 8259], [1594, 345339]] \\ \hline
3 & 325 & 200 & 98.73\% & 98.76\% & 98.73\% & 98.73\% & 98.74\% & 20.69 s & [[341958, 8381], [411, 346522]] \\ \hline
4 & 325 & 200 & 98.52\% & 98.55\% & 98.52\% & 98.52\% & 98.52\% & 17.08 s & [[340440, 49899], [415, 346518]] \\ \hline
5 & 325 & 200 & 98.38\% & 98.42\% & 98.38\% & 98.38\% & 98.39\% & 15.86 s & [[339478, 10861], [402, 346531]] \\ \hline
6 & 325 & 200 & 98.59\% & 98.63\% & 98.59\% & 98.59\% & 98.60\% & 16.10 s & [[340943, 9396], [367, 346566]] \\ \hline
7 & 325 & 200 & 98.75\% & 98.77\% & 98.75\% & 98.75\% & 98.75\% & 16.44 s & [[342010, 8329], [384, 346549]] \\ \hline
8 & 325 & 200 & 98.73\% & 98.76\% & 98.73\% & 98.73\% & 98.74\% & 16.46 s & [[341948, 8391s], [400, 346533]] \\ \hline
9 & 325 & 200 & 98.74\% & 98.77\% & 98.74\% & 98.74\% & 98.75\% & 18.81 s & [[341998, 8341], [405, 346528]] \\ \hline
10 & 325 & 200 & 98.90\% & 98.92\% & 98.90\% & 98.90\% & 98.90\% & 19.85 s & [[34294, 346528]] \\ \hline
11 & 325 & 200 & 98.87\% & 98.89\% & 98.87\% & 98.87\% & 98.88\% & 10.28 s & [[342946, 7393], [404, 346529]] \\ \hline
12 & 325 & 200 & 98.88\% & 98.90\% & 98.88\% & 98.88\% & 98.88\% & 10.68 s & [[343651, 6688], [283, 346650]] \\ \hline \hline \end{tabular}
\end{table} 
Table 14. _Cont._ \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Set** & **Clusters** & **Seed** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC** & **Computation Time** & **Confusion Matrix** \\ \hline
9 & 325 & 200 & 98.73\% & 98.75\% & 98.73\% & 98.73\% & 98.73\% & 18.98 s & [[341787, 8552], [297, 346636]] \\ \hline
10 & 325 & 200 & 98.88\% & 98.90\% & 98.88\% & 98.88\% & 98.88\% & 18.94 s & [[342863, 7476], [304, 346629]] \\ \hline
11 & 325 & 200 & 98.86\% & 98.88\% & 98.86\% & 98.86\% & 98.86\% & 9.97 s & [[342664, 7675], [264, 346669]] \\ \hline
12 & 325 & 200 & 98.87\% & 98.89\% & 98.87\% & 98.87\% & 98.88\% & 11.00 s & [[342834, 7505], [338, 346595]] \\ \hline
**13** & **325** & **200** & **99.00\%** & **99.01\%** & **99.00\%** & **99.00\%** & **13.37 s** & **[[343651, 6688], [283, 346650]]** \\ \hline \hline \end{tabular}
\end{table} 
Table 15. Performance Across Different Feature Sets (Third Method). Analysis of the Third Method:
* Feature Selection Stability
* Results were consistent with those observed in the Second Method, suggesting that this labeling approach was similarly robust across feature sets or selections. * Best Performing Feature Sets
* Set 13 again provided the highest precision (99.01%) and recall (99.00%), confirming its stability as the best choice. The best results are bolded in Table 15.
* The best results were obtained when \"missed_bytes\", \"dest_port_zeek\", and \"src_port_zeek\" were excluded, similar to the Second Method. * Lower Performing Feature Sets
* Sets 4 and 5 resulted in a significant drop in precision and recall, reinforcing the importance of conn_state and proto in clustering accuracy in the Third Method also. * For the Third Method also, set 13 (bolded) remained the best-performing feature set, producing stable and high-accuracy results.