# Detecting Cyber Threats in UWF-ZeekDataFall22 Using K-Means Clustering in the Big Data Environment
## 5 K-Means Clustering Results and Discussion
### Finding the Ideal Number of Clusters  
The number of clusters in K-means clustering plays a crucial role in defining how well attack data is separated from normal traffic, especially in large datasets [3]. To determine the optimal number of clusters, values ranging from 2 to 350 for the First Method and values ranging from 2 to 400 for the Second and Third methods were used, evaluating their impact on accuracy, precision, recall, F1 score, and AUC. The following subsections analyze the results obtained from each labeling heuristic, detailing how performance varied as the number of clusters increased. Since results from multiple runs demonstrated stability when keeping all the configurations the same, we reported representative runs for each configuration. The results are presented in Tables 2-4.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Clusters** & **Seed** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC** &
\begin{tabular}{c} **Computation** \\ **Time** \\ \end{tabular} & **Confusion Matrix** \\ \hline
2 & 1 & 49.76\% & 24.76\% & 49.75\% & 33.06\% & 50.00\% & 4.19 s &
\begin{tabular}{c} [[0, 350339], \\ \([0,350339]\)] \\ \end{tabular} \\ \hline
10 & 1 & 49.76\% & 75.00\% & 49.75\% & 33.07\% & 50.00\% & 4.39 s &
\begin{tabular}{c} [[11, 350328], \\ \([0,346933]\)] \\ \end{tabular} \\ \hline
50 & 1 & 51.38\% & 75.41\% & 51.37\% & 36.57\% & 51.61\% & 4.55 s &
\begin{tabular}{c} [[11307, 339032], \\ \([0,346933]\)] \\ \end{tabular} \\ \hline
100 & 1 & 52.85\% & 75.79\% & 52.84\% & 39.58\% & 53.08\% & 4.89 s &
\begin{tabular}{c} [[21557, 328782], \\ \([0,346933]\)] \\ \end{tabular} \\ \hline
200 & 1 & 76.90\% & 84.23\% & 76.90\% & 75.63\% & 77.02\% & 6.00 s &
\begin{tabular}{c} [[189295, 161044], \\ \([0,346933]\)] \\ \end{tabular} \\ \hline
**300** & **1** & **96.98\%** & **97.15\%** & **96.98\%** & **96.98\%** & **97.00\%** & **14.63 s** &
\begin{tabular}{c} [[329291, 21048], \\ \([0,346933]\)] \\ \end{tabular} \\ \hline
350 & 1 & 85.85\% & 88.98\% & 85.85\% & 85.57\% & 85.92\% & 16.05 s &
\begin{tabular}{c} [[251685, 98654], \\ \([0,346933]\)] \\ \end{tabular} \\ \hline Averages & & 66.21\% & 74.47\% & 66.21\% & 57.21\% & 66.38\% & 8.11 s & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Clusters with at least one Attack.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Clusters** & **Seed** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC** &
\begin{tabular}{c} **Computation** \\ **Time** \\ \end{tabular} & **Confusion Matrix** \\ \hline
2 & 2 & 91.97\% & 92.42\% & 91.97\% & 91.94\% & 91.94\% & 4.21 s &
\begin{tabular}{c} [[340377, 9962], \\ \([46018,300915]\)] \\ \end{tabular} \\ \hline
10 & 2 & 91.98\% & 92.43\% & 91.98\% & 91.96\% & 91.96\% & 4.59 s &
\begin{tabular}{c} [[340327, 10012], \\ \([45889,301074]\)] \\ \end{tabular} \\ \hline
50 & 2 & 96.92\% & 97.03\% & 96.92\% & 96.92\% & 96.93\% & 5.57 s &
\begin{tabular}{c} [[331052, 19287], \\ \([2158,344775]\)] \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table}
Table 3: Clusters with at least 25% Attack Data.