# Security Awareness in Software-Defined Multi-Domain 5G Networks
## 6 Characteristics of Application-Specific Data in the Mobile Network Testbed
### Effects on Machine Learning  
The data sets were also analysed using machine learning algorithms in order to study how the homogeneity affects to data analysis. The used algorithms were \(k\)-means [59; 60], which is a well-known clustering algorithm often used in anomaly detection, and bisecting-\(k\)-means [69], which is a fast variation of \(k\)-means where clusters are found hierarchically. We studied differences in the complexity of optimal models (i.e., the optimal cluster amount \(k\)). For the analysis, the collected data was first normalized using scripts based on scikit-learn library [70; 71] and then analysed with of Apache Spark's _clustering_ algorithms [72]. The results are only suggestive. The results of the \(k\)-means algorithm depend on the data set and may in some cases provide counterintuitive results. For this analysis, we used our IoT and video-IoT data sets, that have lots of similarities (the same core network signalling). The \(k\)-means algorithm clusters data points into \(k\) amount of clusters. The accuracy of a learned cluster model is evaluated by measuring the variance (so called Within Set Sum of Squared Errors--WSSSE), which is the combined Euclidean distance of all data points to their nearest cluster centres. Figure 12 illustrates these distances in the two distinct data sets. The \(y\)-axis shows distance values, while the \(x\)-axis depicts the \(k\) value. In \(k\)-means the average error distances decreases while cluster amount value increases but on the other hand a large \(k\) value makes models less feasible. The effective \(k\) value locates in 'elbow' points of diagrams where a decrease of WSSSE slows down. By looking the figures, we can see that in both cases, the distance to closest cluster centroids is smaller for the IoT data than it is for the combined IoT and video data (\(y\)-axis). However, the curves in the diagram cannot be directly compared as the scales for different data sets are different. Therefore, to find the optimal \(k\)-amount we compared diagrams using the shape of the diagram and by locating the 'elbow' points. Figure 11: Multidimensional scaling illustration of the testbed communication with video and IoT applications. When considering the complexity of the model (amount of clusters), the results from the \(k\)-means provide some indications that the same accuracy can be achieved with a smaller cluster amount in the IoT only case) than in the combined scenario. The \(k\)-means figure illustrates that the IoT-only curve turns upwards to a greater degree than the combined curve, so the elbow for the IoT only curve is more on the left. To obtain some numerical estimates about the differences in optimal \(k\) values, we looked at the ratio between the decrease in WSSSE value and the previous value. The decrease is less than 5% when \(k\) is 17 for the IoT-only data and 20 for the combined data. Hence, in this case, \(k\) is three clusters (15%) smaller for homogeneous data than for more heterogeneous flows. The fewer centroids there are, the more likely it is that random and uniformly-distributed'malicious' data points generate a longer distance to the centroids and, hence will be correctly interpreted as malicious. Detection of anomalies is likely to be easier when the average distances are small as in these cases the detection threshold can be set lower and will catch more anomalous datapoints. The results from bisecting-\(k\)-means (Figure 13) did not produce the same advantages in the optimal cluster count. The algorithm utilizes the hierarchical algorithm where clusters are split recursively as the algorithm progresses. The 'elbow points' were at the same locations for both the IoT and IoT/video data sets. Figure 12: The \(k\)-means clustering for IoT only and video/IoT scenarios. The diagram illustrates average distances to cluster centroids with different numbers (\(k\)) of clusters. The left side y-columns provide values for IoT data (red curves) and the right side y-columns provide values for video/IoT data (black curves).