# Detecting Cyber Threats in UWF-ZeekDataFall22 Using K-Means Clustering in the Big Data Environment
## 5 K-Means Clustering Results and Discussion
### Finding the Ideal Number of Clusters
#### 5.2.1 First Method: Clusters with at Least One Attack as Attack Clusters  
In the first method, every cluster containing at least one attack was labeled as an attack cluster. Table 2 presents the results of the runs for clusters with at least one attack. A seed of 1 was used and though runs were done for all clusters between 2 and 350, only results for 2, 10, 50, 100, 200, 300, and 350 clusters are presented. Since the results were showing a downward after 300, the runs were stopped at 350.  
Analysis of the results for the First Method:  
* Performance with 2 clusters \(\bigcirc\) Since one cluster contained most of the attack points and the other cluster contained a mix of attack and normal data, both clusters were labeled as attack clusters. \(\bigcirc\) This resulted in an accuracy of only 49% and a very high number of false positives.
* Performance improvement with more clusters \(\bigcirc\) As the number of clusters increased, attacks and normal data were more effectively separated, leading to a gradual reduction in false positives.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Clusters** & **Seed** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC** & **Computation Time** & **Confusion Matrix** \\ \hline
2 & 3 & 91.97\% & 92.42\% & 91.97\% & 91.94\% & 91.94\% & 4.31 s & [[340377, 9962], [46018, 300915]] \\ \hline
10 & 3 & 91.36\% & 91.98\% & 91.36\% & 91.33\% & 91.33\% & 4.35 s & [[341417, 8922], [51267, 295666]] \\ \hline
50 & 3 & 96.98\% & 97.08\% & 96.98\% & 96.98\% & 96.99\% & 4.77 s & [[331601, 18738], [2296, 344637]] \\ \hline
100 & 3 & 98.83\% & 97.85\% & 98.83\% & 98.83\% & 98.84\% & 6.51 s & [[339413, 10926], [4150, 342783]] \\ \hline
200 & 3 & 98.30\% & 98.32\% & 98.30\% & 98.30\% & 98.31\% & 5.65 s & [[341266, 9073], [2732, 344201]] \\ \hline
**300** & **3** & **98.61\%** & **98.64\%** & **98.61\%** & **98.61\%** & **98.62\%** & **20.93 s** & **[[341121, 9218], [431, 346502]]** \\ \hline
350 & 3 & 98.59\% & 98.62\% & 98.59\% & 98.59\% & 98.59\% & 24.06 s & [[341252, 9087], [723, 346210]] \\ \hline Average & & 96.38\% & 96.42\% & 96.38\% & 96.37\% & 96.37\% & 10.08 s \\ \hline \hline \end{tabular}
\end{table}
Table 4: Clusters with at least 50% Attack Data.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Clusters** & **Seed** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **AUC** & **Computation Time** & **Confusion Matrix** \\ \hline
100 & 2 & 97.12\% & 97.22\% & 97.12\% & 97.12\% & 97.13\% & 5.22 s & [[332536, 17803], [2237, 344696]] \\ \hline
200 & 2 & 98.43\% & 98.45\% & 98.43\% & 98.43\% & 98.44\% & 6.21 s & [[341667, 8672], [2229, 344704]] \\ \hlineThough the computation time increased with the number of clusters, the best performance was observed at 300 clusters, where the model achieved 97.15% precision and 96.98% recall. These results are bolded in Table 2. Beyond 300 clusters, there was a slight decrease in performance, and computation time increased further, with 350 clusters resulting in a marginal drop in precision, possibly due to over-segmentation.
* Summary of the First Method
* This method is critical for scenarios where capturing all potential attacks is paramount as it prioritizes detecting every possible attack, even at the cost of a higher number of false positives.