# Detecting Cyber Threats in UWF-ZeekDataFall22 Using K-Means Clustering in the Big Data Environment
## 5 K-Means Clustering Results and Discussion
### Visualizing the Clusters  
To better understand how the attacks are distributed within the dataset and how well K-means clustering can separate them, Principal Component Analysis (PCA), a dimensionality reduction algorithm, was used to compress the feature space before graphing the data [4].  
Using PCA, first the high-dimensional feature space was transformed into two principal components, allowing for a 2D visualization of the clusters. This approach preserved as much variance as possible while making it feasible to interpret the separation between normal and attack data points. By analyzing the PCA component loadings, the most significant features contributing to each principal component were identified. The primary contributor to the first principal component was identified as orig_ip_bytes and the second principal component was identified as proto. This indicates that the number of bytes sent from the original source (orig_ip_bytes) as well as protocol type (proto) played a major role in distinguishing between normal and attack traffic.  
After applying PCA and using two principal components, the first step was to visualize the dataset without clustering, distinguishing attack data from normal data. As shown in Figure 6, the attack data (red) and normal data (blue) display a certain degree of overlap but also show some natural separation. This provided insight into the distribution of attacks before applying K-means clustering.  
After applying K-means clustering with two clusters (K = 2), the PCA model was able to separate over 92% of the attacks into one cluster. As seen in Figure 7, most attack data points are grouped into one cluster (also shown in Figure 6), confirming that a simple binary classification approach through clustering can provide significant separation between normal and attack data.  
Figure 6: Visualizing the Data Without Clustering (for two Principal Components).  
Increasing the number of clusters to three (K = 3) did not significantly improve the separation of attack data with two principal components. Figure 8 illustrates that, although an additional cluster was introduced, the separation of attacks remained relatively unchanged. This suggests that two clusters were already capturing most of the distinction between attack and normal data, and increasing to three clusters did not yield meaningful improvements.  
However, after increasing to fifty clusters (K = 50), for two principal components the point at which the model reached over 97% precision--the clustering pattern became significantly more fragmented. As shown in Figure 9, the attack and normal data points are now scattered across multiple small clusters. Though this makes it harder to interpret the visualization, it confirms that a higher number of clusters allows for finer-grained distinctions and improved precision.  
Figure 8: K-means Clustering for k = 3 (for two Principal Components).  
Figure 7: K-means Clustering for k = 2 (for two Principal Components).  
These results highlight that K-means clustering is effective in distinguishing attack traffic from normal traffic, even with as few as two clusters. The feature importance analysis using PCA further confirmed that orig_ip_bytes and proto were the strongest differentiators in the dataset, reinforcing the idea that network traffic volume and protocol types are key indicators in anomaly detection. However, as the number of clusters increases, interpretability becomes challenging, despite precision improvements. This analysis demonstrates how dimensionality reduction through PCA and clustering techniques can provide valuable insights for unsupervised anomaly detection in cybersecurity.