Snort preprocessor using clustering data training