K-Means Clustering Use-Case In Security Domain :
Tags: machinelearning
Published: 2021-07-16 10:19:55

 
K-mean clustering is the one of the easiest algorithm and is Centroid based clustering that is used under unsupervised learning. The K-means algorithm identifies k number of centroids, and then allocates every data point to the nearest cluster, while keeping the centroids as small as possible.

 
k-mean clustering algorithm is used in Machine Learning models where  one need to group the similar unlabeld data  known as clusters. And this cluster are formed by relating/finding some relation among unlabeld data set itself.

selecting the value of k(ie number of cluster) is very important, as random selection of number of cluster might be of no use (its eaxctly like zooming photo it will be of no use after a certain times of zooming in) hence selection of  right number of clusters is crucial.  
 Centroid based clustering methods iteratively measure the distance between the clusters and the characteristic centroids using various distance metrics.with the help of Euclidian distance.

The major setback here is that we should either intuitively or scientifically with help of [Elbow Method](https://en.wikipedia.org/wiki/Elbow_method_(clustering)#:~:text=In%20cluster%20analysis%2C%20the%20elbow,number%20of%20clusters%20to%20use.) define the number of clusters, “k”, to begin the iteration of any clustering machine learning algorithm to start assigning the data points.

####Elbow Method
Elbow method gives us an idea on what a good k number of clusters would be based on the sum of squared distance (SSE) between data points and their assigned clusters’ centroids. We pick k at the spot where SSE starts to flatten out and forming an elbow. We’ll use the geyser dataset and evaluate SSE for different values of k and see where the curve might form an elbow and flatten out.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3rrgoyd0zpsd418tmgyz.png)

The graph above shows that k=2 is not a bad choice. Sometimes it’s still hard to figure out a good number of clusters to use because 
the curve is monotonically decreasing and may not show any elbow or has an obvious point where the curve starts flattening out.

##Use-Cases in the Security Domain
Here is a list of some of the interesting use cases of K-means in Security Domain:
####1. Identifying crime localities
With data related to crimes available in specific localities in a city, the category of crime, the area of the crime, and the association between the two can give quality insight into crime-prone areas within a city or a locality.
####2. Insurance fraud detection
Machine Learning has a critical role to play in fraud detection and has numerous applications in automobile, healthcare, and insurance fraud detection. utilizing past historical data on fraudulent claims, it is possible to isolate new claims based on its proximity to clusters that indicate fraudulent patterns. Since insurance fraud can potentially have a multi-million dollar impact on a company, the ability to detect frauds is crucial.
####3. Cyber-profiling criminals
Cyber-profiling is the process of collecting data from individuals and groups to identify significant co-relations. The idea of cyber profiling is derived from criminal profiles, which provide information on the investigation division to classify the types of criminals who were at the crime scene.
####4. Call record detail analysis
A call detail record (cdr) is the information captured by telecom companies during the call, sms, and internet activity of a customer. This information provides greater insights about the customer’s needs when used with customer demographics. We can cluster customer activities for 24 hours by using the unsupervised k-means clustering algorithm. It is used to understand segments of customers with respect to their usage by hours.
####5. Automatic clustering of it alerts
Large enterprise it infrastructure technology components such as network, storage, or database generate large volumes of alert messages. Because alert messages potentially point to operational issues, they must be manually screened for prioritization for downstream processes. Clustering of data can provide insight into categories of alerts and mean time to repair, and help in failure predictions.
####6. Rideshare data analysis
the publicly available uber ride information dataset provides a large amount of valuable data around traffic, transit time, peak pickup localities, and more. Analyzing this data is useful not just in the context of uber but also in providing insight into urban traffic patterns and helping us plan for the cities of the future.
####7. Crime document classification
Cluster documents in multiple categories based on tags, topics, and the content of the document. This is a very standard classification problem and k-means is a highly suitable algorithm for this purpose. The initial processing of the documents is needed to represent each document as a vector and uses term frequency to identify commonly used terms that help classify the document. the document vectors are then clustered to help identify similarity in document groups.
These were few use cases but the list goes on be it in Security Domain or any other, K-means is very effective as well as easy way of Clustering in machine learning.
THANK YOU!