A practical approach for clustering large data flows of malicious URLs
x - means : extending k - means with efficient estimation of the number of clusters .