liveBook · Manning

Centroid

As explained in Cyber Threat Hunting

A centroid is the arithmetic mean of the data points assigned to a cluster and represents that cluster's center.

A centroid is the arithmetic mean of the data points assigned to a cluster. It represents the cluster’s center and provides the reference point for similarity in k-means. section 8.2

K-means uses centroids through an iterative workflow:

  • Assign each data point to its closest centroid using straight-line, or Euclidean, distance. section 8.2.1
  • Recompute each centroid as the mean of the points assigned to its cluster. section 8.2.1
  • Repeat assignment and recomputation until centroids stop changing or a maximum step count is reached. section 8.2.1
  • Scale features before clustering so variables with larger magnitudes do not dominate centroid distances. section 8.2.1

Four-cluster traffic analysis

With k = 4, k-means maps each row of df_features_one_hot_enc to one of four clusters. A run produced clusters containing 110,085, 42,279, 7,328, and 2 points; smaller clusters can receive closer analysis, while centroid calculations remain sensitive to outliers. section 8.2.4

Listing 8.16 Applying k-means to df_features_one_hot_enc
km = KMeans(n_clusters = 4)                       #1
km.fit(df_features_one_hot_enc)                   #2
df_features_one_hot_enc['cluster'] = km.labels_   #3
df_features_one_hot_enc.head()

The listing shows how to create four centroids with KMeans, fit them to the feature table, and attach the resulting cluster labels. section 8.2.4

How Cyber Threat Hunting covers it

How deep it goes
Explains centroid calculation, distance assignment, iteration, scaling, and outlier sensitivity without deriving the algorithm’s implementation.
Examples
Uses a 14-feature traffic table, four clusters, two-dimensional plots, histograms, and cluster-size counts.
What it assumes
Assumes a feature-based data set and introduces centroids through clusters, means, distances, and feature scaling.
What you can do after
Apply it via scikit-learn to fit k-means, label rows, visualize clusters, and compare cluster sizes.
How it connects
Connects centroids to k-means clustering, Euclidean distance, feature scaling, unsupervised machine learning, and outliers.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

Compare how 7 books explain centroid →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.