Clustering groups observations with similar characteristics without predefined labels. In cybersecurity, it can organize device behavior to help identify anomalies, segment network traffic, or classify threats. section 11.6 section 12.0
Cybersecurity teams can use clustering to:
- Group devices with similar login behavior, using features such as bandwidth usage and access times. section 11.6
- Flag devices that fall apart from known groups for further investigation; unusual behavior may signal misuse or a potential breach. section 11.6
- Explore relationships between variables to identify cybersecurity risk factors. section 11.10
Device login activity
A K-Means example groups five devices using bandwidth usage and access times. The resulting plot shows devices with similar behavior together; a device that stands apart may merit investigation, but a cluster assignment is a signal, not proof of compromise. section 11.6
Listing 11.3 Grouping similar events
#Import libraries
from sklearn.cluster import KMeans #1
import pandas as pd #2
import matplotlib.pyplot as plt #3
#Sample dataset: Device login activity
data = {'Device': ['Laptop_A', 'Phone_B', 'Printer_C',
'Laptop_B', 'Server_D'], #4
'Bandwidth_Usage': [100, 200, 50, 90, 300], #5
'Access_Times': [10, 12, 3, 9, 16]} #6
df = pd.DataFrame(data) #7
#Extract features for clustering
X = df[['Bandwidth_Usage', 'Access_Times']] #8
#Apply K-means with 2 clusters
kmeans = KMeans(n_clusters=2, random_state=42) #9
df['Cluster'] = kmeans.fit_predict(X) #10
#Plot clusters
plt.scatter(df['Bandwidth_Usage'], df['Access_Times'],
c=df['Cluster'], cmap='viridis',
label='Clusters') #11
plt.title('K-Means Clustering of Login Activity') #12
plt.xlabel('Bandwidth Usage') #13
plt.ylabel('Access Times') #14
plt.grid(True) #15
plt.show() #16
Inspect the Python listing to see how device features are selected, grouped into two K-Means clusters, and plotted. section 11.6
