A dataset is a structured collection of observations and attributes prepared for analysis or computational use. In cybersecurity, datasets turn device activity or login failures into evidence for identifying patterns, anomalies, and decisions. section 11.6 section 13.6.2
Useful cybersecurity datasets connect measurable fields to a specific investigative or operational question:
- Device activity can include bandwidth usage and access times, supporting comparisons between devices with similar or unusual login behavior. section 11.6
- Failed-login records can include user ID, login hour, device type, and failure reason, enabling analysis of causes, devices, and time periods. section 13.6.2
- Interpretation should connect observed patterns to actions such as training, access-control review, device-specific investigation, or peak-hour monitoring. section 13.6.2
Comparing device login behavior
A generated dataset contains five devices with bandwidth-usage and access-time attributes. Applying K-Means groups devices with similar behavior; a server with unusually high bandwidth usage may form a separate cluster and warrant investigation for misuse or abnormal activity. section 11.6
Listing 11.3 Grouping similar events
#Import libraries
from sklearn.cluster import KMeans #1
import pandas as pd #2
import matplotlib.pyplot as plt #3
#Sample dataset: Device login activity
data = {'Device': ['Laptop_A', 'Phone_B', 'Printer_C',
'Laptop_B', 'Server_D'], #4
'Bandwidth_Usage': [100, 200, 50, 90, 300], #5
'Access_Times': [10, 12, 3, 9, 16]} #6
df = pd.DataFrame(data) #7
#Extract features for clustering
X = df[['Bandwidth_Usage', 'Access_Times']] #8
#Apply K-means with 2 clusters
kmeans = KMeans(n_clusters=2, random_state=42) #9
df['Cluster'] = kmeans.fit_predict(X) #10
#Plot clusters
plt.scatter(df['Bandwidth_Usage'], df['Access_Times'],
c=df['Cluster'], cmap='viridis',
label='Clusters') #11
plt.title('K-Means Clustering of Login Activity') #12
plt.xlabel('Bandwidth Usage') #13
plt.ylabel('Access Times') #14
plt.grid(True) #15
plt.show() #16
The listing constructs a device-login dataset, extracts bandwidth and access-time features, assigns two K-Means clusters, and plots the results. section 11.6
