An outlier is an observation unusually far from an expected distribution or reference pattern. In cybersecurity, unusual device or network behavior can warrant investigation as a potential security risk. section 8.4.1 section 12.2.1
Two approaches identify unusual behavior:
- Compare historical data with a baseline using statistical measures, then flag values above a threshold such as the mean plus two standard deviations. Review false positives and adjust thresholds over time. section 8.4.1
- Group devices by observed behavior; devices outside the expected groups may merit investigation. section 11.6
Unusual network communications
A DBSCAN example compares devices’ internal and external communications. The output labels Printer_C and Server_D as outliers (-1); unusual communication patterns could signal misuse or compromise, but require investigation. section 12.2.1
Listing 12.1 DBSCAN for threat detection
import pandas as pd #1
from sklearn.cluster import DBSCAN #2
import matplotlib.pyplot as plt #3
# Create a sample dataset: Network communication patterns
data = { #4
'Device': ['Laptop_A', 'Phone_B', 'Printer_C', 'Laptop_B', 'Server_D'],
'External_Comm': [10, 15, 3, 8, 120],
#External communications (number of external IPs contacted)
'Internal_Comm': [100, 95, 200, 90, 80]
#Internal communications (number of internal IPs contacted)
}
df = pd.DataFrame(data) #5
# Extract features for clustering
X = df[['External_Comm', 'Internal_Comm']] #6
# Apply DBSCAN
dbscan = DBSCAN(eps=15, min_samples=2) #7
df['Cluster'] = dbscan.fit_predict(X) #8
#Plot the clusters
plt.figure(figsize=(8, 6)) #9
plt.scatter(df['External_Comm'], df['Internal_Comm'],
c=df['Cluster'], cmap='Greys',
label='Clusters') #10
plt.title(('DBSCAN Clustering of Network '
'Communications')) #11
plt.xlabel('External Communications') #12
plt.ylabel('Internal Communications') #13
plt.grid(True) #14
plt.show() #15
#Display the resulting clusters
print(df) #16
Run the Python listing to cluster sample devices by network communications and inspect the resulting labels. section 12.2.1
