1
$\begingroup$

I am still just dabbling in the shallower waters of machine learning and I am looking to compare the results of a Supervised algorithm (KNN) and Unsupervised algorithm (k-means) when it comes to identifying network based DOS attacks. I am stuck on how my data will fit into a k-means algorithm. In the tutorials I have seen (for example Long/Lat) the data very neatly plots onto a graph in which you can easily see how it clusters. In the link provided they use longitude and latitude locations as plot points.

In my data I have a time series which indicates when a packet was sent and I am interested in TCP and UDP packets. When there is a very high frequency of packets in a short amount of time there has been an attack. I am aware that I would have to convert the different packets types into numerical data with some form of encoding, but the issue is that when I imagine the plotted graph I can see it grouping TCP and UDP packets from the same time frame together - does that make sense?

I have included a sample of the data below. There is no attack happening in the first table, but there is a TCP flood underway in the second. So the question is how do you select the appropriate data and plot it so that a k-means algorithm can cluster it? I think its the Time feature and Protocol feature I need as the others don't really effect anything.

No. Time Source Destination Protocol Length Info
1 0 213.163.87.149 192.168.12.100 UDP 693 50019 > 55287 Len=651
2 0.009109 213.163.87.149 192.168.12.100 UDP 178 50019 > 55287 Len=136
3 0.03756 192.168.12.100 213.163.87.149 UDP 86 55287 > 50019 Len=44
4 0.040381 213.163.87.149 192.168.12.100 UDP 180 50019 > 55287 Len=138
5 0.040415 213.163.87.149 192.168.12.100 UDP 148 50019 > 55287 Len=106
6 0.051892 213.163.87.149 192.168.12.100 UDP 177 50019 > 55287 Len=135
7 0.066043 213.163.87.149 192.168.12.100 UDP 151 50019 > 55287 Len=109
8 0.068918 192.168.12.206 34.216.113.46 TCP 66 60588 > 443 [ACK] Seq=1 Ack=1 Win=501 Len=0 TSval=1855484038 TSecr=3288649611
9 0.069256 192.168.12.206 34.216.113.46 TCP 66 60576 > 443 [ACK] Seq=1 Ack=1 Win=501 Len=0 TSval=1855484038 TSecr=3288649618
10 0.06932 192.168.12.206 34.216.113.46 TCP 66 60574 > 443 [ACK] Seq=1 Ack=1 Win=501 Len=0 TSval=1855484038 TSecr=3288649615
11 0.070402 213.163.87.149 192.168.12.100 UDP 185 50019 > 55287 Len=143
12 0.088693 192.168.12.100 213.163.87.149 UDP 86 55287 > 50019 Len=44
13 0.089871 213.163.87.149 192.168.12.100 UDP 180 50019 > 55287 Len=138
14 0.095743 52.114.92.64 192.168.12.100 TLSv1.2 388 Application Data
15 0.099751 213.163.87.149 192.168.12.100 UDP 128 50019 > 55287 Len=86
16 0.116736 213.163.87.149 192.168.12.100 UDP 182 50019 > 55287 Len=140
17 0.130674 213.163.87.149 192.168.12.100 UDP 180 50019 > 55287 Len=138
18 0.140124 192.168.12.100 213.163.87.149 UDP 86 55287 > 50019 Len=44
19 0.142975 213.163.87.149 192.168.12.100 UDP 128 50019 > 55287 Len=86
20 0.145032 192.168.12.100 52.114.92.64 TCP 54 51061 > 443 [ACK] Seq=1 Ack=335 Win=258 Len=0
21 0.153861 213.163.87.149 192.168.12.100 UDP 183 50019 > 55287 Len=141
22 0.167646 213.163.87.149 192.168.12.100 UDP 140 50019 > 55287 Len=98
23 0.172693 213.163.87.149 192.168.12.100 UDP 181 50019 > 55287 Len=139
24 0.18827 192.168.12.100 52.114.92.64 TLSv1.2 235 Application Data
432 3.498621 213.163.87.149 192.168.12.100 UDP 200 50019 > 55287 Len=158
433 3.511119 213.163.87.149 192.168.12.100 UDP 184 50019 > 55287 Len=142
434 3.531878 192.168.12.100 213.163.87.149 UDP 86 55287 > 50019 Len=44
435 3.53436 213.163.87.149 192.168.12.100 UDP 181 50019 > 55287 Len=139
436 3.534412 213.163.87.149 192.168.12.100 UDP 197 50019 > 55287 Len=155
437 3.557786 213.163.87.149 192.168.12.100 UDP 185 50019 > 55287 Len=143
438 3.562951 213.163.87.149 192.168.12.100 UDP 320 50019 > 55287 Len=278
439 3.567072 213.163.87.149 192.168.12.100 UDP 178 50019 > 55287 Len=136
440 3.571375 192.168.12.206 192.168.12.131 TCP 74 37964 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961609 TSecr=0 WS=128
441 3.571607 192.168.12.206 192.168.12.131 TCP 74 37966 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961609 TSecr=0 WS=128
442 3.571798 192.168.12.206 192.168.12.131 TCP 74 37968 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961609 TSecr=0 WS=128
443 3.572238 192.168.12.206 192.168.12.131 TCP 74 37970 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961610 TSecr=0 WS=128
444 3.572498 192.168.12.206 192.168.12.131 TCP 74 37972 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961610 TSecr=0 WS=128
445 3.573037 192.168.12.131 192.168.12.206 TCP 54 80 > 37964 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
446 3.573142 192.168.12.131 192.168.12.206 TCP 54 80 > 37966 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
447 3.573265 192.168.12.131 192.168.12.206 TCP 54 80 > 37968 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
448 3.573391 192.168.12.131 192.168.12.206 TCP 54 80 > 37970 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
449 3.574408 192.168.12.131 192.168.12.206 TCP 54 80 > 37972 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
450 3.574634 192.168.12.206 192.168.12.131 TCP 74 37974 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961612 TSecr=0 WS=128
451 3.575003 192.168.12.206 192.168.12.131 TCP 74 37976 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961612 TSecr=0 WS=128
452 3.575606 192.168.12.206 192.168.12.131 TCP 74 37978 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961612 TSecr=0 WS=128
453 3.575643 192.168.12.206 192.168.12.131 TCP 74 37980 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961613 TSecr=0 WS=128
454 3.576023 192.168.12.131 192.168.12.206 TCP 54 80 > 37974 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
455 3.576138 192.168.12.131 192.168.12.206 TCP 54 80 > 37976 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
456 3.576495 192.168.12.206 192.168.12.131 TCP 74 37982 > 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=241961613 TSecr=0 WS=128
457 3.57701 192.168.12.131 192.168.12.206 TCP 54 80 > 37978 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
Improve this question
$\endgroup$

1 Answer 1

Reset to default
0
$\begingroup$

You do not need to plot data first to fit k-means clustering. You can fit k-means clustering and then decide to plot it or not.

K-means clustering requires a distance metric, typically euclidean distance. Euclidean distance requires continuous-valued features. It appears that only "Time" and "Length" are continuous-valued. The other features need to be converted to continuous-valued or not used.

K-means clustering does not do feature selection. Feature selection would require a separate algorithm.

Improve this answer
$\endgroup$
3
  • $\begingroup$ I don't think we can use time series data in a clustering algorithm. I am not 100% sure but please point out if I am wrong. $\endgroup$
    – spectre
    Oct 16, 2021 at 9:07
  • $\begingroup$ Either ignore the time-series aspect or use something like dynamic time warping k-means clustering. $\endgroup$
    – Brian Spiering
    Oct 16, 2021 at 14:40
  • $\begingroup$ I know it says avoid comments like thanks, but thanks! The Length I don't actually think is continuous as there is an upper limit of a packet size so I had the idea to use Time and the amount of instances of a TCP packet in half a second. Seemed to fit better in my head and that comment about using dynamic time-warping was very timely. $\endgroup$
    – Colin Crook
    Oct 17, 2021 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.