SeqClu-PV: An extension of online K-medoids to efficiently cluster sequences real-time

Real-time sequence clustering is the problem of clustering an infinite stream of sequences in real time with limited memory. A variant of the k-medoids algorithm called <i>SeqClu </i>is the suggested approach, representing a cluster with <i>p </i>most representative sequences of the cluster, called prototypes, to solve the problem of maintaining...

Cold start is coming: How to approximate the optimal set of initial prototypes for clustering sequence data online

Clustering data is a classic topic in the academic community and in the industry. It is by and large one of the most popular unsupervised classification techniques. It is fast and flexible as it can accommodate all kinds of data when a suitable similarity metric is found. SeqClu is an online k-medoids prototype based clustering algorithm...

Analysis of sequential feature engineering and statistical features for malware behavior discovery

Malware Packet-sequence Clustering and Analysis (MalPaCA) is a unsupervised clustering application for malicious network behavior, it currently uses solely sequential features to characterize network behavior. In this paper an extensive comparison between those features and statistical features is performed. During the comparison a better...

Accelerating Cluster Assignment for SeqClu

Clustering is a group of (unsupervised) machine learning algorithms used to categorize data into clusters. The most popular clustering algorithm is k-means clustering. K-means clustering clusters the data into k clusters where a cluster is represented by the mean of the data points called a centroid. Instead of using the mean as a centroid, a...

MalPaCA Feature Engineering: A comparative analysis between automated feature engineering and manual feature engineering on network traffic

Identifying novel malware and their behaviour enables security engineers to prevent and protect users with devices on the network from attackers. MalPaCA is an algorithm that helps to understand the behaviours of the network traffic by clustering uni-directional network connections which can be analyzed further to interpret which label suites...

The influence of sequence length on the clustering performance of MalPaCA

MalPaCa is a novel, unsupervised clustering algorithm, which creates based on the network flow of a software a behavioral profile representing its actual capabilities. One of the key variables affecting is performance and usability is the sequence length or how many packets it analyzes in order to group a connection to a cluster. This article...

MalPaCA: Malware behaviour analysis using unsupervised machine learning: Comparative analysis of various clustering algorithms on determining the best performance in terms of network behaviour discovery

MalPaCA makes use of unsupervised machine learning to provide malware capability assessment by clustering the temporal behaviour of malware network packet traces. A comparative analysis was performed on various clustering algorithms to determine the best clustering algorithm in terms of network behaviour discovery. The clustering algorithms...