CLUSTERING MALICIOUS ACTIONS BASED ON INFORMATION RECEIVED FROM A HONEYNET

Abstract

The method of agglomerative clustering of intruders on the basis of their activity time series with use of information criteria for determination of distance between time series as measure of similarity is proposed, as well as criteria of stopping the clustering process, which allow to obtain the optimal ratio of clusters purity and completeness, and accordingly determining the number of clusters.