Network security event detection via normalized distance based clustering

A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations, the operations comprising:

• assigning each of a plurality of samples of network traffic data to a respective position in a list, wherein each of the plurality of samples is assigned one of a plurality of cluster identifiers corresponding to the respective position in the list;
• traversing the list, wherein for each position in the list, the traversing comprises:
• incrementing an order indicator;
• determining if a cluster identifier of the plurality of cluster identifiers for a sample of the plurality of samples assigned to the position is less than the order indicator;
• shifting to a next position in the list when the cluster identifier is less than the order indicator;
• or
• when the cluster identifier is not less than the order indicator:
• computing a distance between the sample assigned to the position and all other samples in the plurality of samples;
• recording a cluster identifier of another one of the plurality of samples when a distance between the sample assigned to the respective position and the another one of the plurality of samples is less than a threshold distance, wherein the threshold distance is based upon an aggregate normalized distance associated with a feature space of the plurality of samples and a number of the plurality of samples;
• and
• selecting a minimum cluster identifier among the cluster identifiers that are recorded, for assignment to all other cluster identifiers that are recorded;
• determining a plurality of clusters of the plurality of samples from cluster identifiers remaining in the list after the traversing;
• and
• identifying at least one of the plurality of clusters as representing anomalous network traffic data.

A device comprising:

• a processing system including at least one processor;
• and
• a computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising:
• assigning each of a plurality of samples of network traffic data to a respective position in a list, wherein each of the plurality of samples is assigned one of a plurality of cluster identifiers corresponding to the respective position in the list;
• traversing the list, wherein for each position in the list, the traversing comprises:
• incrementing an order indicator;
• determining if a cluster identifier of the plurality of cluster identifiers for a sample of the plurality of samples assigned to the position is less than the order indicator;
• shifting to a next position in the list when the cluster identifier is less than the order indicator;
• or
• when the cluster identifier is not less than the order indicator:
• computing a distance between the sample assigned to the position and all other samples in the plurality of samples;
• recording a cluster identifier of another one of the plurality of samples when a distance between the sample assigned to the respective position and the another one of the plurality of samples is less than a threshold distance, wherein the threshold distance is based upon an aggregate normalized distance associated with a feature space of the plurality of samples and a number of the plurality of samples;
• and
• selecting a minimum cluster identifier among the cluster identifiers that are recorded, for assignment to all other cluster identifiers that are recorded;
• determining a plurality of clusters of the plurality of samples from cluster identifiers remaining in the list after the traversing;
• and
• identifying at least one of the plurality of clusters as representing anomalous network traffic data.