Method and system for clustering darknet traffic streams with word embeddings

A method for analyzing and clustering darknet traffic streams with word embeddings, comprising:

• a) collecting data from blackhole taps of said darknet, being unassigned IP addresses;
• b) splitting the collected data into sliding time windows, each having a predetermined length;
• c) For each time window, grouping the destination port (D-port) records of the same source IP (S-IP) into a port sequence, to obtain a plurality of port sequences;
• d) transforming said port sequences into a numerical feature vectors by applying a word embedding algorithm to said port sequences, by treating ports as words and port sequences as sentences;
• e) clustering said feature vectors over time by performing temporal clustering;
• and
• f) upon identifying clusters that have been appeared and classified as malicious in the past or clusters that have never seen before, issuing an alert.