Multi-distance clustering

A computing system, comprising:

• a processor;
• multi-distance clustering logic configured to cause the processor to:
• read a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set, where each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one, wherein the data set comprises data points corresponding to features extracted from electronic communications associated with a service;
• cluster the data points in the data set into n clusters based on the similarity matrix S, where n is not determined prior to the clustering;
• evaluate the n clusters to detect a cluster comprising data points of features indicative of anomalous electronic communication attempting to access the service;
• and
• execute an action to block the anomalous electronic communication from accessing the service.

A computer-implemented method comprising, with a processor:

• reading, from an electronic data structure, a multi-distance similarity matrix S that records pair-wise multi-distance similarities between respective pairs of data points in a data set, where each pair-wise similarity is based on distances between a pair of data points calculated using K different distance functions, where K is greater than one, wherein the data set comprises data points corresponding to features extracted from electronic communications associated with a service;
• clustering the data points in the data set into n clusters based on the similarity matrix S, where n is not determined prior to the clustering;
• evaluating the n clusters to detect a cluster comprising data points of features indicative of anomalous electronic communication attempting to access the service;
• and
• executing an action to block the anomalous electronic communication from accessing the service.