Stack-hac for machine learning based botnet detection

A non-transitory machine-readable medium including instructions that, when executed by a machine, cause the machine to perform operations for network intrusion detection, the operations comprising:

• receiving a network session;
• implementing a stacked hierarchical agglomerative clustering (HAC) algorithm that operates multiple HAC algorithms to identify respective clusters to which the network session maps, each HAC algorithm of the StackHAC algorithm operates using a different linkage function and distance pair;
• appending the respective cluster assignments from each of the multiple HAC algorithms to a feature space representing the reduced and modified feature space of the network sessions resulting in an augmented or enhanced feature space;
• and
• determining, using a classifier or clustering model that operates using the augmented feature vector as input, whether the network session is associated with a network intrusion.

A method for network intrusion detection, the method comprising:

• receiving a network session;
• implementing a stacked hierarchical agglomerative clustering (HAC) algorithm that operates multiple HAC algorithms to identify respective clusters to which the network session maps, each HAC algorithm of the StackHAC algorithm operates using a different linkage function and distance pair;
• appending the respective clusters from the multiple HAC algorithms to a feature vector representing the network session resulting in an augmented feature vector;
• and
• determining, using a classifier or clustering model that operates using the augmented feature vector as input, whether the network session is associated with a network intrusion.