Unsupervised Analysis with Clustering for the Detection and Characterization of Cybersecurity Threats

Gutierrez-Acosta C.A.; Orihuela-Orozco L.A.; Ponce-Galarza B.S.; Soria-Quijaite J.J.; Saboya N. · International Journal of Safety and Security Engineering (2026) · DOI: 10.18280/ijsse.160816

Resumen

This study presents a comparative unsupervised workflow combining principal component analysis (PCA) with four clustering algorithms (K-Means, hierarchical agglomerative clustering (H-Clust), Clustering Large Applications (CLARA), and Density-Based Spatial Clustering (DBSCAN)) to detect anomalous patterns in the UNSW-NB15 dataset. Thirty-nine standardized variables were reduced to ten principal components, preserving 78% of total variance. Guided by the silhouette coefficient, k = 7 clusters was adopted. For a fair comparison, all algorithms were evaluated on a fixed 10,000 record sample, while K-Means was additionally fitted to the complete dataset (n = 82,332). On the complete dataset, K-Means achieved up to 100% purity for Normal traffic and 94.6% for Generic attacks, alongside heterogeneous clusters. Comparatively, K-Means, H-Clust, and CLARA achieved statistically similar, modest alignment with true labels (Adjusted Rand Index (ARI) 0.10-0.13) across random seeds. Conversely, DBSCAN failed to meaningfully partition the traffic (ARI near zero) despite obtaining the highest internal silhouette score, a divergence termed the “DBSCAN paradox.” These findings demonstrate that centroid-, hierarchy-, and medoid-based partitions achieve comparable, seed-sensitive alignment, proving internal cohesion metrics alone are insufficient for cybersecurity evaluation. This PCA-based pipeline offers a promising label-free pre-alert module for security operations centers, though moderate external validity indicates room for improvement. Copyright:

Instituciones: Universidad Peruana Unión