 |
The left table is the confusion matrix of the data through the K-means algorithm. TP is the number of packets that are grouped correctly after the algorithm, FP is the number of packets that are incorrectly grouped, FN is the number of packets that cannot be grouped but can be classified into clusters, and TN is the number of packets that cannot be grouped after the algorithm judges. The right table shows the accuracy rate obtained by K-means and the coverage rate of the attack pattern by the snort ruleset. Experiments have confirmed that the coverage rate can reach 98%; it can perfectly filter all kinds of attacks collected by Cowrie. Establish a suitable defense mechanism.
|
IEEE/ICACT20230053 Slide.14
[Big Slide]