An Intelligence Defense System with SNORT Rules is an interesting study. Can you explain how many features are stored in dataframe format from Cowrie honeypot log data? Which features are used in the clustering process? And why were those features chosen? Is it the most effective and efficient approach to create a K-Means Clustering model to include all the features? Thank you very much.
Thanks for your question! In fact, we have many features, such as packet timestamp, session timestamp, src_port, ip, paylod, paylaod_lenth, avg payload lenth and we also record country, ISP, etc. through GeoIP database, we use payload to do some preprocessing for k-means clustering, Since our goal is to group similar payloads together and generate regular expressions, the other features are mainly for further research. Best reagards.
