Comparison of Evolutionary Data Clustering of Network Attacks

The identification of network attacks is becoming an increasingly difficult task due to the volume of data transmitted by modern communication networks. Human intelligence is gradually taking the place of man in this role, although it is still impossible to replace him completely. The presented article deals with the analysis of selected evolutionary clustering algorithms: genetic algorithm clustering, particle swarm optimization clustering and differential evolution clustering. Their task is to divide the input data - the characteristics of the streams of the selected traffic into individual groups - clusters with the same characteristics. In order to make the results of the analysis plausible, the CSE-CIC-IDS2018 dataset was used, in which individual items are described and individual cyber-attacks are identified. Since the number of parameters that describe individual streams is high, the PCA method is used. The clustering itself is then implemented with 8 parameters that represent the first 8 principal components. The metric for comparing individual clustering algorithms was the global distance of individual points from centroids. Based on the results, the best method that uses evolutionary principles was determined. However, it can be said that all three methods analyzed can find applications in automatically describing data communication and finding anomalies that may indicate a cyber attack on a given network. The presented method of using clustering algorithms can be applied for data communication analysis, which will be performed in real-time but also with a time delay in the search for evidence that can help to investigate a cyber incident.