DBSCAN (Density-Based Spatial Clustering of Applications with Noise) takes a different approach: a cluster is any region where points are densely packed together, separated by sparser regions. It needs no $k$, discovers arbitrarily shaped clusters that k-means' circular boundaries cannot represent, and, most usefully for security work, explicitly labels sparse, isolated points as noise rather than forcing them into the nearest cluster.
dbscan_network_flows.py
from sklearn.cluster import DBSCAN
dbscan = DBSCAN(eps=0.6, min_samples=8)
labels = dbscan.fit_predict(scaled)
n_outliers = (labels == -1).sum()
print(f"DBSCAN found {labels.max() + 1} clusters and {n_outliers} outliers")
Tool in focus: sklearn.cluster.DBSCAN
The two parameters that matter are eps (how close two points must be to count as neighbours) and min_samples (how many neighbours a point needs to anchor a dense region). Points that join no dense region at all are labelled -1: DBSCAN's built-in outlier flag, exactly the flag a security analyst wants.
Try it yourself: k-Means or DBSCAN?
A dataset's normal traffic forms one large, roughly circular cluster and one small, crescent-shaped cluster that wraps partway around it, with a handful of genuinely isolated points scattered far from both. Which algorithm from this unit would correctly separate the crescent from the circle without being told how many clusters to expect, and would also correctly flag the isolated points as outliers instead of forcing them into the nearest cluster?