k-Means: Partitioning Traffic into K Groups

The four-step k-means algorithm, a runnable scikit-learn example clustering standardised network-flow features, a real chart showing three clusters plus unclustered scan-burst outliers, and why k-means needs both a chosen k and scaled features.

~5 min total·4 quadrants of structured content

By the end of this topic, you will

List the four steps of the k-means algorithm in order
Cluster standardised network-flow features with scikit-learn's KMeans
Explain why k-means requires both a pre-chosen k and standardised features

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Video content coming soon.

Quadrant 2 · e-Content

Articles and case studies

k-Means: Partitioning Traffic into K Groups

k-means iterates between assigning points to their nearest centroid and recomputing each centroid, until the assignments stop changing. Injected scan-burst traffic sits so far from every centroid that a distance threshold catches it without ever needing a label.

Quadrant 3 · Web Resources