Systems and methods for cluster-based network threat detection

1. A method of detecting threats in a network, comprising:

obtaining, by a network security monitor, a plurality of records for a plurality of entities that access the network, the plurality of records comprising attributes associated with the one or more entities;

generating, by the network security monitor, a plurality of clusters from the plurality of records using a matching process;

classifying, by the network security monitor, a first cluster of the plurality of clusters as a threat cluster;

receiving, subsequent to generating the plurality of clusters, a record from an entity that access the network;

assigning, by the network security monitor, the record to the first cluster using the matching process;

detecting, by the network security monitor responsive to assigning the record to the first cluster, a threat associated with the entity; and

performing a tuning process to identify, via a multivariable loop, one or more variables to use to match the record with the first cluster corresponding to the threat cluster.

2. The method of claim 1 , wherein the entity is different from the plurality of entities used to generate the plurality of clusters.

3. The method of claim 1 , wherein generating the plurality of clusters comprises:

selecting, by the network security monitor, one of fixed cluster construction or variable cluster construction;

identifying, responsive to the selection, a number of clusters to generate; and

generating, responsive to identifying the number of clusters, the plurality of clusters corresponding to the number of clusters.

4. The method of claim 1 , wherein the matching process comprises at least one of a fuzzy logic algorithm or a k-nearest neighbors technique, the method comprising;

weighting the attributes associated with the one or more entities; and

generating the clusters using the matching process and the weighted attributes.

5. The method of claim 1 , wherein generating the plurality of clusters comprises:

determining that a first record of the plurality of records is a mismatch with the first cluster; and

generating a second cluster of the plurality of clusters; and

assigning the first record of the plurality of records to the second cluster.

6. The method of claim 1 , comprising:

determining that an attribute of the record is a non-numeric attribute; and

using Boolean logic to match the attribute with the first cluster.

7. The method of claim 1 , comprising:

determining that an attribute of the record comprises a numeric value; and

using fuzzy logic to match the numeric value of the attribute with the first cluster.

8. The method of claim 1 , comprising:

determining that an attribute of the record comprises a numeric value; and

determining an average value for the first cluster based on assigning the numeric value of the attribute of the record to the first cluster; and

updating a center value of the first cluster based on the average value.

9. The method of claim 1 , comprising:

validating the first cluster based on comparing a ratio of threats to records with a threshold.

10. A system for detecting threats in a network, comprising:

a network security monitor comprising one or more processors and memory;

a data collector of the network security monitor configured to obtain a plurality of records for a plurality of entities that access the network, the plurality of records comprising attributes associated with the one or more entities;

a cluster generator of the network security monitor configured to generate a plurality of clusters from the plurality of records using a matching process; and

a classifier of the network security monitor configured to classify a first cluster of the plurality of clusters as a threat cluster,

wherein the network security monitor is further configured to:

receive, subsequent to generating the plurality of clusters, a record from an entity that communicates via the network;

assign the record to the first cluster using the matching process;

detect, responsive to assigning the record to the first cluster, a threat associated with the entity; and

perform a tuning process to identify, via a multivariable loop, one or more variables to use to match the record with the first cluster corresponding to the threat cluster.

11. The system of claim 10 , wherein the entity is different from the plurality of entities used to generate the plurality of clusters.

12. The system of claim 10 , wherein the network security monitor is further configured to:

select one of fixed cluster construction or variable cluster construction;

identify, responsive to the selection, a number of clusters to generate; and

generate, responsive to identifying the number of clusters, the plurality of clusters corresponding to the number of clusters.

13. The system of claim 10 , wherein the matching process comprises at least one of a fuzzy logic algorithm or a k-nearest neighbors technique, and the network security monitor is further configured to:

weight the attributes associated with the one or more entities; and

generate the clusters using the matching process and the weighted attributes.

14. The system of claim 10 , wherein the network security monitor is further configured to:

determine that a first record of the plurality of records is a mismatch with the first cluster;

generate a second cluster of the plurality of clusters; and

assign the first record of the plurality of records to the second cluster.

15. The system of claim 10 , wherein the network security monitor is further configured to:

determine that an attribute of the record is a non-numeric attribute; and

use Boolean logic to match the attribute with the first cluster.

16. The system of claim 10 , wherein the network security monitor is further configured to:

determine that an attribute of the record comprises a numeric value; and

use fuzzy logic to match the numeric value of the attribute with the first cluster.

17. The system of claim 10 , wherein the network security monitor is further configured to:

determine that an attribute of the record comprises a numeric value; and

determine an average value for the first cluster based on assigning the numeric value of the attribute of the record to the first cluster; and

update a center value of the first cluster based on the average value.

18. The system of claim 10 , wherein the network security monitor is further configured to:

validate the first cluster based on comparing a ratio of threats to records with a threshold.