Multiple-Features-Based Semisupervised Clustering DDoS Detection Method

Algorithm 1

Multiple-Features-Based Constrained--Means (MF-CKM) detection algorithm.

Input: Set of data points , in which is a vector with three

detection features (the weight of each feature is expressed as ), number of

clusters , and set of labeled data as seeds for selection of initial clustering center

, which satisfies .

Output: Disjoint partitioning of such that the MF-CKM objective function is

optimized.

Method:

(1) Selection of initialize clustering centers. ), in which

is a vector with three elements expressed as .

(2) Repeat until algorithm convergence

(2a) assign_cluster: For , if assign to the cluster (i.e., set ). For

, assign to the cluster (i.e., set ), for

(2b) estimate_means:  

(2c)