ICSTrace: A Malicious IP Traceback Model for Attacking Data of the Industrial Control System
Algorithm 1
Partial seeded K-means.
Input: given a sample set , the clustering number k, the known clustering number l, , the sample subset of known cluster partition , and the sample subset of unknown cluster partition .
(1)
Calculate the mean of the samples in each known cluster :.
(2)
Calculate the distance from each sample in to the known mean , and choose the largest value which equals mean distance added minimum distance as the new initial mean and let as known mean.
(3)
Repeat Step 2, until samples are chosen as the initial mean vector , make and to be the initial mean vector with k means.
(4)
Calculate the distance which is from each sample in to each mean vector .
(5)
Choose the cluster label for the sample according to nearest initial vector , and add into corresponding cluster .
