Pith. sign in

REVIEW 4 major objections 5 minor 32 references

The importance of the clustering model to detect new types of intrusion in data traffic

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper argues that K-means clustering, applied without labels, can recover the true attack categories in network traffic, including previously unseen types.

desk verdict K-means counts nothing on its own, and since the paper never says what K was—and its own figure shows five clusters for seven claimed attacks—the central detection claim is unsupported and the rest is a thin, sloppy workflow. read the letter →

arxiv 2411.14550 v2 pith:SI3Z75PS submitted 2024-11-21 cs.CR cs.AI

Noor Saud Abd , Noor Walid Khalid , Basim Hussein Ali This is my paper · ORCID
classification cs.CRcs.AI
keywords intrusiondetectionK-meansclusteringunlabelednetworktrafficXGBoostanomalyIoTdatasetcybersecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that K-means clustering, run on network traffic without any labels, can discover the attack categories hiding in the data. The authors collected 19,677 traffic records spanning seven common attack types, applied K-means after cleaning and normalizing the features, and report that the clusters match those seven types. They also applied the same approach to a public Kaggle IoT intrusion dataset and report that the model 'detected the number of attacks correctly.' The wider point matters because new attack types appear constantly and labeled examples for them do not exist; if clustering can recover the taxonomy on its own, intrusion detection would not have to wait for manual labeling.

What carries the argument

The load-bearing mechanism is K-means clustering. Given a pre-specified number K, the algorithm picks K initial centroids, assigns every data point to the nearest centroid by Euclidean distance $$d(X_t, X_\xi) = \sqrt{\sum_{u=1}^{n}(X_{u t} - X_{u \xi})^2}$$ and then recomputes each centroid as the mean of its assigned points, repeating until assignments stabilize. Before clustering, the paper drops flow identifiers, IP addresses, timestamps, and missing-value columns, converts categorical features to numbers, and normalizes scales. The resulting cluster labels are treated as pseudo-labels and passed to XGBoost for the classification and evaluation stage; K-means is what carries the claimed ability to count and enumerate attack types.

What would settle it

Re-run the pipeline on the same 19,677-row dataset with K chosen by a data-driven rule such as the elbow method or silhouette score, and check whether the resulting number of clusters equals seven and whether the cluster memberships align with the known attack labels; any mismatch would refute the central claim.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that K-means clustering, applied to unlabeled network-flow data, groups traffic into clusters that correspond one-to-one with known attack types and assigns each cluster a numerical label. The authors state that on their collected dataset 'the seven attacks were actually classified by the clustering system using the K-means algorithm,' and on the Kaggle IoT intrusion dataset 'the clustering model worked well and detected the number of attacks correctly.' The intended consequence is that when a genuinely new attack appears, it will form a new cluster and receive a new number, allowing analysts to flag it before any labeled examples exist.

Load-bearing premise

The claim depends on the number of clusters K being chosen without knowing how many attack types are actually present, and the paper never states how K was selected; if it was set to the known seven attack types, then the reported match is circular.

Editorial extensions

If this is right

  • Intrusion detection systems could flag genuinely new attack types as soon as they appear, because a previously unseen cluster would signal an unknown behavior.
  • The need for manually labeled traffic data would fall, since cluster labels can serve as pseudo-labels for training downstream classifiers such as XGBoost.
  • The same pipeline could be applied to any unlabeled traffic capture, including IoT networks, to enumerate how many distinct attack behaviors are present.
  • If cluster counts match true attack counts, K-means could estimate attack diversity without any ground-truth labels.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A fair test of the claim would require choosing K without access to the known attack count (for example, by silhouette score or elbow method) and then comparing the resulting clusters to held-out labels; the paper never discloses how K was selected, so the reported exact match could be a self-fulfilling choice.
  • The paper reports no cluster-quality metrics such as adjusted Rand index, normalized mutual information, or purity against ground truth; reporting those would show whether clusters correspond to attack semantics or merely separate traffic by volume, timing, or protocol.
  • A direct test of the 'new attack type' claim would be to withhold one known attack family from the data, cluster the remainder, and see whether the withheld family forms its own distinct cluster and receives its own number.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper claims that K-means clustering can discover and correctly count attack types in unlabeled network traffic, using two datasets: a self-collected set built with Kali Linux, tcpdump, and CICFlowMeter, and the Kaggle 'Intrusion Detection in Internet of Things Network' dataset. The authors state in the Contributions section that seven attack types 'were actually classified by the clustering system using the K-means algorithm' and that the model 'detected the number of attacks correctly' on both datasets. The paper also describes an XGBoost classification stage and reports a classification report with very high precision, recall, and Cohen's Kappa. The central claim, however, is unsupported because the paper never discloses the value of K or how it was chosen; the only displayed K-means output shows five clusters, not seven; and no ground-truth comparison is provided for either dataset.

Significance. If the central claim were established, the paper would address a real need: unsupervised detection of novel attack types in unlabeled traffic. The authors also attempted a practical data collection effort and provided a detailed description of their testbed. However, the significance is currently negative because the load-bearing evidence is absent. The paper supplies no machine-checked proofs, no reproducible code, no parameter-free derivation, and no falsifiable prediction. The claim that K-means 'counted the attacks' is not supported by any disclosed experimental output; in fact, the only quantitative clustering result contradicts it. The contribution, as presented, reduces to a circular statement if K was set to the known number of attack types.

major comments (4)
  1. [Contributions section (p. 2) and §1.3.2] The central claim that K-means 'detected the number of attacks correctly' is unsupported because K is an input parameter, not an output. Section 1.3.2 states that 'K indicates how many pre-defined clusters must be formed during the process,' yet the paper never reports the value of K used for either dataset, nor any method for selecting it (e.g., silhouette, gap statistic, or stability analysis). If K was set to the known seven attack types, then the claim that the model 'counted the attacks' is circular: K-means will return exactly K clusters by construction. The paper must disclose K and demonstrate that it emerged from the data.
  2. [Figure 2 (p. 5)] The only unsupervised clustering output displayed for the self-collected dataset is the value_counts shown under Figure 2, which lists cluster labels 0 through 4 with counts (7361, 5801, 3390, 1349, 1080). That is five clusters, not the seven attack types claimed in the Contributions section. This direct discrepancy undermines the statement that 'the seven attacks were actually classified by the clustering system.' The authors need to explain why the displayed clustering produced five groups and how this result supports the claim of seven detected attacks.
  3. [§1.3.2, Eq. (1)] Equation (1) is unusable as presented because the text surrounding it is copied from a different domain. The formula for Euclidean distance is immediately followed by 'In the presented work, n is fixed to 1 since the occurrence probability of the landslide serves as the data property for modeling the susceptibility to landslides.' No landslide data appear anywhere in this paper, and the centroid update equation is missing entirely. This garbled text means the clustering algorithm is not actually described, which is a load-bearing methodological gap for a paper whose entire contribution is the application of K-means.
  4. [Table 1 and Dataset Description (pp. 6-8)] No ground-truth comparison is provided for either dataset. For the self-collected dataset, the paper does not show how the cluster labels correspond to the seven known attack types (DoS, Brute Force, TCP Flooding, UDP Flooding, etc.) that were generated in the testbed. For the Kaggle IoT dataset, no clustering output or K value is reported at all. Table 1 reports precision, recall, F1-score, and support for seven classes, but these are supervised classification metrics; the paper does not explain how clusters were mapped to class labels, whether the reported classes came from cluster pseudo-labels or from true labels, or how the classification report relates to the unsupervised claim. Without a confusion matrix or cluster-to-class correspondence, the statement that the model 'detected the number of attacks correctly' is unverifiable.
minor comments (5)
  1. [Section numbering and organization] The section numbering is inconsistent: '1.1.2 Building the model' appears after '1.4 METHODOLOGY', and '1.2 CONCLUSION' appears after the results figures. The paper would benefit from a coherent structure with sequential numbering.
  2. [Dataset description (p. 5)] The dataset dimensions are reported inconsistently: the paper mentions 19,677 rows and 84 columns, then 83 columns, then states that after dropping one missing-value column and four other columns the dataset became 78 columns. The arithmetic (83 - 5 = 78) is consistent, but the initial 84-column mention is not explained, and the names of dropped columns are repeated verbatim twice.
  3. [Figure references] Figure (1) is referenced as showing a sample of the dataset, but the figure is not present in the text. Figure (3) and Figure (4) are similarly referenced without being displayed or described. The reader cannot assess the clustering or classification results from the visualizations.
  4. [Abstract and Contributions wording] The abstract states 'The model counted the attacks and assigned numbers to each one of them,' but the paper does not explain what 'assigned numbers' means in terms of attack types. The phrase 'with the use of XG-boost algorithm following completing the aggregation with K-means algorithm' is also grammatically unclear.
  5. [References] Several references are incomplete or incorrectly numbered. For example, reference [13] is listed as 'Dhaliwal, S. S., Nahid, A. A, 2018' but the text cites Farhan et al. for the same citation number, and the reference list contains duplicate entries for the same work (e.g., references [20] and [21] duplicate Salem et al.).

Circularity Check

2 steps flagged · score 6.0 of 10

The central 'detected the number of attacks' claim reduces to the K-means input K: the paper defines K as the pre-defined cluster count, reports no data-driven K selection, and the only displayed clustering output has five clusters, not seven.

  1. fitted input called prediction [Section 1.3.2; Abstract; Contributions of this paper]
    "In this case, K indicates how many pre-defined clusters must be formed during the process; for example, if K=2, there will be two clusters; if K=3, there will be three clusters, and so on. ... The model counted the attacks and assigned numbers to each one of them. ... there were 7 types of attacks and the seven attacks were actually classified by the clustering system using the K-means algorithm."

    The paper's own description of K-means makes K a supplied input: the number of clusters produced is exactly K. The abstract's headline result, 'The model counted the attacks and assigned numbers to each one of them,' is therefore the value of K, not an inference from unlabeled data. The Contributions sentence similarly claims that seven attacks 'were actually classified by the clustering system,' which holds by construction only if K was set to seven. The paper reports no silhouette, gap statistic, stability check, or alternative K values for either dataset. The only displayed clustering artifact, the value_counts under Figure 2, shows five cluster labels (0 through 4), so the seven-cluster claim is not supported by any reported clustering output.

  2. fitted input called prediction [Abstract (Kaggle IoT dataset experiment)]
    "Secondly, We tried the same work on the ready data inside the Kaggle repository called (Intrusion Detection in Internet of Things Network), and the clustering model worked well and detected the number of attacks correctly as shown in the results section."

    For the Kaggle IoT dataset, no K value, no cluster labels, and no clustering evaluation are shown in the results section. Since the number of K-means clusters is, by the paper's own Section 1.3.2 definition, the pre-defined K, the statement that the model 'detected the number of attacks correctly' is a claim that the known class count was supplied as K or matched it, not that clustering measured the count. Under the natural reading that K was taken from the known attack taxonomy, the detection is the input parameter itself, and the claim is unverifiable from the reported material.

full rationale

The derivation chain that would support 'the model counted the attacks' would have to show that K-means, run on unlabeled flows, produced a number of clusters equal to the true attack count without that number being supplied. The paper breaks this chain in Section 1.3.2 by defining K-means as requiring a pre-defined number K of clusters, and it never reports the K used or any data-driven procedure such as silhouette analysis, the gap statistic, or stability testing. The only quantitative clustering output in the paper, the value_counts under Figure 2, shows five cluster labels, not the seven attack types claimed in the Contributions section; the seven-class results in Table 1 come from a supervised XGBoost classifier, so they cannot demonstrate that unsupervised clustering recovered the taxonomy. Thus the central 'number of attacks' claim is, on the paper's own account, the input parameter K presented as a detection result: if K was set from the known seven classes, the match is forced by construction. This is partial circularity (score 6) rather than total circularity, because the paper also includes a data-collection procedure and supervised performance metrics that are not themselves circular, but those components do not rescue the central unsupervised detection claim.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central claim rests on two unvalidated assumptions: that K-means cluster assignments correspond to attack types, and that the number of clusters K is chosen independently of the ground truth. No evidence is provided for the first, and the second is contradicted by the text's silence on how K was set.

free parameters (1)
  • K (number of clusters) = Undisclosed; Figure 2 shows 5 cluster labels, while the text claims 7 attack types.
    K-means requires K as input. The paper never states how K was chosen. If K is set to the known number of attack types, the 'correct count' is forced by the input.
assumptions (4)
  • domain assumption Euclidean distance on the 78 selected network flow features is an appropriate similarity measure for grouping traffic into attack types.
    Invoked in Eq. (1) and the K-means application without justification.
  • domain assumption The self-collected dataset contains exactly seven attack types, which are the clusters K-means should recover.
    Stated in the Contributions section: 'there were 7 types of attacks'.
  • ad hoc to paper Dropping the columns 'Flow ID', 'Src IP', 'Dst IP', 'Timestamp' and one column with missing values does not materially affect the clustering result.
    Data Cleaning section in Methodology.
  • standard math K-means converges to a reasonable local optimum from its initialization.
    Implicitly assumed for the reported single run.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The importance of the clustering model to detect new types of intrusion in data traffic." pith.science (2026). https://pith.science/paper/SI3Z75PS

@misc{pith2026241114550,
  author       = {Pith},
  title        = {Pith review of: The importance of the clustering model to detect new types of intrusion in data traffic},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SI3Z75PS}},
  note         = {Machine review of arXiv:2411.14550}
}
read the original abstract

In the current digital age, the volume of data generated by various cyber activities has become enormous and is constantly increasing. The data may contain valuable insights that can be harnessed to improve cyber security measures. However, much of this data is unclassified and qualitative, which poses significant challenges to traditional analysis methods. Clustering facilitates the identification of hidden patterns and structures in data through grouping similar data points, which makes it simpler to identify and address threats. Clustering can be defined as a data mining (DM) approach, which uses similarity calculations for dividing a data set into several categories. Hierarchical, density-based, along with partitioning clustering algorithms are typical. The presented work use K-means algorithm, which is a popular clustering technique. Utilizing K-means algorithm, we worked with two different types of data: first, we gathered data with the use of XG-boost algorithm following completing the aggregation with K-means algorithm. Data was gathered utilizing Kali Linux environment, cicflowmeter traffic, and Putty Software tools with the use of diverse and simple attacks. The concept could assist in identifying new attack types, which are distinct from the known attacks, and labeling them based on the characteristics they will exhibit, as the dynamic nature regarding cyber threats means that new attack types often emerge, for which labeled data might not yet exist. The model counted the attacks and assigned numbers to each one of them. Secondly, We tried the same work on the ready data inside the Kaggle repository called (Intrusion Detection in Internet of Things Network), and the clustering model worked well and detected the number of attacks correctly as shown in the results section.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 28 canonical work pages

  1. [1]

    K -means Clustering Algorithms: A Comprehensive Review, Variants Analysis, and Advances in the Era of Big Data

    Ikotun, A. M. et al. "K -means Clustering Algorithms: A Comprehensive Review, Variants Analysis, and Advances in the Era of Big Data." Information Sciences 22.1 (2023): pp. 178 -210. https://doi.org/10.1016/j.ins.2022.09.073

    work page doi:10.1016/j.ins.2022.09.073 2023

  2. [2]

    A Survey on the Use of Data Clustering for Intrusion Detection System in Cybersecurity

    Bohara, B. et al. "A Survey on the Use of Data Clustering for Intrusion Detection System in Cybersecurity." International Journal of Network Security & Its Applications 12.1 (2020): p. 1. https://doi.org/10.5121/ijnsa.2020.12101

    work page arXiv 2020

  3. [3]

    A Review on Cybersecurity Datasets for Machine Learning Algorithms

    Yavanoglu, O. and Aydos, M. "A Review on Cybersecurity Datasets for Machine Learning Algorithms." Proceedings of the 2017 IEE E International Conference on Big Data (Big Data) (2017): pp. 2186 -2193. https://doi.org/10.1109/BigData.2017.8258134

    arXiv 2017

  4. [4]

    Network Intrusion Detection System Using Supervised Learning Paradigm

    Mebawondu, J. O. et al. "Network Intrusion Detection System Using Supervised Learning Paradigm." Scientific African 9 (2020): e00497. https://doi.org/10.1016/j.sciaf.2020.e00497

    work page doi:10.1016/j.sciaf.2020.e00497 2020

  5. [5]

    Cybersecurity Detection Model Using Machine Learning Techniques

    El-Taie, M. and Kraidi, A. Y. "Cybersecurity Detection Model Using Machine Learning Techniques." Journal of Cybersecurity & Information Management 12.1 (2023)

    work page 2023

  6. [6]

    C SVM Classification and KNN Techniques for Cyber Crime Detection

    Veena, K. et al. "C SVM Classification and KNN Techniques for Cyber Crime Detection." Wireless Communications and Mobile Computing (2022): 3640017. https://doi.org/10.1155/2022/3640017

    work page doi:10.1155/2022/3640017 2022

  7. [7]

    A Deep Learning Methodology for Predicting Cybersecurity Attacks on the Internet of Things

    Alkhudaydi, O. A. et al. "A Deep Learning Methodology for Predicting Cybersecurity Attacks on the Internet of Things." Information 14.10 (2023): p. 550. https://doi.org/10.3390/info14100550

    work page doi:10.3390/info14100550 2023

  8. [8]

    A Survey on Intrusion Detection System: Feature Selection, Model, Performance Measures, Application Perspective, Challenges, and Future Research Directions

    Thakkar, A. and Lohiya, R. "A Survey on Intrusion Detection System: Feature Selection, Model, Performance Measures, Application Perspective, Challenges, and Future Research Directions." Artificial Intelligence Review 55.1 (2022): pp. 453 -563. https://doi.org/10.1007/s10462-020-09837-3

    work page doi:10.1007/s10462-020-09837-3 2022

Show all 32 references
  1. [9]

    Data Security and Privacy Protection for Cloud Storage: A Survey

    Yang, P. et al. "Data Security and Privacy Protection for Cloud Storage: A Survey." IEEE Access 8 (2020): pp. 131723 -131740. https://doi.org/10.1109/ACCESS.2020.3012590

    2020

  2. [10]

    A Systematic Literature Review of Intrusion Detection System for Network Security: Research Trends, Datasets and Methods

    Ferdiana, R. "A Systematic Literature Review of Intrusion Detection System for Network Security: Research Trends, Datasets and Methods." Proceedings of th e 2020 4th International Conference on Informatics and Computational Sciences (ICICoS) (2020): pp. 1 -6. https://doi.org/1...

    2020

  3. [11]

    Machine Le arning and Cyber Security

    Das, R. and Morris, T. H. "Machine Le arning and Cyber Security." Proceedings of the 2017 International Conference on Computer, Electrical & Communication Engineering (ICCECE) (2017): pp. 1 -7. https://doi.org/10.1109/ICCECE.2017.8246763

    2017

  4. [12]

    A Comparative Analysis of Supervised and Unsupervised Models for Detecting Attacks on the Intrusion Detection Systems

    Talaei Khoei, T. and Kaabouch, N. "A Comparative Analysis of Supervised and Unsupervised Models for Detecting Attacks on the Intrusion Detection Systems." Information How to Cite: Noor Saud Abd et al; “The Importance of the Clustering Model to Detect New Types of Intrusion in ...

    2025 doi

  5. [13]

    Optimized Deep Learning with Binary PSO for Intrusion Detection on CSE-CIC-IDS2018 Dataset

    Farhan, R. I. et al. "Optimized Deep Learning with Binary PSO for Intrusion Detection on CSE-CIC-IDS2018 Dataset." Journal of Al - Qadisiyah for Computer Science and Mathematics 12.3 (2020): p. 16

    2020

  6. [14]

    An Effect ive Deep Learning Based Multi -Class Classification of DoS and DDoS Attack Detection

    Silivery, A. K. et al. "An Effect ive Deep Learning Based Multi -Class Classification of DoS and DDoS Attack Detection." International Journal of Electrical and Computer Engineering Systems 14.4 (2023): pp. 421-431

    2023

  7. [15]

    A Novel Attention-Based Feature Learning and Optimal Deep Learning Approach for Network Intrusion Detection

    Sakthi, K. and Nirmal Kumar, P. "A Novel Attention-Based Feature Learning and Optimal Deep Learning Approach for Network Intrusion Detection." Journal of Intelligent & Fuzzy Systems 45.3 (2023): pp. 5123 -5140. https://doi.org/10.3233/JIFS-230832

    2023 doi

  8. [16]

    Evaluation of Machine Learning Algorithms in Network - Based Intrusion Detection System

    Chua, T. H. and Salam, I. "Evaluation of Machine Learning Algorithms in Network - Based Intrusion Detection System." arXiv Preprint arXiv:2203.05232 (2022)

    2022 arXiv

  9. [18]

    High -Dimensional Pattern Regression Using Machine Learning: From Medical Images to Continuous Clini cal Variables

    Wang, Y. et al. "High -Dimensional Pattern Regression Using Machine Learning: From Medical Images to Continuous Clini cal Variables." Neuroimage 50.4 (2010): pp. 1519 - 1535. https://doi.org/10.1016/j.neuroimage.2010.0 1.097

    2010 doi

  10. [19]

    Selection of Relevant Features and Examples in Machine Learning

    Blum, A. L. and Langley, P. "Selection of Relevant Features and Examples in Machine Learning." Artificial Intelligence 97.1 (1997): pp. 245 –271. https://doi.org/10.1016/S0004- 3702(97)00056-3

    1997 doi

  11. [20]

    Introduction to the Data Mining Techniques in Cybersecurity

    Salem, I. E. et al. "Introduction to the Data Mining Techniques in Cybersecurity." Mesopotamian Journal of Cybersecurity (2022): pp. 28-37

    2022

  12. [21]

    A Clustering Method Based on K -Means Algorithm

    Li, Y. and Wu, H. "A Clustering Method Based on K -Means Algorithm." Physics Procedia 25 (2012): pp. 1104 -1109. https://doi.org/10.1016/j.phpro.2012.03.166

    2012 doi

  13. [22]

    Unsupervised K - Means Clustering Algorithm

    Sinaga, K. P. and Yang, M. S. "Unsupervised K - Means Clustering Algorithm." IEEE Access 8 (2020): pp. 80716 -80727. https://doi.org/10.1109/ACCESS.2020.2989683

    2020

  14. [23]

    Multi -View K-Means Clustering Algorithm Based on Redundant and Sparse Feature Learning

    Kong, G. et al. "Multi -View K-Means Clustering Algorithm Based on Redundant and Sparse Feature Learning." Physica A: Statistical Mechanics and Its Applications 633 (2024): p. 129405. https://doi.org/10.1016/j.physa.2024.129405

    2024

  15. [24]

    A Study of Graph-Based System for Multi -View Clustering

    Wang, H. et al. "A Study of Graph-Based System for Multi -View Clustering." Knowledge-Based Systems 163 (2019): pp. 1009 -1019. https://doi.org/10.1016/j.knosys.2018.08.027

    2019 doi

  16. [25]

    Intrusion Detection System: A Comprehensive Review

    Liao, H. J. et a l. "Intrusion Detection System: A Comprehensive Review." Journal of Network and Computer Applications 36.1 (2013): pp. 16-24. https://doi.org/10.1016/j.jnca.2012.04.014

    2013 doi

  17. [26]

    A Clustering Met hod Based on K - Means Algorithm

    Li, Y. G. "A Clustering Met hod Based on K - Means Algorithm." Applied Mechanics and Materials 380 (2013): pp. 1697 -1700. https://doi.org/10.4028/www.scientific.net/A MM.380.1697

    2013 doi

  18. [27]

    The K -Means Algor ithm: A Comprehensive Survey and Performance Evaluation

    Ahmed, M. et al. "The K -Means Algor ithm: A Comprehensive Survey and Performance Evaluation." Electronics 9.8 (2020): p. 1295. https://doi.org/10.3390/electronics9081295

    2020 doi

  19. [28]

    Landslide Susceptibility Zonation Method Based on C5.0 Decision Tree and K - Means Cluster Algorithms to Improve the Efficiency of Risk Management

    Guo, Z. et al. "Landslide Susceptibility Zonation Method Based on C5.0 Decision Tree and K - Means Cluster Algorithms to Improve the Efficiency of Risk Management." Geoscience Frontiers 12.6 (2021): p. 101249. https://doi.org/10.1016/j.gsf.2021.101249

    2021

  20. [29]

    K -Means Tree: An Optimal Clustering Tree for Unsupervised Learning

    Tavallali, P. et al. "K -Means Tree: An Optimal Clustering Tree for Unsupervised Learning." The Journal of Supercomputing 77.5 (2021): pp. 5239 -5266. https://doi.org/10.1007/s11227- 020-03573-x

    2021 doi

  21. [30]

    Detecting Cybersecurity Attacks Using Different Network Features with LightGBM and XGBoost Learners

    Leevy, J. L. et al. "Detecting Cybersecurity Attacks Using Different Network Features with LightGBM and XGBoost Learners." Proceedings of the 2020 IEEE Second International Conference on Cognitive Machine In telligence (CogMI) (2020): pp. 190 -197. https://doi.org/10.1109/CogM...

    2020

  22. [31]

    Anomaly Detection Using XGBoost Ensemble of Deep Neural Network Models

    Ikram, S. T. et al. "Anomaly Detection Using XGBoost Ensemble of Deep Neural Network Models." Cybernetics a nd Information Technologies 21.3 (2021): pp. 175-188

    2021

  23. [32]

    Network Intrusion Detection with XGBoost

    Gouveia, A. and Correia, M. "Network Intrusion Detection with XGBoost." Recent Advances in Security, Privacy, and Trust for Computing Systems and Applications (2020): pp. 1-12

    2020

  24. [33]

    Avcı, İ., & Koca, M. (20 23). Cybersecurity Attack Detection Model, Using Machine Learning Techniques. Acta Polytechnica Hun - garica, 20(7), 29-44

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.