Determination of optimal cluster number in connection to SCADA

Abstract

The recent evolution of cyber-attacks creates eminent pressure on information and communication systems. The increasing number of cyber-attacks and their sophistication have resulted in needs of the new type of cyber defense. The anomaly detection in relation to intrusion detection system (IDS) in connection with standard cyber defense technologies may be the answer to contemporary development in cyber security. Moreover, unsupervised anomaly detection based on K-means algorithm is broadly examined by a considerable number of researchers. Therefore, the algorithm is a solid selection in relation to intrusion detection system. However, one of the problems is to determine a proper number of cluster for the K-means. Nonetheless, there are methods to determine the optimal number of clusters. The aim of the article is to determine the number of clusters in relation to Supervisory Control and Data Acquisition system.