I am working on a research to detect ssh bruteforce attack using data mining. I would like to using ip geolocation as one of attributes. But, ip geolocation can't be used in classification algorithm due to difference of geolocation of each site (which means that I have to use clustering, right?). So, is there any technique that I can use classification with other attributes first, then use clustering later while using the classification in the system already.
$\begingroup$
$\endgroup$
3
-
$\begingroup$ what differences in geolocation? We don't know your data. $\endgroup$– Has QUIT--Anony-MousseOct 17, 2015 at 11:51
-
$\begingroup$ @Anony-Mousse Let's say that my training data is collected from country A. Most of the legitimate user will come from the country. But if I use this model in another country. It will fail. Since the legitimate user doesn't come from country A anymore. $\endgroup$– Thanapon SooOct 18, 2015 at 20:22
-
$\begingroup$ Why don't you then train one model per country? $\endgroup$– Has QUIT--Anony-MousseOct 18, 2015 at 20:27
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
Clustering isn't your general solution when you can't classify.
Never use clustering in an automated approach (except if you are doing vector quantization).
It is an explorative method. Meaning tht it can and will fail to produce the desired results.
The purpose is to help you understand your data.
It's not a drop in fix for classification issues.
answered Oct 17, 2015 at 11:51
$\begingroup$
$\endgroup$
0
Perhaps you could bin your latitudes and longitudes into larger geographic areas?
