Week 7 - Clustering and Threat Hunting

 In regards to threat hunting, there are specific techniques that can be effective. One of these techniques is clustering. Clustering is borrowed from statistical analysis, which is useful when looking for shared features in large data sets. Clustering analysis is a technique often used in statistics to identify groups of data points based on certain criteria, such as occurrence. 

Good clustering methods will result in groups that have high interclass similarity, meaning that they are quite similar to one another based on the predefined criteria, as well as low interclass similarity.

Similar to clustering, grouping is a means to categorize similar data points by taking a set of unique features and determining the artifacts that fit the criteria. Grouping requires that these defining features be described in advance, whereas clustering does not require this to be the case. Often, one of the features used in a clustering criterion is time, as would be the case in looking for a particular type of command executed in a certain time frame.