Constructing APT Attack Scenarios Based on Intrusion Kill Chain and Fuzzy Clustering

Table 2

Results of clustering algorithms with different dimensions.

Clustering algorithm	Dimensions of clustering algorithm	Result
Fuzzy Clustering which includes the attack-event dimension	alarm_event, IP address, timestamp	Escalating attack mechanism, and there is higher correlation in an attack sequence
Fuzzy Clustering which exclude the attack-event dimension	IP address, timestamp	Attack events intersect, and there is small correlation in an attack sequence