Current Issue

Romanian Journal of Information Technology and Automatic Control / Vol. 36, No. 2, 2026


Enhancing threat intelligence analysis through Fuzzy C-Means Clustering: A novel approach for cybersecurity

Mokhled ALTARAWNEH, Laila ALTERKAWI

Abstract:

This paper presents an experimental framework applying Fuzzy C-Means (FCM) clustering to improve cybersecurity threat intelligence analysis. Common clustering algorithms (e.g., k‑means, DBSCAN) enforce hard divisions that cannot represent the uncertainties and overlaps inherent in cyber threat indicators. The proposed FCM‑based system assigns partial memberships to better model ambiguous and dynamic threat behaviors. Using the CICIDS2017 dataset, FCM achieves 91.5% accuracy and a 3.5% false positive rate – a 12.7% accuracy improvement and a 75% reduction in false positives compared to k‑means. Internal validation (Fuzzy Partition Coefficient = 0.92, Silhouette Score = 0.78) and external comparison with ground truth (Normalized Mutual Information = 0.85, ROC AUC = 0.94) confirm the quality of the fuzzy clustering. The results show that FCM provides a mathematically grounded and operationally beneficial foundation for threat intelligence systems, reducing analyst workload and improving threat detection. The primary contribution is a reproducible, detailed experimental evaluation that quantifies the operational advantages of FCM over hard clustering methods on a modern benchmark dataset, along with a practical interpretation framework for security operations centers.

Keywords:
Cybersecurity, Threat intelligence, Fuzzy C-Means, Anomaly detection, Threat hunting.

View full article:

CITE THIS PAPER AS:
Mokhled ALTARAWNEH, Laila ALTERKAWI, "Enhancing threat intelligence analysis through Fuzzy C-Means Clustering: A novel approach for cybersecurity", Romanian Journal of Information Technology and Automatic Control, ISSN 1220-1758, vol. 36(2), pp. 35-46, 2026. https://doi.org/10.33436/v36i2y202603