Current Issue
Romanian Journal of Information Technology and Automatic Control / Vol. 36, No. 2, 2026
Enhancing threat intelligence analysis through Fuzzy C-Means Clustering: A novel approach for cybersecurity
Mokhled ALTARAWNEH, Laila ALTERKAWI
This paper presents an experimental framework applying Fuzzy C-Means (FCM) clustering to improve cybersecurity threat intelligence analysis. Common clustering algorithms (e.g., k‑means, DBSCAN) enforce hard divisions that cannot represent the uncertainties and overlaps inherent in cyber threat indicators. The proposed FCM‑based system assigns partial memberships to better model ambiguous and dynamic threat behaviors. Using the CICIDS2017 dataset, FCM achieves 91.5% accuracy and a 3.5% false positive rate – a 12.7% accuracy improvement and a 75% reduction in false positives compared to k‑means. Internal validation (Fuzzy Partition Coefficient = 0.92, Silhouette Score = 0.78) and external comparison with ground truth (Normalized Mutual Information = 0.85, ROC AUC = 0.94) confirm the quality of the fuzzy clustering. The results show that FCM provides a mathematically grounded and operationally beneficial foundation for threat intelligence systems, reducing analyst workload and improving threat detection. The primary contribution is a reproducible, detailed experimental evaluation that quantifies the operational advantages of FCM over hard clustering methods on a modern benchmark dataset, along with a practical interpretation framework for security operations centers.
Keywords:
Cybersecurity, Threat intelligence, Fuzzy C-Means, Anomaly detection, Threat hunting.
CITE THIS PAPER AS:
Mokhled ALTARAWNEH,
Laila ALTERKAWI,
"Enhancing threat intelligence analysis through Fuzzy C-Means Clustering: A novel approach for cybersecurity",
Romanian Journal of Information Technology and Automatic Control,
ISSN 1220-1758,
vol. 36(2),
pp. 35-46,
2026.
https://doi.org/10.33436/v36i2y202603