Număr curent

Revista Română de Informatică și Automatică / Vol. 36, Nr. 2, 2026


Enhancing threat intelligence analysis through Fuzzy C-Means Clustering: A novel approach for cybersecurity

Mokhled ALTARAWNEH, Laila ALTERKAWI

Rezumat:

This paper presents an experimental framework applying Fuzzy C-Means (FCM) clustering to improve cybersecurity threat intelligence analysis. Common clustering algorithms (e.g., k‑means, DBSCAN) enforce hard divisions that cannot represent the uncertainties and overlaps inherent in cyber threat indicators. The proposed FCM‑based system assigns partial memberships to better model ambiguous and dynamic threat behaviors. Using the CICIDS2017 dataset, FCM achieves 91.5% accuracy and a 3.5% false positive rate – a 12.7% accuracy improvement and a 75% reduction in false positives compared to k‑means. Internal validation (Fuzzy Partition Coefficient = 0.92, Silhouette Score = 0.78) and external comparison with ground truth (Normalized Mutual Information = 0.85, ROC AUC = 0.94) confirm the quality of the fuzzy clustering. The results show that FCM provides a mathematically grounded and operationally beneficial foundation for threat intelligence systems, reducing analyst workload and improving threat detection. The primary contribution is a reproducible, detailed experimental evaluation that quantifies the operational advantages of FCM over hard clustering methods on a modern benchmark dataset, along with a practical interpretation framework for security operations centers.

Cuvinte cheie:
Cybersecurity, Threat intelligence, Fuzzy C-Means, Anomaly detection, Threat hunting.

Vizualizează articolul complet:

ACEST ARTICOL SE CITEAZĂ ASTFEL:
Mokhled ALTARAWNEH, Laila ALTERKAWI, „Enhancing threat intelligence analysis through Fuzzy C-Means Clustering: A novel approach for cybersecurity”, Revista Română de Informatică și Automatică, ISSN 1220-1758, vol. 36(2), pp. 35-46, 2026. https://doi.org/10.33436/v36i2y202603