INNER CODE UNIT · Python
odd_df
A3sal0n/CyberThreatHunting · tools/bro-dns-iforest.py:150
odd_df = bro_target_df[outliers == -1]
# Explore outliers with the help from KMeans
odd_matrix = to_matrix.fit_transform(odd_df)
num_clusters = min(len(odd_df), 4) # 4 clusters unless we have less than 4 observations
odd_df['cluster'] = KMeans(n_clusters=num_clusters).fit_predict(odd_matrix)
# Group the dataframe by cluster
cluster_groups = odd_df[['cluster']].groupby('cluster')
# Save all outliers per cluster
f = open('kmeans-clusters.json', 'w')
for key, group in cluster_groups:
f.write('#Cluster {:d}: {:d} observations'.format(key, len(group)) + '\n')
np_matrix = group.to_records()
for item in np_matrix:
f.write(json.dumps(original_data[srows[item[0]]]) + '\n')
f.close()