Having a unsupervised algorithm done on a dataset (e.g. K-means), how to determine which cluster is normal and which is anomalous (for 30 clusters, for example)?
If the dataset contains normal traffic much more than anomalies (99%), then the radius of clusters associate to normal traffic is bigger. Is this true? Why?
If so, then we set the clusters with greater radius to normal according to a threshold. The smaller the threshold, the more the detection rate and the more the false alarm rate. Is this true?
Could labeled dataset, helps determining the normal clusters? For example, finding the closest point to the centroid of a given cluster and check whether it is labeled anomaly or not?
[1] uses Cluto software and its mountain visualization graph that I can't understand why its 3D, having feature space of dimension 41.
Reference: [1] Jose F. Nieves, Data Clustering for Anomaly Detection in Network Intrusion Detection
