Hierarchical Clustering of Group Behaviors in Cyber Situation Awareness

In cyber situation awareness, top-down simulation for group behaviors of attacks are unsupported to simulate unknown cliques of attackers. To solve this issue, we believe that hierarchical group behaviors as an abstract data type (ADT) can be agglomerated by other behavior types, such as individual and subgroup behaviors with a bottom-up way. In this paper, we propose a hierarchical clustering algorithm according to theory of ADTs. Specifically, behavioral algebra acts as a formalization approach of hierarchical relationship. Because this proposed algorithm reduces the time complexity of existing hierarchical clustering, it can implement agglomeration of group behaviors for simulation.