K-Means Clustering of Attack Tools for Threat Attribution in Network Security Incidents

Abstract

This research investigates the application of K-means clustering for attack tool attribution in network security (cybersecurity) incidents using a large-scale open-source dataset of 14,133 records. The dataset includes attributes such as attack type, tools, vulnerabilities, MITRE techniques, impacts, and detection methods, providing a comprehensive foundation for clustering analysis. Unlike previous attribution studies emphasizing malware signatures, anomaly detection, or insider behaviors, this research uniquely focuses on tool-based clustering to uncover consistent adversarial tradecraft across incidents. The methodology involved data preprocessing with tokenization and TF-IDF encoding of tools, dimensionality reduction through Principal Component Analysis, and clustering with K-means optimized using the Elbow Method evaluation, employing silhouette scores, entropy, and purity metrics. Results indicated an optimal clustering configuration at k = 6, with a silhouette score o.71, reflecting well-defined separation. Frequently recurring tools such as BurpSuite, Wireshark, curl, Python, and PowerShell formed distinct clusters aligning closely with MITRE ATT&CK tactics, including reconnaissance, exploitation, persistence, and exfiltration. Statistical tests confirmed significant relationships between clustered tools and vulnerabilities, validating the approach for attribution. The novelty of this research lies in demonstrating that attack tool clustering provides a resilient and interpretable forensic perspective, offering defenders actionable intelligence. This study contributes a scalable, explainable, and data-driven framework for advancing threat attribution and proactive defense by shifting focus from payloads to persistent tool usage.