Multi-type relational clustering for enterprise cyber-security networks

Several cyber-security data sources are collected in enterprise networks providing relational information between different types of nodes the network, namely computers, users and ports. This can be expressed as adjacency matrices detailing inter-type relationships corresponding to relations intra-type showing same type. In this paper, we propose an extension Non-Negative Matrix Tri-Factorisation (NMTF) simultaneously cluster based on their intra relationships. Existing NMTF clustering methods suffer from long computational times due large matrix multiplications. our approach, enforce stricter indicator constraints factor circumvent these issues. Additionally, make proposed approach less susceptible variation results random initialisation, a novel initialisation procedure Double Singular Value Decomposition for multi-type clustering. Finally, new performance measure suitable assessing unlabelled sets is presented. Our algorithm assessed both simulated real computer network against standard approaches its strong performance.