AMP-KMeans and CHIC: Adaptive Multi-Distance and Ensemble Clustering Frameworks for Network Intrusion Detection

This section reviews prior work organised around four research themes relevant to the proposed methods: distance-based and centroid clustering for intrusion detection, density-based and hybrid approaches, ensemble clustering, and evaluation datasets and metrics. The section concludes with a synthesis of existing gaps that motivate AMP-KMeans and CHIC.

2.1 Distance-based and centroid clustering for intrusion detection

Clustering remains one of the most widely adopted unsupervised techniques for intrusion detection because it can identify hidden structures in network traffic without requiring labeled data. However, extensive studies have shown that no single clustering algorithm consistently performs well across datasets with different characteristics, as performance is highly dependent on factors such as dimensionality, cluster geometry, density distribution, and sample size [6]. This limitation is particularly relevant in cybersecurity, where network traffic exhibits heterogeneous and evolving patterns that rarely conform to the assumptions of traditional clustering methods.

A common strategy for improving clustering performance in intrusion detection is dimensionality reduction. Experimental evidence on the NSL-KDD dataset demonstrated that applying Principal Component Analysis (PCA) prior to K-Means clustering significantly improves detection accuracy, increasing performance from 82.61% to 94.51% [14]. These findings suggest that feature-space optimisation plays a critical role in enhancing cluster separability and reducing the impact of redundant attributes.

Recent research has also explored the limitations of fixed distance measures. Conventional clustering algorithms typically rely on a single metric, such as Euclidean distance, which may not adequately capture the complex relationships present in high-dimensional security data. Metric-learning approaches have shown that distance functions can be learned directly from the data to better reflect underlying class structures [15]. Similarly, multi-view clustering frameworks have demonstrated that combining multiple representations of the same dataset can improve clustering quality by exploiting complementary information sources [16]. These observations suggest that adaptive combinations of multiple distance metrics may provide a more flexible representation of network traffic than any single metric alone.

2.2 Density-based and hybrid methods

Density-based clustering approaches have attracted considerable attention in intrusion detection because of their ability to identify arbitrarily shaped clusters and detect anomalous observations as outliers. Recent improvements to DBSCAN have focused on automating parameter selection, leading to enhanced detection performance and lower false-positive rates on benchmark intrusion detection datasets [17]. Nevertheless, density-based methods remain sensitive to variations in local density, a common characteristic of real-world network traffic where benign and malicious activities often exhibit significantly different distributions.

To address these limitations, hybrid approaches have been proposed that incorporate additional contextual information beyond feature similarity. Relationship-aware clustering methods that model temporal dependencies, communication patterns, and shared attack characteristics have been shown to improve clustering purity compared with approaches based solely on raw feature vectors [4]. Such findings highlight the importance of exploiting structural relationships within security events rather than relying exclusively on geometric proximity.

Another challenge arises from the high dimensionality of cybersecurity data. Locally adaptive weighting mechanisms have demonstrated effectiveness in identifying relevant dimensions while suppressing noisy or irrelevant features, particularly in outlier detection scenarios [18]. Furthermore, combining clustering with supervised learning has been shown to reduce the manual labeling burden associated with security alert analysis while maintaining high classification performance [19]. Collectively, these studies indicate that adaptive weighting and hybrid learning strategies offer promising directions for overcoming the limitations of conventional clustering techniques.

2.3 Ensemble clustering

Ensemble clustering has emerged as an effective strategy for improving clustering robustness by integrating the outputs of multiple clustering algorithms. The fundamental premise is that combining diverse clustering perspectives can produce solutions that are more accurate and stable than those generated by any individual algorithm [12]. This approach is particularly attractive in intrusion detection, where the underlying structure of network traffic may not be adequately captured by a single clustering paradigm.

Research has shown that ensemble performance depends not only on the quality of individual clusterings but also on their diversity. In particular, ensembles composed of moderately accurate yet substantially different clustering solutions often outperform ensembles built from highly similar algorithms [13]. This finding has motivated the use of heterogeneous clustering ensembles that combine centroid-based, density-based, hierarchical, probabilistic, and graph-based approaches.

Additional studies have highlighted the importance of uncertainty management within ensemble frameworks. Improved performance has been achieved by focusing on ambiguous data points located near cluster boundaries, where cluster assignments are inherently less reliable [20]. Similar benefits have been observed in other domains through the integration of ensemble learning with graph-based models capable of capturing complex relationships among data instances [21]. These results suggest that adaptive weighting and boundary-aware refinement mechanisms can further enhance ensemble clustering performance, particularly in challenging datasets characterised by overlapping classes and irregular cluster structures.

2.4 Evaluation and datasets

Sharafaldin and colleagues [22] created CICIDS2017 to fix problems with older datasets. They built a realistic network with 12 victim machines running different operating systems, captured traffic over five days, and extracted 80 features per flow. The result has about 2.8 million instances across 8 attack types, with all the messiness of real data, imbalanced classes, correlations between features, temporal patterns.

Tavallaee et al. [23] cleaned up the old KDD'99 dataset to create NSL-KDD. They removed redundant records that were biasing results, leaving 125,973 instances with 41 features. It's less representative of modern attacks, but so many studies have used it that it's still valuable for comparison.

Steinley et al. [24] provided a detailed analysis of the Adjusted Rand Index (ARI), highlighting its normalization properties and its robustness due to correction for chance. For internal validation, the silhouette coefficient remains a widely used metric for assessing cluster cohesion and separation [25].

2.5 Synthesis and research gaps

Table 1 summarises the key approaches reviewed above and identifies the gaps that AMP-KMeans and CHIC are designed to address. Existing single-algorithm methods (K-Means, DBSCAN, GMM) each make fixed geometric or distributional assumptions that network traffic routinely violates. Parameter-adaptive variants such as the study [17] reduce manual tuning but remain single-algorithm approaches susceptible to those same assumptions. Ensemble methods [13, 14] improve robustness but have not been systematically applied to multi-class network intrusion data with heterogeneous cluster shapes and severe class imbalance. None of the reviewed works combines adaptive distance weighting, density-sensitive initialisation, and entropy-driven boundary refinement within a unified ensemble framework designed specifically for intrusion detection workloads.

Table 1. Comparison of related approaches and research gaps addressed by the proposed methods

Note: intrusion detection systems (IDS); Adaptive Multi-Path K-Means (AMP-KMeans); Consensus-Based Hierarchical Integration Clustering (CHIC); Gaussian Mixture Model (GMM)

This section introduces the proposed clustering framework for intrusion detection, which consists of two complementary approaches: AMP-KMeans and Consensus-Based Hierarchical Integration Clustering (CHIC). The overall workflow of the proposed approach is illustrated in Figure 1. The framework begins with network traffic datasets that undergo preprocessing, after which the processed data are analyzed using the two proposed clustering methods. The resulting clusters are finally evaluated using standard clustering quality metrics.

Figure 1. Overview of the proposed clustering framework

4.1 Mathematical notation

The proposed clustering framework relies on several mathematical symbols to describe the dataset, clustering parameters, density estimation, entropy analysis, and ensemble consensus construction. For clarity and consistency, the notation used throughout this chapter is summarized in Table 2.

Table 2. Mathematical notation

4.2 Adaptive Multi-Path K-Means

AMP-KMeans addresses three fundamental limitations of traditional K-Means: single distance metric imposing uniform geometric assumptions, sensitivity to initialization, and inability to handle outliers and varying cluster shapes.

This design builds directly on the study [11], which demonstrated that combining complementary distance functions captures structural relationships in network intrusion data that any single metric misses, while extending that binary combination into a fully adaptive, three-path weighted architecture.

4.2.1 Multi-path distance computation

For each point $x_i$ and centroid $c_j$ , three complementary distance measures:

Euclidean (geometric distance):

$d_{i j}^{(1)}=\left\|x_i-c_j\right\|_2$

Manhattan (robust to outliers):

$d_{i j}^{(2)}=\left\|x_i-c_j\right\|_1$

Cosine (directional similarity):

$d_{i j}^{(3)}=1-\left(x_i \cdot c_j\right) /\left(\left\|x_i\right\|_2\left\|c_j\right\|_2\right)$

Composite distance: $D_{i j}=\Sigma w_m \cdot \operatorname{normalized}\left(d_{i j}^{(m)}\right)$, where normalized distances ensure each metric contributes comparably.

4.2.2 Adaptive weight update

Weights $w_m$ adapt each iteration based on cluster cohesion measured by each metric. $S_m^{(t)}$ be the mean intra-cluster distance under metric m at iteration t, averaged first within each cluster and then across clusters to account for class imbalance:

$S_m^{(t)}=(1 / k) \sum_{j=1}^k\left(1 /\left|C_{\mathrm{j}}\right|\right) \Sigma_{\mathrm{i}} \in C_{\mathrm{j}} d_{i j}^{(m)}$

Weight update:

$w_m^{(t+1)}=\frac{\left(\frac{1}{S_m^{(t)}}\right)}{\Sigma\left(\frac{1}{S_r^{(t)}}\right)}$

where, $r$ is the summation index over all three metrics (1 to 3). This ensures metrics producing more compact clusters receive higher weight.

4.2.3 Density-sensitive initialization

To avoid the sensitivity of standard random initialization, AMP-KMeans estimates the local density of each point before selecting initial centroids. The local density ρᵢ for point xᵢ is defined as the mean distance to its k nearest neighbors:

$\rho_i=\left(1 / k_{n \beta r}\right) \Sigma_j \in k N N(i)\left\|x_i-x_j\right\|_2$

where, kNN(i) denotes the set of k nearest neighbors of xᵢ. A high ρᵢ indicates that xᵢ is in a sparse region, while a low ρᵢ indicates a dense neighborhood. This quantity is computed once before the iterative loop and is used only for initialization.

The first centroid c⁽¹⁾ is selected with probability proportional to 1/ρ_i, i.e., points in denser regions are more likely to be chosen as the first centroid, since dense areas more reliably represent genuine cluster cores:

$p_i^{(1)} \propto 1 / \rho_i$

The superscript denotes the selection step for the first centroid. For each subsequent centroid c⁽ᵗ⁾ (t = 2, …, k), the selection probability combines density preference with maximum coverage:

$p_i^{(t)} \propto\left(1 / \rho_i\right) \cdot \min _{\{c \text { already selected }\}}\left\|x_i-c\right\|_2$

This ensures that later centroids are both in reasonably dense zones and as far as possible from already-placed centroids, guaranteeing good initial coverage of the feature space. The superscript (t) therefore simply indexes the selection order, from t = 1 to t = k.

4.2.4 Covariance estimation and outlier handling

Covariance matrix for each cluster:

$\Sigma_j=\left(\frac{1}{\left|C_j\right|}\right) \Sigma\left(x_i-c_j\right)\left(x_i-c_j\right)^{\mathrm{T}}+\varepsilon I$

where, ε > 0 is a small regularization constant ensuring Σⱼ is positive definite.

Points whose squared Mahalanobis distance exceeds the 95th percentile of the chi-squared distribution with d degrees of freedom, denoted $\chi_{\{d, 0.95\}}^2$, where d is the feature dimensionality, are flagged as outliers and reassigned to the second-nearest centroid. This threshold follows the standard statistical convention: under the assumption that a cluster follows a multivariate Gaussian distribution, 95% of inlier points fall within the ellipsoid defined by $\chi_{\{d, 0.95\}}^2$. Points exceeding the 99th percentile of observed Mahalanobis distances are labeled as noise and excluded from centroid updates entirely.

4.3 Consensus-Based Hierarchical Integration Clustering

CHIC integrates five base clustering algorithms through adaptive local weighting, consensus voting, and boundary refinement.

4.3.1 Base algorithm selection

Five fundamentally different algorithms:

• K-Means: Centroid-based partitioning (10 initializations, best silhouette)

• GMM: Probabilistic (full covariance, best BIC)

• DBSCAN: Density-based (adaptive eps)

• Hierarchical: Agglomerative (Ward linkage)

• Spectral: Graph-theoretic (RBF kernel, Nyström approximation)

4.3.2 Adaptive local weighting

For each point $i$ and algorithm $m$, compute local consistency using k-nearest neighbors ($k=\min (20, n /100)$). Entropy of labels in neighborhood:

$H_i^{(m)}=-\Sigma p_{i l}^{(m)} \log p_{i l}^{(m)}$

Consistency score:

$\operatorname{consistency}_i^{(m)}=1-H_i^{(m)} / \log \left(\left|L_m\right|\right)$

Local weights:

$w_i^{(m)}=$consistency $_i^{(m)} / \Sigma$consistency $y_i^{(r)}$

4.3.3 Weighted co-association matrix

For points $p$ and $q$ :

$A_{p q}=\frac{\Sigma_m w_p^{(m)} w_q^{(m)} \mathbb{1}\left[L_m(p)=L_m(q)\right]}{\Sigma_m w_p^{(m)} w_q^{(m)}}$

Properties: weighted contribution from reliable algorithms, symmetry, range [0, 1] positive semi-definite.

4.3.4 Consensus clustering and boundary refinement

Distance matrix: $D_{pq}=1-A_{pq}$. Apply hierarchical clustering with average linkage to obtain $k$ clusters. Identify boundary points $B$ where label entropy in neighborhood exceeds threshold $\tau$ (75th percentile). Reassign boundary points via distance-weighted voting from neighbors.

Table 3 reports the time and memory complexity for each stage of the CHIC pipeline.

Table 3. The time and memory complexity of each Consensus-Based Hierarchical Integration Clustering (CHIC) stage

Time and memory complexity per stage of CHIC. For $n>10^5$ , the co-association matrix step is approximated by operating on a stratified sample of size s, reducing complexity to O(s·n) at a modest accuracy cost. The Nyström approximation (s = 1000) is already applied to the Spectral base learner.

6.1 Overall performance comparison

Figures 2, 3, and 4 present graphical summaries of the results in Table 4 for Silhouette score and ARI. Figures 2 and 3 compare ARI scores across all methods on both datasets. Figure 4 shows silhouette score trends, illustrating the geometric quality gain achieved by the proposed methods comparing to the traditional methods.

Figure 2. Adjusted Rand Index (ARI) comparison across all methods CICIDS2017 dataset (error bars = ± std)

Figure 3. Adjusted Rand Index (ARI) comparison across all methods NSL-KDD dataset (error bars = ± std)

Figure 4. Silhouette score trends across methods

Table 4. Comprehensive clustering results (mean ± std)

Note: Adjusted Rand Index (ARI); Consensus-Based Hierarchical Integration Clustering (CHIC); Adaptive Multi-Path K-Means (AMP-KMeans); Normalized Mutual Information (NMI); Gaussian Mixture Model (GMM)

6.2 Ablation study

To isolate the contribution of each design element, Table 5 presents results from systematically removing individual components from CHIC-Optimal and AMP-KMeans-Adaptive on CICIDS2017 (8-class, most complex setting).

Table 5. Ablation study results on CICIDS2017

Note: Adjusted Rand Index (ARI); Consensus-Based Hierarchical Integration Clustering (CHIC); Adaptive Multi-Path K-Means (AMP-KMeans); Normalized Mutual Information (NMI); Gaussian Mixture Model (GMM)

Each row removes one component from the full model. Δ ARI is the percentage change relative to the respective full model. Results confirm that all design elements contribute positively: adaptive local weighting provides the largest individual contribution to CHIC (+7.6% when removed), while the density-sensitive initialisation provides the largest marginal gain in AMP-KMeans (+7.2%). The monotonic improvement from CHIC-Basic through CHIC-Optimal (Table 4) is consistent with the component-wise analysis in Table 5.

6.3 Key findings

Ensemble Superiority: CHIC variants consistently achieve the highest ARI scores across both datasets, with performance improving monotonically as more components are added. On CICIDS2017: CHIC-Basic (0.646) → CHIC-Advanced (0.668) → CHIC-Ensemble (0.689) → CHIC-Optimal (0.712), representing a cumulative gain of +10.2% over CHIC-Basic. On NSL-KDD the same trend holds: 0.779 → 0.789 → 0.801 → 0.812 (+4.2% cumulative). The larger gains on CICIDS2017 reflect the greater complexity of its 8-class structure compared to NSL-KDD's binary classification.

AMP-KMeans Improvements: AMP-KMeans and its variants substantially outperform standard K-Means on both datasets. On CICIDS2017: K-Means ARI = 0.215 → AMP-KMeans = 0.568 (+164%) → AMP-KMeans++ = 0.589 (+174%) → AMP-KMeans-Adaptive = 0.612 (+185%). On NSL-KDD the gains are more modest: 0.615 → 0.735 (+19.5%) → 0.746 (+21.3%) → 0.757 (+23.1%), consistent with NSL-KDD's simpler structure. AMP-KMeans-Adaptive identified 9 clusters on CICIDS2017 (versus 8 ground-truth classes) with 1.2% noise, suggesting the presence of sub-structure within certain attack families.

Traditional Baseline: On CICIDS2017, GMM achieves the best traditional ARI (0.492) but the lowest silhouette score (0.054), indicating geometrically incoherent clusters despite moderate label alignment. K-Means performs worst by ARI (0.215). DBSCAN identifies 12 clusters with 8.54% noise, reflecting density variation within attack classes. On NSL-KDD, all traditional methods reach ARI values of 0.61–0.62, with the exception of DBSCAN (0.546).

Attack-Category Analysis: Examination of per-class cluster purity on CICIDS2017 reveals that CHIC-Optimal achieves the strongest separation for DoS variants (estimated cluster F1 > 0.85), which form temporally dense and geometrically compact groups well-suited to density-sensitive initialisation. Web Attack subtypes (Brute Force, XSS, SQL Injection) exhibit greater feature overlap; the boundary refinement step most visibly benefits these classes by reassigning ambiguous boundary points. Infiltration and Botnet attacks, which represent low-volume, distributed patterns dispersed across the feature space, remain the most challenging to separate, consistent with the elevated noise ratio (8.54%) identified by DBSCAN in those feature regions. PortScan clusters are well-separated by all methods, reflecting the distinctive high-rate scanning signature. These observations explain why improvement magnitude is higher on CICIDS2017 (8 classes, heterogeneous geometry) than on NSL-KDD (2 classes, simpler structure).

Statistical Significance and Stability: All comparisons between proposed and traditional methods are significant at p < 0.001 with large effect sizes (Cohen's d > 16 in all cases). CHIC-Optimal's standard deviation is approximately half that of GMM (0.015) and one-fifth that of DBSCAN (0.042), demonstrating the stability benefit of ensemble averaging.

Statistical Test Justification: Normality of ARI distributions across the 5 experimental runs was assessed using the Shapiro-Wilk test. For all proposed methods and K-Means, GMM, and Hierarchical, the normality assumption was not rejected (p > 0.05), supporting the use of independent-samples t-tests. For DBSCAN, normality was rejected (p = 0.03) due to its higher variance across runs; a Mann-Whitney U test was therefore used for all comparisons involving DBSCAN, and results remain significant at p < 0.001. Variance homogeneity was confirmed by Levene's test for all t-test comparisons. We acknowledge that 5 experimental runs constitute a small sample; the large observed effect sizes (Cohen's d > 16) and tight confidence intervals nonetheless support the reported significance levels.

Table 6 presents the detailed statistical validation for the key comparisons on CICIDS2017.

Table 6. Statistical validation