Clustering-Based Defense (CBD) in Security

• Clustering-Based Defense (CBD) is a defensive design pattern that uses various clustering methods to expose and organize adversarial structures in security applications.
• It leverages algorithms like K-means, density-based, and structured clustering to identify malicious behavior in network traffic, federated learning, and cyber-physical systems.
• Clustering outcomes drive downstream actions such as filtering, relabeling, or aggregation, effectively enhancing intrusion detection, poisoning mitigation, and fairness robustness.

Searching arXiv for papers on clustering-based defenses across security domains. Clustering-Based Defense (CBD) denotes a class of security mechanisms in which clustering is used to expose, organize, or constrain malicious structure before a downstream defensive action is taken. Across the literature, CBD appears in intrusion detection, website fingerprinting defense, federated learning, backdoor and poisoning mitigation, fairness-preserving clustering, power-system monitoring, and clustered wireless or mobile ad hoc networks. The shared premise is that adversarial behavior, poisoned data, or privacy-relevant traffic induces exploitable regularities in feature space, gradient space, traffic patterns, transfer-function structure, or network topology; clustering then becomes the substrate for labeling, filtering, aggregation, padding adaptation, or coordinated response (Abd et al., 2024, Khajavi et al., 1 Sep 2025, Yadav et al., 2021, Jin et al., 2021).

1. Conceptual scope and meanings of CBD

In the cited literature, CBD is not a single standardized algorithm. It ranges from unsupervised partitioning of network flows with K-means, to density-based filtering of federated gradients, to cluster-head hierarchies in ad hoc networks, to consensus clustering used as a robustness mechanism against fairness attacks. Some systems cluster data points directly; others cluster gradients, measurements, traffic traces, or even nodes in a communication graph. This suggests that CBD is best understood as a defensive design pattern rather than a single method.

A first important distinction is between cluster-as-detector and cluster-as-architecture. In detector-centric systems, clustering separates suspicious from benign structure, as in Beta Poisoning defense, backdoor segregation, dynamic clustering of power-system measurements, or K-means grouping of unlabeled traffic (Gulciftci et al., 2 Aug 2025, Zhang et al., 21 May 2026, Jevtić et al., 2020). In architecture-centric systems, clustering organizes the defense surface itself: cluster-heads aggregate intrusion evidence in wireless ad hoc networks, and vehicular hierarchical federated learning assigns anomaly detection and aggregation roles to cluster heads and an EPC layer (Sen, 2010, HaghighiFard et al., 2 May 2025).

A second distinction concerns the defensive objective. In some papers, CBD is used to discover unknown attacks from unlabeled observations; in others it is used to filter poisoned updates or samples; elsewhere it is used to guarantee anonymity or fairness properties. In Adaptive Tamaraw, clustering is not used to detect an attacker directly, but to build $(k,l)$-diverse anonymity sets that support a formal upper bound on attacker success probability (Khajavi et al., 1 Sep 2025). In Consensus Fair Clustering, the defense target is not malware or poisoning, but fairness manipulation via adversarial changes to protected labels (Chhabra et al., 2022).

2. Recurring methodological structure

Despite this heterogeneity, most CBD systems share a recurring pipeline: construct a representation, form clusters under a task-specific similarity notion, and apply a cluster-conditioned action. For network intrusion, the representation is typically a flow-level feature vector obtained from traffic capture and preprocessing; for federated learning it is a client gradient; for website fingerprinting it is a time-series trace or Traffic Aggregation Matrix; for backdoor defense it is a latent feature vector from a trained network; for power systems it is a transfer-function-derived feature matrix; and for clustered network defense it is node-level or cluster-level state (Abd et al., 2024, Khajavi et al., 1 Sep 2025, Guo et al., 2023, Shi et al., 23 Apr 2026).

One major family of CBDs uses partitioning objectives of the K-means type. The intrusion-detection formulation minimizes within-cluster variance,

$$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$

with Euclidean assignments and mean updates. In that setting, normalization is integral because network features can differ by orders of magnitude, and the resulting clusters are interpreted as attack categories or normal traffic (Abd et al., 2024).

A second family uses density-based clustering. CCA-UD applies UMAP to penultimate-layer features and then DBSCAN with $\epsilon = 0.8$ and $\text{minPts} = 20$ to discover poisoned clusters, followed by centroid analysis and feature mixing (Guo et al., 2023). CSC applies t-SNE and DBSCAN with $\text{eps} = 3$ during early epochs, then flags non-largest clusters as suspicious and relabels them to a virtual class before classifier-head fine-tuning (Shi et al., 23 Apr 2026). EnCAgg projects gradients onto the top two PCA directions and applies DBSCAN with a radius selected from known-benign reference clients, then re-clusters with generated pseudo-gradients to recover benign outliers (Zhang et al., 21 May 2026).

A third family uses structured or constrained clustering. Adaptive Tamaraw constructs $(k,l)$-diverse anonymity sets and maintains Tamaraw’s information-theoretic guarantee through fixed-rate padding, fixed defended-length buckets, and per-set safe switching times; its security bound is expressed through non-uniform weighted $\delta$-non-injectivity (Khajavi et al., 1 Sep 2025). Consensus Fair Clustering aggregates multiple K-means partitions into a co-association matrix and then learns a fairness-aware graph embedding with contrastive and KL-based objectives (Chhabra et al., 2022). Dynamic clustering for power systems groups measurements whose disturbance-to-output transfer functions satisfy a proportionality condition, operationalized through a reachability-Gramian feature matrix $\Phi = C W_L$ and similarity checks of the form $\|p_j \Phi_i - p_i \Phi_j\|\le \theta$ (Jevtić et al., 2020).

3. Representative domains and instantiations

The literature uses the term across substantially different security settings. The following summary highlights the principal formulations.

Domain	CBD formulation	Representative work
Network intrusion detection	K-means on normalized flow features; cluster-to-attack mapping; optional XGBoost stage	(Abd et al., 2024)
Website fingerprinting defense	Pattern-level clustering into $(k,l)$-diverse anonymity sets; per-set Tamaraw parameters	(Khajavi et al., 1 Sep 2025)
Federated learning	K-means over client gradients; trust-based elimination; or reference-guided DBSCAN in low-dimensional gradient space	(Yadav et al., 2021, Zhang et al., 21 May 2026)
Data poisoning and backdoor defense	Distance clustering near class means, incompatibility clustering, DBSCAN latent segregation, centroid analysis	(Gulciftci et al., 2 Aug 2025, Jin et al., 2021, Shi et al., 23 Apr 2026, Guo et al., 2023)
Clustered network defense architectures	Cluster-head election, evidence aggregation, cooperative detection, mobile agents	(Sen, 2010, Kumarasamy et al., 2013)
Dynamic cyber-physical monitoring	Operating-point-dependent clustering of measurements via transfer-function similarity	(Jevtić et al., 2020)
Fairness robustness	Consensus clustering plus fair graph partitioning under adversarial protected-label manipulation	(Chhabra et al., 2022)

In intrusion detection, CBD is explicitly framed as a mechanism for discovering novel or unlabeled attacks in traffic. The model clusters network flows, counts the number of attack modes present, and assigns labels based on characteristic features such as protocol or port distributions, packet rate, and flags (Abd et al., 2024). In federated learning, the same term denotes server-side clustering of client gradients so that malicious updates can be downweighted or eliminated without client-side overhead (Yadav et al., 2021). EnCAgg extends this logic to dynamic poisoning by using reference-guided density clustering and pseudo-gradient bridging in the two most divergent PCA dimensions (Zhang et al., 21 May 2026).

In backdoor and poisoning defense, CBD is strongly geometry-driven. The Beta Poisoning defense clusters the one-dimensional distances of non-target samples to the target-class mean and flags the minimum-distance cluster (Gulciftci et al., 2 Aug 2025). Incompatibility clustering defines clusters through training-time cross-generalization rather than static embeddings; poisoned and clean samples are separated because they generalize only to themselves under the training objective (Jin et al., 2021). CSC and CCA-UD instead exploit early latent segregation and density structure in feature space (Shi et al., 23 Apr 2026, Guo et al., 2023).

Older network-security work uses clustering in a different sense. In clustered wireless ad hoc networks and MANET IDS designs, nodes are organized into clusters, leaders or cluster-heads are elected, and intrusion information is aggregated upward for cooperative analysis and response (Sen, 2010, Kumarasamy et al., 2013). These systems show that CBD can refer to a defense topology as much as to a machine-learning primitive.

4. Operationalization and empirical performance

A defining property of CBD is that clustering is rarely the endpoint. It is usually followed by a second-stage action. In intrusion detection, clusters are mapped to attack labels or normal traffic and can also seed a supervised classifier. The custom Kali Linux dataset contained 19,677 flows and 78 features after cleaning; clustering reportedly recovered seven clusters matching seven performed attacks, and the post-clustering Optimized XGBoost Classifier reached Cohen’s Kappa $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$0, Precision $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$1, Recall $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$2, Specificity $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$3, and Micro-average AUC $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$4 (Abd et al., 2024).

In Adaptive Tamaraw, the downstream action is per-cluster padding selection rather than attack labeling. The defense starts with global fixed-rate padding, then switches at a fixed safe time $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$5 to anonymity-set-specific parameters. The reported trade-off is explicit: in high-privacy mode, the attacker’s accuracy bound is pushed below $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$6, while in efficiency-centered settings the system cuts total overhead by $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$7 compared with classic Tamaraw (Khajavi et al., 1 Sep 2025).

In federated learning, cluster-conditioned action typically means filtering or weighted aggregation. The K-means-based method on NSL-KDD uses per-round honest-versus-malicious cluster assignment, trust scores updated by $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$8 or $$\min_{\{\mu_i\}_{i=1}^k,\{S_i\}_{i=1}^k} \sum_{i=1}^k \sum_{\mathbf{x} \in S_i} \lVert \mathbf{x} - \mu_i \rVert_2^2,$$9, and permanent elimination below the threshold $\epsilon = 0.8$0; with $\epsilon = 0.8$1 adversaries, accuracy reportedly recovers toward $\epsilon = 0.8$2 after elimination (Yadav et al., 2021). EnCAgg reports strong robustness even under dynamic poisoning: on MNIST and CIFAR-10 it maintains about $\epsilon = 0.8$3 and $\epsilon = 0.8$4–$\epsilon = 0.8$5 accuracy, respectively, even at $\epsilon = 0.8$6 malicious participation, and on an AGR-tailored adaptive attack it achieves $\epsilon = 0.8$7 and $\epsilon = 0.8$8 accuracy at $\epsilon = 0.8$9 and $\text{minPts} = 20$0 malicious ratios (Zhang et al., 21 May 2026).

In poisoning and backdoor defense, CBD often ends with removal, relabeling, or retraining. The Beta Poisoning CBD attains MNIST Accuracy, Precision, Recall, and F1 of $\text{minPts} = 20$1, and CIFAR-10 Accuracy $\text{minPts} = 20$2, Precision $\text{minPts} = 20$3, Recall $\text{minPts} = 20$4, and F1 $\text{minPts} = 20$5 (Gulciftci et al., 2 Aug 2025). Incompatibility clustering reduces backdoor attack success rate to below $\text{minPts} = 20$6 on 134 of 165 scenarios, with only a $\text{minPts} = 20$7 drop in clean accuracy on CIFAR-10 and a negligible drop on GTSRB (Jin et al., 2021). CSC reports average ASR $\text{minPts} = 20$8 on CIFAR-10, $\text{minPts} = 20$9 on CIFAR-100, $\text{eps} = 3$0 on GTSRB, and $\text{eps} = 3$1 on Tiny-ImageNet while preserving strong clean accuracy, and CCA-UD reports consistently high AUC across corrupted-label, clean-label, global, local, source-specific, and sample-specific backdoor settings (Shi et al., 23 Apr 2026, Guo et al., 2023).

In cyber-physical monitoring and clustered network architectures, the action is alarming, isolation, or coordinated response rather than dataset sanitization. The dynamic clustering strategy for the IEEE 24-bus power system re-clusters measurements as the operating point changes, then raises alarms through intra-cluster residuals $\text{eps} = 3$2 (Jevtić et al., 2020). The wireless ad hoc architecture uses cluster-heads, mobile agents, and trust-weighted or majority fusion to support cluster-wide and network-wide response, with reported detection rates of $\text{eps} = 3$3 for flooding, $\text{eps} = 3$4 for blackhole, $\text{eps} = 3$5 for sleep deprivation, and $\text{eps} = 3$6 for packet dropping, with low false alarm rates (Sen, 2010).

5. Limitations, attack surface, and common misconceptions

A recurrent misconception is that clustering automatically yields robustness. Two adversarial clustering studies directly reject that premise. “Practical Attacks Against Graph-based Clustering” shows that targeted noise injection and small-community attacks can cause graph-clustering-based DGA detection to fail even for less informed attackers, although practical defenses such as retraining and hyperparameter hardening can raise attacker cost (Chen et al., 2017). “Is Data Clustering in Adversarial Settings Secure?” formalizes poisoning and obfuscation attacks against clustering and shows that single-linkage hierarchical clustering can be significantly subverted by a relatively small percentage of attack samples, including by bridge attacks that induce mergers or fragmentation (Biggio et al., 2018).

Several domain-specific weaknesses recur. K-means-based CBDs assume roughly spherical clusters under Euclidean distance and are sensitive to feature scaling and the choice of $\text{eps} = 3$7; the intrusion-detection study explicitly notes sensitivity to initialization, feature scaling, concept drift, and potential instability in noisy or highly imbalanced data (Abd et al., 2024). In website fingerprinting, a wrong anonymity-set assignment does not void the underlying fixed-rate, fixed-$\text{eps} = 3$8 guarantee, but the early classifier still misidentifies the correct set in a nontrivial fraction of traces, with approximately $\text{eps} = 3$9 switching to an incorrect set and $(k,l)$0 not switching at all (Khajavi et al., 1 Sep 2025). In reference-guided federated clustering, benign-cluster identification can degrade if references are scarce or compromised, and projection to two PCA dimensions can discard discriminative structure (Zhang et al., 21 May 2026).

Hierarchy-based CBDs introduce a different attack surface. In vehicular HFL, false positives can arise from extreme non-IID behavior, sparse participation, or mobility-induced cluster instability, while CH compromise remains a concern even with EPC-level checks and cross-cluster consistency (HaghighiFard et al., 2 May 2025). In mobile ad hoc intrusion architectures, mobile-agent security and the trustworthiness of cluster-heads remain explicit concerns (Sen, 2010). These cases show that CBD can shift the locus of vulnerability from point-level similarity to role assignment, aggregation, and coordination.

6. Design directions and research trajectory

The trajectory of the literature runs from early clustered intrusion architectures in wireless and mobile ad hoc networks, through dynamic clustering in cyber-physical systems and K-means-based network traffic analysis, to recent density-based, consensus-based, and provably bounded formulations in deep learning and privacy defense (Sen, 2010, Kumarasamy et al., 2013, Jevtić et al., 2020, Abd et al., 2024, Khajavi et al., 1 Sep 2025). This progression suggests increasing emphasis on three properties: stronger representation learning, explicit robustness to heterogeneity or drift, and tighter formal control over what cluster membership implies for security.

Several directions recur across papers. One is replacing simple partitioning with richer clustering models: DBSCAN or HDBSCAN for density structure, spectral clustering for non-convex geometry, GMMs for ellipsoidal structure, and consensus or ensemble methods for robustness (Abd et al., 2024, Zhang et al., 21 May 2026, Chhabra et al., 2022). Another is improving the representation before clustering. The intrusion-detection work recommends flow-level attributes and normalization; EnCAgg uses PCA projections guided by benign references; CCA-UD and CSC use penultimate-layer features; incompatibility clustering goes further by defining clusters through training-time self-expansion and cross-generalization rather than fixed embeddings (Guo et al., 2023, Shi et al., 23 Apr 2026, Jin et al., 2021).

A third direction is operational adaptivity. Adaptive Tamaraw uses safe-time switching and per-set parameter assignment; vehicular HFL adds adaptive cosine thresholds, reliability-weighted aggregation, and cross-cluster consistency; intrusion-detection CBDs recommend periodic re-clustering, centroid-drift tracking, and human-in-the-loop validation (Khajavi et al., 1 Sep 2025, HaghighiFard et al., 2 May 2025, Abd et al., 2024). In production settings, this implies that CBD is rarely static: cluster definitions, validity checks, and downstream policies must evolve with concept drift, site redesigns, topology changes, or changes in attacker behavior.

A final direction is formalization. Weighted $(k,l)$1-non-injectivity in website fingerprinting, consensus-based fairness objectives, and attack-optimization frameworks for adversarial clustering all indicate that CBD is moving from heuristic grouping toward explicit threat-model-aware design (Khajavi et al., 1 Sep 2025, Chhabra et al., 2022, Biggio et al., 2018). The literature therefore points toward a mature view of CBD: not merely clustering for its own sake, but clustering embedded inside a defensible pipeline in which representation choice, cluster semantics, downstream action, and adversarial evaluation are all first-class design variables.