Improved density peak clustering with a flexible manifold distance and natural nearest neighbors for network intrusion detection

Recently, density peak clustering (DPC) has gained attention for its ability to intuitively determine the number of classes, identify arbitrarily shaped clusters, and automatically detect and exclude anomalies. However, DPC faces challenges as it considers only the global distribution, resulting in difficulties with group density, and its point allocation strategy may lead to a domino effect. To expand the scope of DPC, this paper introduces a density peak clustering algorithm based on the manifold distance and natural nearest neighbors (DPC-MDNN). This approach establishes nearest neighbor relationships based on the manifold distance and introduces representative points using local density for distribution segmentation. In addition, an assignment strategy based on representatives and candidates is adopted, reducing the domino effect through microcluster merging. Extensive comparisons with five competing methods across artificial and real datasets demonstrate that DPC-MDNN can more accurately identify clustering centers and achieve better clustering results. Furthermore, application experiments using three subdatasets confirm that DPC-MDNN enhances the accuracy of network intrusion detection and has high practicality.