K-Modes Cluster Analysis Using SAS -- 2

I am doing research on cyber security for my company in order to demonstrate the need for additional cyber security software. Specifically, I need to demonstrate the basics of how companies can make use of data analysis tools to review their cyber security posture with the end goal being the justification of purchasing proprietary software for additional cyber security benefits. As part of this project, I will need K-Modes cluster analysis done on a company data set in order to look for anomalous login behavior that would be indicative of a potential cyber security incident such as a data breach. Given the categorical nature of the data set, only K-Modes cluster analysis can be used. The data set is extracted from a company's directory management logs and contains all of the information pertaining to user authentication to company resources. See attached screenshot for variable names and types. Due to the fact that failed login attempts are one of the most obvious signs that an attacker is attempting to gain unauthorized access to a system, the “success” variable, which only has “TRUE” or “FALSE” as possible values, will be one of the primary sources of identifying any potential breaches during the data analysis process. Additionally, because the company’s IP addresses are statically assigned and therefore will never change, the “geoip” and “client_ip” variables will also be key indicators of a potential malicious event due to the fact that an outside attacker will not have the same IP information as a company managed assets would have because they would be on a different network. Lastly, given that the “username” variable is unique to each individual user in the company and only authenticated users can access company resources, any unknown or unassigned usernames being used in any attempts at access will result in an automatic failed login attempt being written to the log’s “success” variable as a “FALSE” value. Given the importance of the aforementioned variables, it would be pragmatic for any clusters to be centered around said variables so that any outliers would be more easily identifiable from the more common data points in the set. This study must be focused on the following hypothesis: • ?0 The dataset does not have an interesting clustering indicating a potential attack • ?1 The dataset contains an interesting clustering indicating a potential attack. Additionally, a detailed and thorough report will be needed outlining the results and clearly explaining what the results indicate. I cannot emphasize enough how import it is that every results be very well explained and justified. The findings of this data analysis project will be used to convince an executive leadership team to expend additional capital on further enhancing the company's cybersecurity defenses. A non-disclosure agreement will be required in order to work on this project.