Final-year CSE project

An Efficient Hybrid K-Means and Decision Approach for Cloud Malware Detection and Privacy Protection

A working machine-learning demonstration that runs entirely in your browser. Every number shown is computed from the data you load — nothing is hardcoded.

Start with a dataset View dashboard

Pipeline

01
Upload
CSV of cloud traffic / host telemetry with numeric features and an optional malware label.
02
Privacy preprocessing
Identifier columns (IPs, emails, IDs) are dropped; records get pseudonymous references; missing values imputed; features normalized.
03
K-Means screening
Unsupervised clustering (k-means++, Euclidean). Clusters dominated by malicious training records, or points far from their centroid, are flagged suspicious.
04
Decision Tree
A CART classifier trained on labelled training rows assigns suspicious records to a malware family.
05
Evaluation
Accuracy, precision, recall, F1, FPR and confusion matrix on a held-out test split.

Cloud malware detection

Cloud workloads produce large volumes of network and host telemetry. Malware such as ransomware, trojans, cryptominers and botnets leave statistical traces — unusual CPU use, high payload entropy, connection bursts, failed logins. ML models learn these patterns from labelled examples.

Why hybrid?

K-Means is cheap and unsupervised: it groups similar behaviour and screens out records sitting in clearly benign clusters. Only suspicious records are passed to the Decision Tree, which provides an interpretable family-level classification. Whether this improves on a tree alone is measured — not assumed — on the Evaluation page.

K-Means

Initialises k centroids with k-means++, then alternates assigning each record to its nearest centroid (Euclidean distance) and recomputing centroids as means, until convergence. Distance to centroid is reported as an anomaly score.

Privacy protection

Direct identifiers are removed before modelling and records receive salted hash references. This reduces exposure but is not a formal anonymisation guarantee — quasi-identifiers in features may still allow re-identification.