Skip to main content

Grouping using correlation

Groups of nodes are formed by using correlation as a measure. This is used to group anoamlies into alerts. The correlation is used to define a measure of distance, which is later used for an hierarchical clustering. This assigns each node to only one group. Each group contain intercorrelated nodes that have a correlation of at least 0.5. Since we are using an hierarchical clustering, nodes that have a correlation above 0.5 might not end up in the same group. For example if node A and B are correlated, but node A has a stronger correlation with node C, and B and C are not correlated, then A will be in the same correlation group of C, but B will not be included in this group.