Practical IP-Level Unsupervised Classification Using HDBSCAN and K-Means

Last Updated on August 24, 2026 by Editorial Team Author(s): Bassem Essameldin Omar Originally published on Towards AI. Practical IP-Level Unsupervised Classification Using HDBSCAN and K-Means A recurring challenge in network analytics arises when two distinct consumer brands are operated by the same legal entity and share a single Autonomous System Number (ASN). Standard IP-to-ISP databases resolve every IP in that ASN to one company name, making it impossible to distinguish which brand a given measurement session belongs to. No labelled training set exists. The input is two datasets (IPv4 and IPv6) where each row represents aggregated sessions sharing the same DNS resolver IP, with accompanying fields: IP range bounds, ASN organisation string, geographic region, connection public IP, and a session count. The objective is to assign each row a brand label using only these network-layer signals. Photo by BoliviaInteligente on Unsplash 1. Data Structure and Signal Sources Each row represents one or more device sessions grouped by their configured DNS resolver address. The key fields are: ip_lower_str / ip_upper_str — lower and upper bounds of the IP range; block rows contain wildcar…