Incremental mining of closed inter-transaction itemsets over data stream sliding windows

Abstract

Mining inter-transaction association rules is one of the most interesting issues in data mining research. However, in a data stream environment the previous approaches are unable to find the result of the new-incoming data and the original database without recomputing the whole database. In this paper, we propose an incremental mining algorithm, called DSM-CITI (Data Stream Mining for Closed Inter-Transaction Itemsets), for discovering the set of all frequent inter-transaction itemsets from data streams. In the framework of DSM-CITI, a new in-memory summary data structure, ITP-tree, is developed to maintain frequent inter-transaction itemsets. Moreover, algorithm DSM-CITI is able to construct ITP-tree incrementally and uses the property to avoid unnecessary updates. Experimental studies show that the proposed algorithm is efficient and scalable for mining frequent inter-transaction itemsets over stream sliding windows.

Extracting fuzzy attack patterns using an online fuzzy adaptive alert correlation framework

“…Our contributions are: A new fuzzy online clustering method is proposed to generate fuzzy attack scenarios based on similarity between alerts. Like other similarity based approaches this module is too fast and can process alert streams online. We extended an inter transaction frequent item set mining approach to support fuzzy item sets for frequent fuzzy pattern mining module. This module is responsible to detect the alerts which are irrelevant based on their features like IP addresses, but have statistical relationships (like Stream‐DOS alert in DDOS that attacker spoofed IP addresses in order to hide attack sources). Adaptive nature of our framework, make it independent of any expert knowledge.…”

Selecting Actionable Patterns from Positive and Negative Sequential Patterns

“…Some other methods discuss interesting rules [15][16][17][18][25][26][27][28][29][30][31][32][33]. Correlation coefficient was used to mine positive and negative association rules [26,27].…”

“…then it is known as non-random sequential pattern, (7) else (8) remove P; (9) If(BDW≥1) (10) the sequence signs for strong rule, save it in set {PNSP}; (11) } (12) } (13)For each PSP or nSP P in {SPnSP} do { (14) Test P by IS; (15) If(P satisfy iS) (16) aSP = aSP∪{P}; (17) else (18) remove P; (19) } (20)return ASP; Line (1) initializes aSP set. Line (2) mines all PSP and nSP.…”

“…N the literature lots of efforts have been made to discover actionable knowledge [1][2][3][4][5][6][7][8][9][10][11][12][13][14], to measure the interestingness in association rule mining [15][16][17][18] and to mine Positive Sequential Patterns (PSP) [19,20]. PSP are frequent subsequences which are uncovered from sequence database.…”

Mining frequent patterns in a varying-size sliding window of online transactional data streams

“…In most of these applications, recent transactions convey more up-to-date information, and hence should carry more weight than older ones. In order to differentiate frequent patterns in recent data from those in historical transactions, researchers have proposed the sliding window model [5][6][7][8][9]. When mining the frequent patterns of an online data stream with the sliding window model, the focus is on a fixed number of recently generated data in the mining operations [10].…”