GrammarViz 2.0: A Tool for Grammar-Based Pattern Discovery in Time Series

Senin, Pavel; Lin, Jessica; Wang, Xing; Oates, Tim; Gandhi, Sunil; Boedihardjo, Arnold P.; Chen, Crystal; Frankenstein, Susan; Lerner, Manfred

doi:10.1007/978-3-662-44845-8_37

Cited by 76 publications

(40 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…With GrammarViz, Senin et al [45] introduce a grammar mining and visualization tool based on CFG induction. While GrammarViz does not specifically consider attributes or malicious software scenarios in general, it describes a practical approach to manually analyzing time series data.…”

Section: Related Workmentioning

confidence: 99%

“…Overgeneralization occurs when the inference process produces a grammar whose language is larger than the unknown language. The use of negligible items results in an unnecessarily evolutionary GA-based [42] L A g t s [ 8] heuristic ALLiS [13] Inductive CYK [36] ABL [54] MDL e-GRIDS [38] CDC [10] VEGGIE [4,5] Eiland et al [17] greedy search ADIOS CDC Incremental parsing [3,44] Sequitur [37] GraphViz [45,46] clustering EMILE [1] C D C large grammar. To limit the impact of over-generalization, it is recommended to also use a set of negative examples.…”

Section: Grammar Inferencementioning

confidence: 99%

“…Rule density (see 4.3) is also important in scenarios where stable behavior is expected: the higher the share of terminals, the higher the overall entropy, and, by extension, the likelihood of anomalous behavior. All anomaly detection efforts can be aided by visualization tools such as GrammarViz [45] as well as our own VA research introduced in Section 7 below.…”

Section: Conceptmentioning

confidence: 99%

See 2 more Smart Citations

SEQUIN: a grammar inference framework for analyzing malicious system behavior

Luh

Schramm

Wagner

et al. 2018

J Comput Virol Hack Tech

View full text Add to dashboard Cite

Targeted attacks on IT systems are a rising threat to the confidentiality of sensitive data and the availability of critical systems. The emergence of Advanced Persistent Threats (APTs) made it paramount to fully understand the particulars of such attacks in order to improve or devise effective defense mechanisms. Grammar inference paired with visual analytics (VA) techniques offers a powerful foundation for the automated extraction of behavioral patterns from sequential event traces. To facilitate the interpretation and analysis of APTs, we present SEQUIN, a grammar inference system based on the Sequitur compression algorithm that constructs a context-free grammar (CFG) from string-based input data. In addition to recursive rule extraction, we expanded the procedure through automated assessment routines capable of dealing with multiple input sources and types. This automated assessment enables the accurate identification of interesting frequent or anomalous patterns in sequential corpora of arbitrary quantity and origin. On the formal side, we extended the CFG with attributes that help describe the extracted (malicious) actions. Discovery-focused pattern visualization of the output is provided by our dedicated KAMAS VA prototype.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Grammar Inferencementioning

confidence: 99%

Section: Conceptmentioning

confidence: 99%

See 1 more Smart Citation

SEQUIN: a grammar inference framework for analyzing malicious system behavior

Luh

Schramm

Wagner

et al. 2018

J Comput Virol Hack Tech

View full text Add to dashboard Cite

show abstract

“…Taking the example above, for 1 , the most repeated sequence is which appears 3 times. Finding the most repeated patterns or sequence is known as Motif Discovery [22]. Therefore, we can characterize each driver with the top most repeated patterns.…”

Section: Finding the Norm Using Motif Discoverymentioning

confidence: 99%

“…Therefore, we can characterize each driver with the top most repeated patterns. A tool proposed in [22] was adopted to find the most repeated sequence in a sample dataset with driving signals. Raw driving signals which produce discretized sequences that deviate from the most repeated patterns of a designated driver will be classified as an anomaly.…”

Section: Finding the Norm Using Motif Discoverymentioning

confidence: 99%

Combining Unsupervised Anomaly Detection and Neural Networks for Driver Identification

Tanprasert

Saiprasert

Thajchayapong

2017

Journal of Advanced Transportation

View full text Add to dashboard Cite

This paper proposes an algorithm for real-time driver identification using the combination of unsupervised anomaly detection and neural networks. The proposed algorithm uses nonphysiological signals as input, namely, driving behavior signals from inertial sensors (e.g., accelerometers) and geolocation signals from GPS sensors. First anomaly detection is performed to assess if the current driver is whom he/she claims to be. If an anomaly is detected, the algorithm proceeds to find relevant features in the input signals and use neural networks to identify drivers. To assess the proposed algorithm, real-world data are collected from ten drivers who drive different vehicles on several routes in real-world traffic conditions. Driver identification is performed on each of the sevensecond-long driving behavior signals and geolocation signals in a streaming manner. It is shown that the proposed algorithm can achieve relatively high accuracy and identify drivers within 13 seconds. The proposed algorithm also outperforms the previously proposed driver identification algorithms. Furthermore, to demonstrate how the proposed algorithm can be deployed in real-world applications, results from real-world data associated with each operation of the proposed algorithm are shown step-by-step.

show abstract

Anomaly Detection in Sequential Data: Principles and Case Studies

Andrade

Gama

Ribeiro

et al. 2019

Wiley Encyclopedia of Electrical and Electronics Engineering

View full text Add to dashboard Cite

Humans are frequently looking for patterns and uniformity to support their choices and decisions. Whatever falls outside the expected can be said to be an anomaly. However, in many practical situations, the presence of anomalies can provide valuable insights, which can point out useful novelties. Thus, in predictive maintenance, for example, anomaly detection is useful to predict equipment failures and prevent losses at technical and financial levels. Most modern equipment has logging systems that allow to collect a high diversity of data regarding the equipment operation and working conditions. One such case is about several human activities. In both applications, looking for anomalies is a relevant task. The large amount of data, collected during a long period of time, makes the analysis by humans unfeasible. Data mining techniques can automatically extract models for anomaly and novelty detection from these data. These techniques, when used in predictive systems, are able to detect anomalies and issue an alert before they start, avoiding interruptions and breakdowns. After briefly describing the main aspects of anomaly detection and the most popular approaches and techniques, this article presents an overview of the main anomaly detection techniques used for predictive maintenance.

show abstract

GrammarViz 2.0: A Tool for Grammar-Based Pattern Discovery in Time Series

Cited by 76 publications

References 7 publications

SEQUIN: a grammar inference framework for analyzing malicious system behavior

SEQUIN: a grammar inference framework for analyzing malicious system behavior

Combining Unsupervised Anomaly Detection and Neural Networks for Driver Identification

Anomaly Detection in Sequential Data: Principles and Case Studies

Contact Info

Product

Resources

About