TKS: Efficient Mining of Top-K Sequential Patterns

Fournier-Viger, Philippe; Gomariz, Antonio; Gueniche, Ted; Mwamikazi, Espérance; Thomas, Rincy

doi:10.1007/978-3-642-53914-5_10

Cited by 61 publications

(34 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In the top-K algorithms, there is no need to define minimum support value. Top-K algorithms discover k most frequent patterns for a user defined k [8].…”

Section: Methods In Detailsmentioning

confidence: 99%

On the Sequential Pattern and Rule Mining in the Analysis of Cyber Security Alerts

Husák

Kašpar

Bou‐Harb

et al. 2017

Proceedings of the 12th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Data mining is well-known for its ability to extract concealed and indistinct patterns in the data, which is a common task in the field of cyber security. However, data mining is not always used to its full potential among cyber security community. In this paper, we discuss usability of sequential pattern and rule mining, a subset of data mining methods, in an analysis of cyber security alerts. First, we survey the use case of data mining, namely alert correlation and attack prediction. Subsequently, we evaluate sequential pattern and rule mining methods to find the one that is both fast and provides valuable results while dealing with the peculiarities of security alerts. An experiment was performed using the dataset of real alerts from an alert sharing platform. Finally, we present lessons learned from the experiment and a comparison of the selected methods based on their performance and soundness of the results.

show abstract

“…In the top-K algorithms, there is no need to define minimum support value. Top-K algorithms discover k most frequent patterns for a user defined k [8].…”

Section: Methods In Detailsmentioning

confidence: 99%

On the Sequential Pattern and Rule Mining in the Analysis of Cyber Security Alerts

Husák

Kašpar

Bou‐Harb

et al. 2017

Proceedings of the 12th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

show abstract

“…We start with the maximal value (1.0) for minimum support and iteratively decrease it with a 0.1 step, until completion. Second, we take advantage of the TKS algorithm (Fournier-Viger et al 2013), in which the notion of FS is expressed in terms of k most supported patterns. This algorithm allows putting constraints on the minimal/maximal length of the detected sequences.…”

Section: Sequential Pattern Miningmentioning

confidence: 99%

Exploring the evolution of node neighborhoods in Dynamic Networks

Orman

Labatut

Naskalı

2017

Physica A: Statistical Mechanics and its Applications

View full text Add to dashboard Cite

Dynamic Networks are a popular way of modeling and studying the behavior of evolving systems. However, their analysis constitutes a relatively recent subfield of Network Science, and the number of available tools is consequently much smaller than for static networks. In this work, we propose a method specifically designed to take advantage of the longitudinal nature of dynamic networks. It characterizes each individual node by studying the evolution of its direct neighborhood, based on the assumption that the way this neighborhood changes reflects the role and position of the node in the whole network. For this purpose, we define the concept of neighborhood event, which corresponds to the various transformations such groups of nodes can undergo, and describe an algorithm for detecting such events. We demonstrate the interest of our method on three real-world networks: DBLP, LastFM and Enron. We apply frequent pattern mining to extract meaningful information from temporal sequences of neighborhood events. This results in the identification of behavioral trends emerging in the whole network, as well as the individual characterization of specific nodes. We also perform a cluster analysis, which reveals that, in all three networks, one can distinguish two types of nodes exhibiting different behaviors: a very small group of active nodes, whose neighborhood undergo diverse and frequent events, and a very large group of stable nodes. density, network diameter (Leskovec et al. 2005a). Second, mesoscopic methods consider the network at an intermediary level, generally that of the community structure, e.g. modularity measure (Kashtan and Alon 2005), size of the communities (Backstrom et al. 2006). Finally, microscopic methods focus on individual nodes and possibly their direct neighborhood, e.g. clustering coefficient (Clauset and Eagle 2007).By definition, methods specifically designed to handle a dynamic network are more likely to take advantage of the specificity of such data. Regarding the granularity, if macroscopic and mesoscopic methods are widespread in the literature, it is not the case for microscopic methods. Yet, the benefits of such approaches are numerous: by allowing the tracking of finer evolution processes, they complement macroscopic and/or mesoscopic results. They help identifying behavioral trends among the network nodes, and consequently outliers. These results can facilitate the description and understanding of processes observed at a higher level, and can be useful to define models of the studied system, especially agent-based ones.In this work, we propose a method specifically designed to study dynamic slowly evolving networks, at the microscopic level. We characterize a node by the evolution of its neighborhood. More precisely, we detect specific events occurring among the groups of nodes constituting this neighborhood, between each pair of consecutive time slices, which we call neighborhood evolution events. This method constitutes our main contribution. To the best of our knowledge, it is the fir...

show abstract

“…These are trends, similar sequences, sequential patterns, and periodic patterns. This work chose to mine sequential patterns (Agrawal and Srikant, 1995;Fournier-Viger et al, 2013), as the main interest is finding subsequences of POS tags appearing frequently in multiple sentences of a text. Recently, Mwamikazi et al used a similar approach for mining patterns of answers in adaptive questionnaires (Mwamikazi et al, 2014).…”

Section: The Signature Extraction Modulementioning

confidence: 99%