New exact concise representation of rare correlated patterns: application to intrusion detection

  • Authors:
  • Souad Bouasker;Tarek Hamrouni;Sadok Ben Yahia

  • Affiliations:
  • LIPAH, Computer Science Department, Faculty of Sciences of Tunis, Tunis, Tunisia;LIPAH, Computer Science Department, Faculty of Sciences of Tunis, Tunis, Tunisia;LIPAH, Computer Science Department, Faculty of Sciences of Tunis, Tunis, Tunisia,Institut TELECOM, TELECOM SudParis, UMR 5157 CNRS SAMOVAR, France

  • Venue:
  • PAKDD'12 Proceedings of the 16th Pacific-Asia conference on Advances in Knowledge Discovery and Data Mining - Volume Part II
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

During the last years, many works focused on the exploitation of rare patterns. In fact, these patterns allow conveying knowledge on unexpected events. Nevertheless, a main problem is related to their very high number and to the low quality of several mined rare patterns. In order to overcome these limits, we propose to integrate the correlation measure bond aiming at only mining the set of rare correlated patterns. A characterization of the resulting set is then detailed, based on the study of constraints of different natures induced by the rarity and the correlation. In addition, based on the equivalence classes associated to a closure operator dedicated to the bond measure, we propose a new exact concise representation of rare correlated patterns. We then design the new RcprMiner algorithm allowing an efficient extraction of the proposed representation. The carried out experimental studies prove the compactness rate offered by our approach. We also design an association rules based classifier and we prove its effectiveness in the context of intrusion detection.