Nouvelle repr\'esentation concise exacte des motifs corr\'el\'es rares : Application \`a la d\'etection d'intrusions

TL;DR

This paper introduces new algorithms for mining and querying a concise representation of rare correlated patterns, demonstrating their efficiency and application in intrusion detection.

Contribution

It proposes the RCPR mining, querying, and regeneration algorithms, filling a gap in efficient extraction and use of rare correlated pattern representations.

Findings

RCPR offers high compactness in pattern representation

The proposed classification method improves intrusion detection accuracy

Algorithms are efficient and scalable for large datasets

Abstract

Correlated rare pattern mining is an interesting issue in Data mining. In this respect, the set of correlated rare patterns w.r.t. to the bond correlation measure was studied in a recent work, in which the RCPR concise exact representation of the set of correlated rare patterns was proposed. However, none algorithm was proposed in order to mine this representation and none experiment was carried out to evaluate it. In this paper, we introduce the new RcprMiner algorithm allowing an efficient extraction of RCPR. We also present the IsRCP algorithm allowing the query of the RCPR representation in addition to the RCPRegeneration algorithm allowing the regeneration of the whole set RCP of rare correlated patterns starting from this representation. The carried out experiments highlight interesting compactness rates offered by RCPR. The effectiveness of the proposed classification method, based on generic rare correlated association rules derived from RCPR, has also been proved in the context of intrusion detection.