New exact concise representation of rare correlated patterns : application to intrusion detection
Résumé
During the last years, many works focused on the exploitation of rare patterns. In fact, these patterns allow conveying knowledge on unexpected events. Nevertheless, a main problem is related to their very high number and to the low quality of several mined rare patterns. In order to overcome these limits, we propose to integrate the correlation measure bond aiming at only mining the set of rare correlated patterns. A characterization of the resulting set is then detailed, based on the study of constraints of different natures induced by the rarity and the correlation. In addition, based on the equivalence classes associated to a closure operator dedicated to the bond measure, we propose a new exact concise representation of rare correlated patterns. We then design the new RcprMiner algorithm allowing an efficient extraction of the proposed representation. The carried out experimental studies prove the compactness rate offered by our approach. We also design an association rules based classifier and we prove its effectiveness in the context of intrusion detection.