Search

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2008.12.011 Byline: Daniele Apiletti, Elena Baralis, Tania Cerquitelli, Vincenzo D'Elia Keywords: Network traffic characterization; Network data analysis; Generalized association rules Abstract: The NetMine framework allows the characterization of traffic data by means of data mining techniques. NetMine performs generalized association rule extraction to profile communications, detect anomalies, and identify recurrent patterns. Association rule extraction is a widely used exploratory technique to discover hidden correlations among data. However, it is usually driven by frequency constraints on the extracted correlations. Hence, it entails (i) generating a huge number of rules which are difficult to analyze, or (ii) pruning rare itemsets even if their hidden knowledge might be relevant. To overcome these issues NetMine exploits a novel algorithm to efficiently extract generalized association rules, which provide a high level abstraction of the network traffic and allows the discovery of unexpected and more interesting traffic rules. The proposed technique exploits (user provided) taxonomies to drive the pruning phase of the extraction process. Extracted correlations are automatically aggregated in more general association rules according to a frequency threshold. Eventually, extracted rules are classified into groups according to their semantic meaning, thus allowing a domain expert to focus on the most relevant patterns. Experiments performed on different network dumps showed the efficiency and effectiveness of the NetMine framework to characterize traffic data. Author Affiliation: Politecnico di Torino, Dipartimento di Authomatica Informatica, Corso Duca degli Abruzzi, 24, 10129 Torino, Italy

This paper presents the IMine index, a general and compact structure which provides tight integration of item set extraction in a relational DBMS. Since no constraint is enforced during the index creation phase, IMine provides a complete representation of the original database. To reduce the I/O cost, data accessed together during the same extraction phase are clustered on the same disk block. The IMine index structure can be efficiently exploited by different item set extraction algorithms. In particular, IMine data access methods currently support the FP-growth and LCM v.2 algorithms, but they can straightforwardly support the enforcement of various constraint categories. The IMine index has been integrated into the PostgreSQL DBMS and exploits its physical level access methods. Experiments, run for both sparse and dense data distributions, show the efficiency of the proposed index and its linear scalability also for large data sets. Item set mining supported by the IMine index shows performance always comparable with, and often (especially for low supports) better than, state-of-the-art algorithms accessing data on flat file. Index Terms--Data mining, item set extraction, indexing.

Associative classification is a promising technique to build accurate classifiers. However, in large or correlated data sets, association rule mining may yield huge rule sets. Hence, several pruning techniques have been proposed to select a small subset of high-quality rules. Since the availability of a 'rich' rule set may improve the accuracy of the classifier, we argue that rule pruning should be reduced to a minimum. The [L.sup.3] associative classifier is built by means of a lazy pruning technique that discards exclusively rules that only misclassify training data. The classification of unlabeled data is performed in two steps. A small subset of high-quality rules is first considered. When this set is not able to classify the data, a larger rule set is exploited. This second set includes rules usually discarded by previous approaches. To cope with the need of mining large rule sets and to efficiently use them for classification, a compact form is proposed to represent a complete rule set in a space-efficient way and without information loss. An extensive experimental evaluation on real and synthetic data sets shows that [L.sup.3] improves the classification accuracy with respect to previous approaches. Index Terms--Data mining, associative classification, association rules, condensed representations.

XML is a rather verbose representation of semistructured data, which may require huge amounts of storage space. We propose a summarized representation of XML data, based on the concept of instance pattern, which can both provide succinct information and be directly queried. The physical representation of instance patterns exploits itemsets or association rules to summarize the content of XML datasets. Instance patterns may be used for (possibly partially) answering queries, either when fast and approximate answers are required, or when the actual dataset is not available, for example, it is currently unreachable. Experiments on large XML documents show that instance patterns allow a significant reduction in storage space, while preserving almost entirely the completeness of the query result. Furthermore, they provide fast query answers and show good scalability on the size of the dataset, thus overcoming the document size limitation of most current XQuery engines. Categories and Subject Descriptors: H.2.3 [Database Management]: Languages--Query languages; H.3.3 [Information Storage and Retrieval]: Information Search and Retrieval--Retrieval models General Terms: Theory, Languages Additional Key Words and Phrases: Association rules, data mining, data summarization, intensional answers, itemsets, semistructured data

Given a class model built from a dataset including labeled data, classification assigns a new data object to the appropriate class. In associative classification the class model (i.e., the classifier) is a set of association rules. Associative classification is a promising technique for the generation of highly accurate classifiers. In this article, we present a compact form which encodes without information loss the classification knowledge available in a classification rule set. This form includes the rules that are essential for classification purposes, and thus it can replace the complete rule set. The proposed form is particularly effective in dense datasets, where traditional extraction techniques may generate huge rule sets. The reduction in size of the rule set allows decreasing the complexity of both the rule generation step and the rule pruning step. Hence, classification rule extraction can be performed also with low support, in order to extract more, possibly useful, rules. Categories and Subject Descriptors: H.2.8 [Database Management]: Database Applications--Data mining General Terms: Algorithms, Experimentation, Theory Additional Key Words and Phrases: Association rules, associative classification, concise representations