Frequent sequential pattern discovery for data screening
Hisashi Tsuruta, Takayoshi Shoudai, Jun’ichi Takeuchi · 2011
Abstract—To early detect and defend the threats in the Internet caused by botnet, darknet monitoring is very important to understand various botnet activities. However, common illegal accesses by ordinary malwares makes such detection difficult. In this paper, in order to remove such accesses by ordinary malwares from the results of network monitoring, we propose a data screening method based on finding frequent sequential patterns which appear in given traffic data. Besides, we apply our method to traffic data observed in darknet and report the results. Index Terms—incident detection, frequent pattern mining, sequential pattern, data screening, darknet monitoring. I.