• The Journal of Korean Association of Computer Education
• /
• v.5 no.4
• /
• pp.53-60
• /
• 2002

Typical Apriori-like methods for mining sequential patterns have some problems such as generating of many candidate patterns and repetitive searching of a large database. And PrefixSpan constructs the prefix projected databases which are stepwise partitioned in the mining process. It can reduce the searching space to estimate the support of candidate patterns, but the construction cost of projected databases is still high. For efficient sequential pattern mining, we need to reduce the cost to generate candidate patterns and searching space for the generated ones. To solve these problems, we proposed SuffixSpan(Suffix checked Sequential Pattern mining), a new method for sequential pattern mining, and show a formal approach to our method.

• Journal of Korea Multimedia Society
• /
• v.5 no.5
• /
• pp.590-598
• /
• 2002

For efficient sequential pattern mining, we need to reduce the cost to generate candidate patterns and searching space for the generated ones. Although Apriori-like methods like GSP[8] are simple, they have some problems such as generating of many candidate patterns and repetitive searching of a large database. PrefixSpan[2], which was proposed as an alternative of GSP, constructs the prefix projected databases which are stepwise partitioned in the mining process. It can reduce the searching space to estimate the support of candidate patterns, but the construction cost of projected databases is still high. To solve these problems, we proposed SuffixSpan(Suffix checked Sequential Pattern mining) as a new sequential pattern mining method. It generates a small size of candidate pattern sets using partition property and suffix property at a low cost and also uses 1-prefix projected databases as the searching space in order to reduce the cost of estimating the support of candidate patterns.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2125-2128
• /
• 2003

알려진 공격 방법에 대해서는 다양한 방법으로 공격을 탐지하여 적절한 대응을 할 수 있는 반면 알려지지 않은 방법에 의한 공격은 침입탐지 시스템에서 공격 자체를 인식하지 못하므로 적절한 대응을 할 수 없게 된다. 따라서 비정상행위에 대한 탐지를 위해 데이터마이닝 기술을 이용하여 새로운 유형의 공격을 추출하고자 하였다. 특히 대용량의 데이터에 공통적으로 나타나는 순차적인 패턴을 찾는 순차분석 기법 중 PrefixSpan알고리즘을 적용하여 비정상 행위 공격을 탐지할 수 있는 방법을 제시하였다.

• Journal of the Korea Society of Computer and Information
• /
• v.14 no.5
• /
• pp.29-36
• /
• 2009

Sequential pattern mining, which discovers frequent subsequences as patterns in a sequence database, is an important data mining problem with broad applications. Since a sequential pattern in DNA sequences can be a motif, we studied to find sequential patterns in DNA sequences. Most previously proposed mining algorithms follow the exact matching with a sequential pattern definition. They are not able to work in noisy environments and inaccurate data in practice. Theses problems occurs frequently in DNA sequences which is a biological data. We investigated approximate matching method to deal with those cases. Our idea is based on the observation that all occurrences of a frequent pattern can be classified into groups, which we call approximated pattern. The existing PrefixSpan algorithm can successfully find sequential patterns in a long sequence. We improved the PrefixSpan algorithm to find approximate sequential patterns. The experimental results showed that the number of repeats from the proposed method was 5 times more than that of PrefixSpan when the pattern length is 4.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.43 no.5 s.311
• /
• pp.17-28
• /
• 2006

In this paper, we investigate a problem of updating sequential patterns when new transactions are added to a database. We present an efficient updating algorithm for sequential pattern mining that incrementally updates added transactions by reusing frequent patterns found previously. Our performance study shows that this method outperforms both AprioriAll and PrefixSpan algorithm which updates from scratch, since our method can efficiently utilize reduced candidate sets which result from the incremental updating technique.

• Journal of Internet Computing and Services
• /
• v.10 no.2
• /
• pp.1-13
• /
• 2009

Intrusion detection is a process that identifies the attacks and responds to the malicious intrusion actions for the protection of the computer and the network resources. Due to the fast development of the Internet, the types of intrusions become more complex recently and need immediate and correct responses because the frequent occurrences of a new intrusion type rise rapidly. Therefore, to solve these problems of the intrusion detection systems, we propose a sequential pattern miner for analysis of the alert data in order to support intelligent and automatic detection of the intrusion. Sequential pattern mining is one of the methods to find the patterns among the extracted items that are frequent in the fixed sequences. We apply the prefixSpan algorithm to find out the alert sequences. This method can be used to predict the actions of the sequential patterns and to create the rules of the intrusions. In this paper, we propose an extended prefixSpan algorithm which is designed to consider the specific characteristics of the alert data. The extended sequential pattern miner will be used as a part of alert data analyzer of intrusion detection systems. By using the created rules from the sequential pattern miner, the HA(high-level alert analyzer) of PEP(policy enforcement point), usually called IDS, performs the prediction of the sequence behaviors and changing patterns that were not visibly checked.

• The KIPS Transactions:PartD
• /
• v.15D no.2
• /
• pp.155-162
• /
• 2008

Biological sequences such as DNA sequences and amino acid sequences typically contain a large number of items. They have contiguous sequences that ordinarily consist of hundreds of frequent items. In biological sequences analysis(BSA), a frequent contiguous sequence search is one of the most important operations. Many studies have been done for mining sequential patterns efficiently. Most of the existing methods for mining sequential patterns are based on the Apriori algorithm. In particular, the prefixSpan algorithm is one of the most efficient sequential pattern mining schemes based on the Apriori algorithm. However, since the algorithm expands the sequential patterns from frequent patterns with length-1, it is not suitable for biological dataset with long frequent contiguous sequences. In recent years, the MacosVSpan algorithm was proposed based on the idea of the prefixSpan algorithm to significantly reduce its recursive process. However, the algorithm is still inefficient for mining frequent contiguous sequences from long biological data sequences. In this paper, we propose an efficient method to mine maximal frequent contiguous sequences in large biological data sequences by constructing the spanning tree with the fixed length. To verify the superiority of the proposed method, we perform experiments in various environments. As the result, the experiments show that the proposed method is much more efficient than MacosVSpan in terms of retrieval performance.

• International Journal of Contents
• /
• v.3 no.2
• /
• pp.18-24
• /
• 2007

Biological sequences such as DNA and amino acid sequences typically contain a large number of items. They have contiguous sequences that ordinarily consist of more than hundreds of frequent items. In biological sequences analysis(BSA), a frequent contiguous sequence search is one of the most important operations. Many studies have been done for mining sequential patterns efficiently. Most of the existing methods for mining sequential patterns are based on the Apriori algorithm. In particular, the prefixSpan algorithm is one of the most efficient sequential pattern mining schemes based on the Apriori algorithm. However, since the algorithm expands the sequential patterns from frequent patterns with length-1, it is not suitable for biological datasets with long frequent contiguous sequences. In recent years, the MacosVSpan algorithm was proposed based on the idea of the prefixSpan algorithm to significantly reduce its recursive process. However, the algorithm is still inefficient for mining frequent contiguous sequences from long biological data sequences. In this paper, we propose an efficient method to mine maximal frequent contiguous sequences in large biological data sequences by constructing the spanning tree with a fixed length. To verify the superiority of the proposed method, we perform experiments in various environments. The experiments show that the proposed method is much more efficient than MacosVSpan in terms of retrieval performance.

• Proceedings of the Korean Information Science Society Conference
• /
• 2007.06b
• /
• pp.27-31
• /
• 2007

생물학적 서열 데이터는 크게 DNA 염기 서열과 단백질 아미노산 서열이 있다. 이들 서열은 일반적으로 많은 수의 항목들을 가지고 있어 그 길이가 매우 길다. 생물학적 데이터 서열들에는 보통 빈번하게 발생하는 부분 연속 서열들이 존재하는데 이들 서열들을 찾아내는 것은 다양한 서열 분석에서 유용하게 사용될 수 있다. 이를 위해 초기에는 Apriori 알고리즘을 기반으로 하는 순차패턴 마이닝 알고리즘들을 활용하는 방법들이 많이 제시되었다. 그중 PrefixSpan 알고리즘은 Apriori기반의 가장 효율적인 순차패턴 마이닝 기법이다. 하지만 이 알고리즘은 길이-1인 빈발 패턴들로부터 서열 패턴을 확장해나가는 방식으로 길이가 긴 연속 서열을 포함하는 생물학적 데이터 서열들에 대한 검색방법으로는 적합하지 않다. 최근에는 기존의 PrefixSpan방식을 이용하면서도 반복적인 처리과정을 줄인 MacosVSpan이 제안되었다. 하지만 이 알고리즘 또한 원본 데이터베이스보다 크기가 큰 별도의 프로젝션 데이터베이스를 사용함으로서 많은 비용부담이 발생하고 특히 길이가 긴 서열에 대해서는 더욱 효율적이지 못하다. 이에 본 논문에서 많은 양의 생물학적 데이터 서열들로부터 빈번한 연속서열을 고정길이 확장 트리를 이용하여 효과적으로 찾아내는 방법을 제안한다. 그리고 다양한 환경에서 실험을 통해 제안하는 방식이 MacosVSpan알고리즘에 비해 검색 성능이 우수함을 증명한다.

• Proceedings of the KAIS Fall Conference
• /
• 2010.05a
• /
• pp.451-454
• /
• 2010

침입탐지란 컴퓨터와 네트워크 자원에 대한 유해한 침입 행동을 식별하고 대응하는 과정이다. 점차적으로 시스템에 대한 침입의 유형들이 복잡해지고 전문적으로 이루어지면서 빠르고 정확한 대응을 할 수 있는 시스템이 요구되고 있다. 이에 대용량의 데이터를 분석하여 의미 있는 정보를 추출하는 데이터 마이닝 기법을 적용하여 지능적이고 자동화된 탐지 및 경보데이터 패턴 분석에 이용할 수 있다. 본 논문에서는 경보데이터 패턴 분석을 위해 시퀀스패턴기법을 적용한 경보데이터 마이닝 엔진을 구축한다. 구현된 경보데이터 마이닝 시스템은 기존의 시퀀스 패턴 알고리즘인 PrefixSpan 알고리즘을 확장 구현하여 경보데이터의 빈발 경보시퀀스 분석과 빈발 공격시퀀스 분석에 활용할 수 있다.