Mining Partially Periodic Event Patterns with Unknown Periods

We consider the problem of discovering partially periodic temporal associations, which we call p-patterns. In computer networks, a p-pattern might consist of ve repetitions every 30 seconds of a port-down event followed by a port-up event, which in turn is followed by a random gap until the next ve repetitions of these events. Finding p-patterns consists of two sub-tasks: (1) nding period lengths (e.g. 30 seconds) and (2) nding temporal association (e.g., port-down followed by port-up). While a variation of Apriori can be employed in the second sub-task, the rst sub-task has not been addressed (to the best of our knowledge). Moreover, how these two tasks are combined has signiicant implications. We develop an algorithm for nding periods using a chi-squared test, and we study the performance of this algorithm in the presence of noise. Further, we develop two algorithms for discovering p-patterns based on whether periods or temporal associations are discovered rst, and we examine trade-oos between these approaches. One result is that the association-rst algorithm has a higher tolerance to noise while the period-rst algorithm is more computation-ally eecient. From comparisons based on synthetic data, we observe that the association-rst algorithm is as eeective as the period-rst approach if the noise to signal ratio (NSR) is less than one. This motivates us to apply the period-rst algorithm to data from a production computer network. Numerous actionable patterns are discovered, including a possible security intrusion.