Application of High-Dimensional Outlier Mining Based on the Maximum Frequent Pattern Factor in Intrusion Detection

Algorithm 1

MFPOF-OM algorithm.

	Input: D//network behaviour dataset
	MinSP//minimum support threshold
	k//number of outliers threshold
	Output: k network behaviour outlier data records
	Begin
	// Stpe 1–3: mining the maximum frequent item sets based on PF-Tree Algorithm
	Step 1: To D, the HeaderTable (D) is generated to satisfy the MinSP;//Calculating the header table of PF-tree
	Step 2: To D, the frequent item set tree is generated to satisfy the given MinSP by using the PF-Tree Algorithm, and denoted as: T;//Obtains frequent item set tree according to the PF-Tree algorithm
	Step 3: Obtains maximum frequents item sets based on an improved PF-Tree, and obtains MFPs (D, MinSP) and support (X)//Obtains maximum frequents item sets
	//Stpe 4–7: Mine k outliers data with minimum MFPOF value based on the obtained MFPs
	Step 4: foreach t in D
	According to formula (3), calculates the maximum frequent patterns factor of each record t: MFPOF(t);
	end foreach//Calculating maximum frequent factor of each transaction t
	Step 5: Obtains a MFPOF value of each network behaviour records t;
	Step 6: For all t, they are sorted in ascending order according to MFPOF (t);
	Step 7: Return the first k network behaviour record with the minimum MFPOF value, and they are k outlier data in the network behaviour data.
	End