1. Anomaly Detection using GAs M. Umer Khan 22-Nov-2005

2. Important Tasks in Previous Weeks To complete a basic story of the model followed for Anomaly Detection using Gas To complete a basic story of the model followed for Anomaly Detection using Gas To give a presentation, about the study conducted until now, to Dr. Waqar To give a presentation, about the study conducted until now, to Dr. Waqar Final year project discussion. Final year project discussion. Maggie website Management Maggie website Management

3. Progress Problems in understanding mathematics involved in Fuzzy Association rules & Frequency Episodes. Problems in understanding mathematics involved in Fuzzy Association rules & Frequency Episodes. Website is being updated. Website is being updated. Just some presentations remaining. Just some presentations remaining.

4. Fuzzy Association Rules Used as a tool for analyses of retail sales. Used as a tool for analyses of retail sales. Piece sales data…..a transaction Piece sales data…..a transaction AR to find correlation among different items in a transaction. AR to find correlation among different items in a transaction. Customer example. Customer example. Let D={T1,T2,……Tn} be the transaction database with n transactions. Let D={T1,T2,……Tn} be the transaction database with n transactions. I ={i1,i2,….im} items I ={i1,i2,….im} items

5. Fuzzy Association Rules contd. Each Ti in D records items purchased. Each Ti in D records items purchased. An association rule will have the form X  Y, c, s where X belongs to I and Y belongs to I An association rule will have the form X  Y, c, s where X belongs to I and Y belongs to I X and Y are disjoint item sets. X and Y are disjoint item sets. s represents the support of this association rule. s represents the support of this association rule. c represents the confidence. c represents the confidence.

6. Fuzzy Association Rules contd. n’, number of transactions that contained both X and Y. n’, number of transactions that contained both X and Y. s(XUY)=n’/n and c= support (XUY)/support(X) s(XUY)=n’/n and c= support (XUY)/support(X) Support(X) = occurrence of item X in whole D Support(X) = occurrence of item X in whole D C indicated when X is satisfied, there will be certainty of c that y is also true. C indicated when X is satisfied, there will be certainty of c that y is also true. Thresholds minconfidence and minsupport are used to mine association rules. Thresholds minconfidence and minsupport are used to mine association rules.

7. Fuzzy Association Rules contd. Such that c>=minconfidence and s>=minsupport Such that c>=minconfidence and s>=minsupport Any item set X is called large item set if support(X) >=minsupport. Any item set X is called large item set if support(X) >=minsupport. Mining algorithm involves 2 steps. Mining algorithm involves 2 steps. 1) find all the large item set 1) find all the large item set 2) Construct association rules for each. 2) Construct association rules for each.

8. References MINING FUZZY ASSOCIATION RULES MINING FUZZY ASSOCIATION RULES AND FUZZY FREQUENCY EPISODES AND FUZZY FREQUENCY EPISODES FOR INTRUSION DETECTION FOR INTRUSION DETECTION by by Jianxiong Luo Jianxiong Luo Susan M. Bridges1 Susan M. Bridges1

9. Future Task To study the remaining issues related model. To study the remaining issues related model.