Characterizing network traffic behaviour using granule‐based association rule mining

Association rule mining is one important technique to characterize the behaviour of network traffic. However, mining association rules from network traffic data still have three obstacles such as efficiency, huge number of results and insufficiency to represent the behaviour of network traffic. Aiming to tackle these issues, this paper presents a granule‐based association rule mining approach, called association hierarchy mining. The proposed approach adopts top‐down rule mining strategy to directly generate interesting rules according to subjectively specified rule template hierarchies, which improves the efficiency of rule generation and subjectively filters user uninterested rules. The approach also proposes to prune a new type of redundant rules defined by this research to reduce the number of rules. Finally, the approach introduces the concept of diversity, aiming to select the interesting rules for better interpreting the behaviour of network traffic. The experiments performed on the MAWI network traffic traces show the efficiency and effectiveness of the proposed approach. Copyright © 2016 John Wiley & Sons, Ltd.