Dynamic WEB: Profile correlation using COBWEB

Abstract

Establishing relationships within a dataset is one of the core objectives of data mining. In this paper a method of correlating behaviour profiles in a continuous dataset is presented. The profiling problem which motivated the research is intrusion detection. The profiles are dynamic in nature, changing frequently, and are made up of many attributes. The paper describes a modified version of the COBWEB hierarchical conceptual clustering algorithm called Dynamic WEB. Dynamic WEB operates at runtime, keeping the profiles up to date, and in the correct location within the clustering tree. Further, as there are a number of attributes within the domain of interest, the tree also extends multi-dimensionally. This allows for multiple correlations to occur simultaneously, focussing on different attributes within the one profile.