A Survey of Sliding-Window FP-Tree Reconstruction for Real-Time Mining of Network Intrusion Data Streams

Intrusion Detection Systems must analyze high-volume, evolving network telemetry with strict latency budgets. Frequent pattern (FP) mining provides compact summaries of co-occurring flow features, yet classical FP-growth is batch-oriented. This thesis surveys and implements sliding-window FP-tree maintenance for real-time mining. We compare four strategies: (V1) no-reorder with tilted counters, (V2) partial subtree rebuild under order drift, (V3) two-tree merge-subtract for explicit deletion, and (V4) decay-based hybrid. Using the CIC-IDS2017 Friday PortScan subset, a 5,000-flow window with 5% support yields per-window mining times of ≈0.21–0.31s on a 20k-flow sample, demonstrating near real-time feasibility. We discuss throughput/latency/memory trade-offs, anomaly scoring via rarity of itemset combinations, and practical guidance on choosing a variant by traffic density and resource constraints.