TTFE: Mining top-k high-threat-and-frequency event sets in IIoT security

Mining top-k high-utility itemsets (THUI) is one of the focuses of intense research interest, and the main task is to find k high-value elements within a transactional dataset. Usually, high-utility items are characterized not by one dimension but by the combination effect of multiple dimensions. However, in traditional algorithms, factors are considered separately, making it impossible to mine items with multiple properties. Therefore, in this study, we presented a novel algorithm to mine top-k high-threat-and-frequency event sets simultaneously. Concretely speaking, inspired by the general utility mining model (GUMM), we first introduced a linear function to combine the effects of threat and frequency to evaluate events’ importance, built an enumeration tree to list promising candidates, and proposed pruning algorithms based on THUI to improve mining efficiency. It is worth noting that our TTFE algorithm can be easily extended to mine event sets with multiple external features (more than 2). Experimental results demonstrate that TTFE can achieve sufficient performance on mining the top-k high value items in eight transaction datasets, whilst generally outperforming time consumption by 63.72%, memory consumption by 71.32%, and minimum threshold by 171.56%, compared to baseline algorithm THUFI, the extension version of the state-of-the-art THUI. The TTFE algorithm also outperforms in these three metrics by 85.93%, 89.82%, and 24.24%, respectively, compared to the GUMM algorithm. Additionally, by adjusting the weight parameters α and β , our algorithm can flexibly degenerate to known top-k utility mining algorithms. Notably, it can be used to discover the top-k important events among service logs to capture security risks of Industrial Internet of Things (IIoT).