Alert Flood Reduction in Large-Scale Control Systems - A Hybrid Pattern Mining-based Approach

The immense flood of alerts that is constantly produced in large-scale control systems (LSCS) of critical infrastructures, ranging from energy and ICT to traffic, represents a substantial challenge for efficient and safe operation. Although research for reducing alert floods exists since decades, mining of appropriate alert patterns as the ultimate means to cope with alert quantity is especially challenged since relationships between alerts are commonly unknown, due to heterogeneity, size, and evolutionary nature of LSCS.Thus, this paper contributes an alert-driven pattern mining approach based on a hybrid, multi-objective evolutionary algorithm being unique in two directions. First, pattern quality is optimized by maximizing both, pattern size in terms of how many alerts are covered by a single pattern occurrence and pattern confidence taking into consideration how many alert occurrences are covered by repeated pattern occurrences, thus allowing for a two-dimensional flood reduction. Secondly, pattern coverage is maximized, ensuring that each alert occurrence is pinned down within a pattern and at the same time allowing for various patterns to be identified for a single alert, thus facilitating a multi-faceted flood reduction. Based on real-world log data in the area of road traffic management, the applicability of our approach is demonstrated.