Analyzer includes data-mining functions provided by NetMiner module.
NetMiner extracts Frequent Itemsets and Association Rules from databases
generated by NetLogger, stores them into another database and applies SQL queries to
filter the results. SQL queries are read from an XML file (i.e. netminer.xml)
and can be increased and updated simply editing that file.
This module is not
intended to perform real-time analysis.
Overview
NetMiner is a module that performs data-mining operations inside Analyzer.
It is made up of three distinct tools:
- the user interface, which is integrated into Analyzer executable and it is
activated from the NetMiner menu;
- the data extraction, transformation and loading utility, which is supplied
as an external command-line utility (dbetl.exe) and that could be used also
apart from Analyzer;
- the Apriori implementation, supplied as an external command-line utility
(apriori.exe),
developed by C.Borgelt of university of
Magdeburg, which implements the data mining algorithm.
NetMiner user interface provides a simple way to handle the extraction of
frequent itemsets and association rules from traffic transactions stored into
NetLogger databases.
The picture below shows the workflow for the extraction of data-mining
results.
- The traffic is logged through NetLogger agent, then the transactions are extracted and transformed into a format
suitable for data-mining by running the
NetMiner wizard.
- The Apriori algorithm is applied to extract association rules or frequent
itemsets (or both).
- The results are transformed and loaded into a destination database.
- The
NetMiner.xml file is processed, thus creating a set of SQL views on
the mining database.
- The results can be analyzed from the NetMiner user interface.
