ALGORITHM: getLargeEventSet (SDB, 𝑡 _session,
min_sup_les)
INPUT: (1) SDB: An input sequence database with time, (2)
𝑡 _session: the time user session, (3) min_sup_les: the
minimum support threshold of getting large event set.
OUTPUT: LES: large event set.
(7) scan sequence database; find all candidate events [ ⟨ 𝐸 1 ⟩ ,
⟨ 𝐸 2 ⟩ ,…, ⟨ 𝐸 𝑗 ⟩ ]
(8) group sequences by IP address and 𝑡 -session; find all
sessions [ 𝑆 1, 𝑆 2,…, 𝑆 𝑚 ]
(9) for each candidate event 𝐸 𝑗 in session 𝑆 𝑚
(10) calculate support for 𝐸 𝑗
(11) if (support of 𝐸 𝑗 ≥ min_sup_les)
(12) output event 𝐸 𝑗 to LES
(13) return
Algorithm 2: Get large event set.