ALGORITHM: getLargeEventSet (SDB, _session,
min_sup_les)
INPUT: (1) SDB: An input sequence database with time, (2)
_session: the time user session, (3) min_sup_les: the
minimum support threshold of getting large event set.
OUTPUT: LES: large event set.
(7) scan sequence database; find all candidate events [ ,
,…, ]
(8) group sequences by IP address and -session; find all
sessions [ 1, 2,…, ]
(9) for each candidate event in session
(10) calculate support for
(11) if (support of ≥ min_sup_les)
(12) output event to LES
(13) return
Algorithm 2: Get large event set.