tabulate_state_vector: Tabulate State Vector

In bradleyboehmke/anomalyDetection: Implementation of Augmented Network Log Anomaly Detection Procedures

Description

tabulate_state_vector employs a tabulated vector approach to transform security log data into unique counts of data attributes based on time blocks. Taking a contingency table approach, this function separates variables of type character or factor into their unique levels and counts the number of occurrences for those levels within each block. Due to the large number of unique IP addresses, this function allows for the user to determine how many IP addresses they would like to investigate. The function tabulates the most popular IP addresses.

Usage

tabulate_state_vector(data, block_length, level_limit = 50L,
  level_keep = 10L, partial_block = FALSE, na.rm = FALSE)

Arguments

data	data
block_length	integer value to divide data by
level_limit	integer value to determine the cutoff for the number of factors in a column to display before being reduced to show the number of levels to keep (default is 50)
level_keep	integer value indicating the top number of factor levels to retain if a column has more than the level limit (default is 10)
partial_block	a logical which determines whether incomplete blocks are kept in the analysis in the case where the number of log entries isn't evenly divisible by the block_length
na.rm	whether to keep track of missing values as part of the analysis or ignore them

Value

A data frame where each row represents one block and the columns count the number of occurrences that character/factor level occurred in that block

Examples

tabulate_state_vector(security_logs, 30)

bradleyboehmke/anomalyDetection documentation built on Oct. 15, 2019, 12:04 a.m.