Extracting Precursor Rules from Time SeriesA Classical Statistical Viewpoint

In many applications of interest one is faced with the problem of identifying precursor events for extraordinary phenomena. We investigate this problem within the framework of Temporal Data Mining. The concept of Precursor Rule is defined in terms of events and sequences of events. Precursor Rules relate Precursor Events extracted from input time series with Phenomenon events extracted from output time series. A methodology is proposed for extracting Precursor Rules from databases containing time series related to different regimes of a system. Given a fixed output time series containing one or more Phenomenon events, a key contribution of this paper is to show that the Granger Causality Test (GCT) can be used for ranking candidate time series according to the likelihood that Precursor Rules exist. Time Series Quantization is performed for extracting Phenomenon events and Precursor events, but GCT is applied to the raw time series, before Quantization and the definition of Event Types. The paper presents an analytic investigation of the utilization of the GCT for time series pairs containing impulsive time-localized structure. Following a number of approximations, the Granger Causality Index is related with the confidence of the Precursor Rules extracted from these time series pairs. An example from Network Security illustrates the effectiveness of the methodology. Using MIB (Management Information Base) datasets collected from real experiments involving Distributed Denial of Service Attacks, it is shown that Precursor Rules relating activities at Attacking Machines with Traffic Floods at Target Machines can be extracted by the method.