Fig. 3 show the minimum support dec

Fig. 3 show the minimum support decreases, the processing times of both algorithms increase because of the total
number of candidate itemsets increases. It is clear that proposed algorithm is faster than the Signature Apriority no mater
what the minimum support is. Therefore, in the real environment, there are not too much candidate itemsets to be
generated during each pass of finding signatures.
The influences of minimum support and confidence thresholds on the anomaly detection based on association rule
mining are shown as Table 1.
Table1. Influences of Minimum Support and Confidence On Detection Model