TTFE: Mining top-k high-threat-and-frequency event sets in IIoT security

A new algorithm called TTFE can identify groups of Industrial Internet of Things (IIoT) events that combine high threat with high frequency, outperforming two comparison algorithms across eight open transaction datasets in a computational benchmark study published in Applied Intelligence. On average across the datasets and tested values of k, TTFE reduced runtime by 63.72% relative to THUFI and by 85.93% relative to GUMM. It also used 71.32% and 89.82% less memory, respectively, and generally produced higher final minimum thresholds.

The tests used open transactional datasets with threat and frequency attributes created by the researchers, not event logs collected from a live industrial network. The results therefore measure computational performance rather than prevented attacks, reduced downtime or improved security decisions in an operational IIoT environment. The method addresses a limitation of mining event sets with only one criterion.

Frequency-oriented methods can identify common combinations of events but may overlook a rare event with severe consequences, while utility-oriented methods can prioritize a high-value event that occurs too infrequently to dominate day-to-day analysis. The proposed approach assigns each event set a single comprehensive score, defined as TF(X) = αT(X) + βF(X), where T(X) is accumulated threat, F(X) is accumulated frequency, and the weights α and β are nonnegative and sum to one. Setting α to one reduces TTFE to threat-only mining, while setting it to zero produces frequency-only mining.

Intermediate values allow users to choose how strongly each dimension influences the ranking. The paper notes that threat and frequency may have inconsistent units and ranges, so normalization such as min-max scaling is required before their weights can be interpreted meaningfully. Threat is itself calculated from two components.

Every event type is assigned a time-invariant external threat value, ET, intended to represent its assessed significance. An occurrence of that event in a particular transaction can also carry an internal threat value, IT. Their product gives the event’s threat within that transaction, T(x,τ) = ET(x) × IT(x,τ), and these transaction-level values are summed across the members of an event set and across all transactions containing the set.

Frequency values are also summed in the same manner. This construction lets the final ranking reflect both the assessed impact associated with an event type and the quantity represented by its logged appearances. The researchers also describe a transaction-weighted score, TWS, obtained by summing the comprehensive values of all transactions containing an event.

TWS is used to establish the processing order of events rather than serving as the final measure of an event set’s importance. Unlike approaches that rank event sets separately for threat and frequency and then intersect the results, TTFE performs the combined search directly. The authors argue that this avoids a structural weakness in the two-ranking strategy: a set that is moderately high on both dimensions may not appear near the top of either separate list, and an intersection of the lists can therefore miss the best combined candidates.

In the paper’s illustrative example, separate mining with equal weights returned {A,B} as the leading threat set and {F,E} as the leading frequency set, producing an empty intersection, although {C,D} ranked highest under the combined score. TTFE instead constructs an enumeration tree and evaluates extensions against the comprehensive score. Each node stores the current event set, its TF value, a remaining value for possible extensions, and the number of child nodes.

A branch is stopped when its current score plus its remaining upper bound cannot exceed the current threshold. Two compact data structures support the search. The ETFR list stores an event set’s transaction identifier, accumulated threat, accumulated frequency and remaining threat information in a vertical hash-map structure.

For event sets containing two or more events, ETFR values can be derived mathematically from the corresponding smaller set, avoiding repeated scans of the full dataset. The second structure, LETF, is an upper-triangular matrix that records TF scores for contiguous event sequences under the selected processing order. Its entries provide exact values for promising sequences and support lower-bound estimates for related subsets.

The paper describes a recursion relationship for ETFR and an inequality stating that the score of an extension cannot exceed the current TF plus the remaining TF, providing the basis for pruning the enumeration tree. TTFE applies four threshold-raising mechanisms to narrow the search before and during enumeration. The first, RETF, uses the kth-highest TF value among single-event sets to set an initial threshold and removes events below it.

The second, LETF-exact, constructs the contiguous-sequence matrix and raises the threshold to the kth-highest exact value available in that matrix. The third, LETF-Lower Bound, generates candidate subsets by removing as many as three events from promising contiguous sequences, estimates their scores and uses the kth-highest estimate to raise the threshold again. The fourth strategy operates during tree search: whenever the priority queue contains more than k candidates, the threshold is updated to the score of the candidate ranked kth.

These mechanisms are intended to exclude branches that cannot enter the final ranking. The result is a top-k list of event sets judged simultaneously on threat and frequency rather than two independently optimized lists. The implementation uses two full scans of the transaction dataset.

During the first, TTFE calculates transaction-weighted scores, establishes the event-processing order and builds the initial ETFR structures. The second scan reorders events within each transaction and constructs the LETF matrix. Information for larger event sets is then obtained recursively from smaller sets, so the full data do not have to be scanned again during enumeration.

The authors also describe configurable pruning switches and support for comment symbols including %, #, @ and // in input files. The algorithm implementations and experimental datasets have been publicly released in a GitHub repository, which the paper reports is under ongoing maintenance. Its repository also includes a workflow for basic testing across the experimental datasets, figure generation and statistical-table production.

The computational comparison used THUFI, an extension of the THUI top-k high-utility itemset algorithm that mines threat and frequency separately before intersecting the two result sets, and GUMM, a general utility mining model with a fixed initial threshold. Eight open-source transactional datasets were evaluated: accidents, chess, kosarak, mushroom, connect, pumsb, pumsb_star and retail. Kosarak and retail were described as sparse, whereas chess, connect and mushroom were characterized as dense.

To simulate datasets containing both threat and frequency attributes, the researchers merged files with the same name, treating negative-valued data as the threat component and positive-only data as the frequency component. The tested k values were 5, 10, 50, 100, 500, 1,000, 5,000 and 10,000. TTFE was evaluated with α values of 0, 0.25, 0.5, 0.75 and 1, with the principal metric comparisons made at α = β = 0.5.

Every experiment was repeated independently 10 times, and arithmetic means were reported. Runs were conducted on a Windows 11 Pro system using an 11th-generation Intel Core i7-11800H processor at 2.30 GHz, an NVIDIA GeForce RTX 5060 Laptop GPU, 32 GB of RAM, a 512 GB solid-state drive, a 1,024 GB hard-disk drive and Java 25 LTS. The GUMM baseline sometimes produced out-of-memory errors.

TTFE’s final minimum threshold was reported as 171.56% higher than THUFI’s and 24.24% higher than GUMM’s. This threshold indicates how effectively an algorithm pruned candidates that could not reach the requested ranking; it is a computational indicator, not a measure of attack prevention or system reliability. In a worked example with seven event types, TTFE raised its threshold from zero to 27.5 using single-event scores, to 73.5 using exact LETF values and then to 85.5 through lower-bound estimates before constructing the tree.

Its top five combined sets were {dfb} with a score of 121.5, {cfb} with 106.5, {dcfb} with 106, {edfb} with 103 and {db} with 101.5. The authors propose that heterogeneous IIoT logs could first be parsed and cleaned into discrete security activities, with event frequencies counted from network-traffic, authentication and device-status records. Device owners would then assign threat values according to event type and device context, after which occurrences could be ordered and represented in the transactional format required by TTFE.

The paper presents this as a proposed data-conversion workflow rather than a validated operational deployment. Its linear framework can also be generalized to three or more external features through a weighted sum whose weights total one, while certain multiplicative scores can be transformed into an additive form by taking logarithms. More complex nonlinear or non-monotonic relationships remain an open problem because the threshold-raising and pruning arguments depend on the relevant mathematical properties.

The benchmark results support TTFE’s efficiency under the simulated two-attribute setup, but further validation would be needed to establish its usefulness, accuracy and decision value on real IIoT security logs.

Subject of Research: Computational mining of top-k IIoT event sets using combined threat and frequency scores

Article Title: TTFE: Mining top-k high-threat-and-frequency event sets in IIoT security

Article References: Yang, Y., Lin, Y., Yiu, S.-M., Xu, S., Chen, X., & Zhong, Z. (2026). TTFE: Mining top-k high-threat-and-frequency event sets in IIoT security. Applied Intelligence, 56(16), 512. https://doi.org/10.1007/s10489-026-07461-1

Image Credits: AI Generated

DOI: 10.1007/s10489-026-07461-1

Keywords: industrial internet of things, cybersecurity, event-set mining, threat scoring, frequency analysis, top-k mining, pruning algorithms, utility mining, algorithm benchmarking, ETFR list, TTFE, Mining