Hardware Implementation for frequent episode discovery in event sequences

Frequent episode discovery in alerts generated by intrusion detection systems has useful information for administrators. In this paper we consider the process of discovering frequent episodes in event sequences. Counting the frequencies of a set of candidate episodes is the most computationally intensive part of this process. We investigate the frequency counting algorithms and present the hardware implementation for speeding up this part. Our hardware implementation of frequency counts offers a speed-up for finding the frequent of an episode.