R: Tabulate State Vector

tabulate_state_vector {anomalyDetection} | R Documentation

## Tabulate State Vector

### Description

`tabulate_state_vector` employs a tabulated vector approach to transform security log data into unique counts of data attributes based on time blocks. Taking a contingency table approach, this function separates variables of type character or factor into their unique levels and counts the number of occurrences for those levels within each block. Due to the large number of unique IP addresses, this function allows for the user to determine how many IP addresses they would like to investigate. The function tabulates the most popular IP addresses.

### Usage

    tabulate_state_vector(data, block_length, level_limit = 50L,
      level_keep = 10L, partial_block = FALSE, na.rm = FALSE)

### Arguments

`data` | data
`block_length` | integer value to divide data by
`level_limit` | integer value to determine the cutoff for the number of factors in a column to display before being reduced to show the number of levels to keep (default is 50)
`level_keep` | integer value indicating the top number of factor levels to retain if a column has more than the level limit (default is 10)
`partial_block` | a logical which determines whether incomplete blocks are kept in the analysis in the case where the number of log entries isn't evenly divisible by the `block_length`
`na.rm` | whether to keep track of missing values as part of the analysis or ignore them

### Value

A data frame where each row represents one block and the columns count the number of occurrences that character/factor level occurred in that block

### Examples

    tabulate_state_vector(security_logs, 30)

[Package anomalyDetection version 0.2.5 Index]