This document outlines four perspectives for identifying patterns in data streams: 1. An identifier/ML model perspective where the general presence of patterns is known or unknown. Known patterns can be found through rule-based or supervised methods, while unknown patterns require unsupervised or rule mining approaches. 2. An analyst perspective where the presence of certain patterns like bots is known or unknown. If their presence is known, rule-based methods can find them. If unknown, hyperparameter tuning may be needed. 3. An observer perspective where an analyst either knows or doesn't know if certain patterns are present. If presence is known but patterns found, unsupervised ML is used. If both presence and patterns are unknown, nothing

1. Perspective of
Identifier(ML) and
Certainty
Presence in Data stream
Generally Occurrence
(general Presence Known)
New/Rare Occurrence or non-general
(general Presence Unknown)
Identifi
er/ ML
Model
Known
Pattern/ way
of finding
Known - Known
Our Setup knows the Signature and
general presence is known.
(Exploitation Required)
>> Rule based
>> Supervised Learning
Known - Unknown
Our Setup knows the Signature and
general presence is unknown.
(Exploitation Required)
>> Rule based
>> Supervised Learning
Unknown
Pattern
Unknown - Known
Our Setup doesn’t knows the
Signature and presence is known.
(Exploration Required)
>> Rule Mining
>> Unsupervised Learning
Unknown - Unknown
Our Setup doesn’t knows the Signature and
general presence is unknown.
(Exploration Required)
>> Rule Mining
>> Unsupervised Learning

2. Perspective of
Analyst and Presence
Ability to find using the system/ Setup
Known Unknown
Observ
er/
Analyst
Do we
Know
Know Bots
are present
Known - Known
We know Bot is there and it’s doing
something and we know how to find
it.
>> Rule based
Known - Unknown
We know some bot is there eg. Reports
‘But we are unable to find it with
confidence. Hyperparameter tuning plays a
role here.
Don’t known
Bots are
Present
(Unknown)
Unknown - Known
We don’t know if bots are present
but we are finding it.
>> ML application
Unknown - Unknown
We don’t know if Bots are Present and we
are unable to find these.