getpatternlist.R

# this function is the result of heirarchical clustering.  
# once we identified the clustered patterns, we found the most 
# prominant collection of variables to identify that pattern.
getpatternlist <- function(vz, mat) {
  skimmer <- mat[ ,"attribute.confidentiality.data.variety.Payment"]==1 &
    mat[ ,"action.physical.variety.Tampering"]==1
  espionage <- (mat[, "actor.external.motive.Espionage"]==1 | 
                  mat[ ,"actor.external.variety.State-affiliated"]==1) & 
    as.vector(getfilter(vz, list("attribute"="confidentiality")))
  pos <- (mat[ , "asset.assets.variety.S - POS controller"]==1 |
            mat[ , "asset.assets.variety.U - POS terminal"]==1) &
    mat[ , "action.hacking"]==1
  dos <- mat[ ,"action.hacking.variety.DoS"]==1
  webapp <- mat[ , "action.hacking.vector.Web application"]==1
  webapp <- webapp & !(webapp & dos)
  misuse <- mat[ ,"action.misuse"]==1
  filter <- skimmer | espionage | pos | dos | webapp | misuse  
  mal.tmp <- mat[ ,'action.malware']==1 & 
    !mat[ ,'action.malware.vector.Direct install']
  malware <- (mal.tmp & !filter)
  theftloss <- mat[ ,'action.error.variety.Loss']==1 | 
    mat[ ,'action.physical.variety.Theft']==1
  filter <- filter | malware | theftloss
  errors <- mat[ ,'action.error']==1 & !filter
  filter <- filter | errors
  other <- !filter
  pats <- data.frame(Skimmers=skimmer, Espionage=espionage, POS=pos, DoS=dos, 
                     Webapp=webapp, Misuse=misuse, Crimeware=malware, 
                     "TheftLoss"=theftloss, Error=errors, Other=other)
  # convert T/F to colname if True
  named.df <- do.call(cbind, lapply(colnames(pats), function(x) {
    ifelse(pats[ ,x], x, NA)
  }))
  # now reduce each row to a single label, return the vector
  apply(named.df, 1, function(x) {
    x[!is.na(x)][1]
  })
}