In the following sections we discuss each of the application types separately and give arguments for the choices we made in the table.

## 5.1 Monitoring And Control

In monitoring and control applications the data volumes are large and it needs to be processed in real time. Two types of tasks can be distinguished: prevention and protection against adversary actions, and monitoring for management purposes.

## 5.1.1 Monitoring Against Adversary Actions

Monitoring against adversary actions is often an unsupervised learning task or one class classification, where the properties of 'normal behavior' are well defined, while the properties of attacks can differ and change from case to case. Classes are typically highly imbalanced with a few real attacks. Computer security. *Intrusion detection* is one of the typical monitoring problems. That is a detection of unwanted access to computer systems mainly through network (e.g. internet). There are passive intrusion detection systems, which only detect and alert the owner, and active systems, which take protective action. In both cases here we refer only to a detection part. Adversary actions is the primary source of concept drift in intrusion detection. The attackers try to invent new ways how to attack, which would overcome the existing security. The secondary source of concept drift is technological progress in time, when more advanced and powerful machines are created, they become accessible to intruders. 'Normal' behavior can also change over time. Lane and Brodley [91] explicitly formulated the problem of concept drift in intrusion detection a decade ago. They presented a detection system using instance based learning. Current research directions and problematics in intrusion detection can be found in a general review [118]. From supervised learning, lately, ensemble techniques have been proposed [104]. Artificial immune systems are widely considered for intrusion detection[77].

Telecommunications. Adversary behavior also applies to *telecommunications industry*, both intrusion and fraud. Mobile masquerade detection problem [106] from research perspective is closely related to intrusion detection. The goal is to prevent adversaries from unauthorized access to a private data. The sources of concept drift are again twofold: adversary behavior trying to overcome the control as well as changing behavior of legitimate users. Fraud detection and prevention in telecommunication industries [66] is also subject to concept drift due to similar reasons. Finance. In *financial sector* data mining techniques are employed to monitor streams of financial transactions (credit cards, internet banking) to alert for possible frauds. Insider trading in stock market is one more application. Both supervised and unsupervised learning techniques are used [20] for detection of fraudulent transactions. The data labeling might be imprecise due to unnoticed frauds, legitimate transactions