改进的时态关联规则在入侵检测中的应用

入侵检测系统的性能在很大程度上与它的检测规则有关,所以如何更快更有效地从网络数据中获取有效的检测规则对于一个IDS(入侵检测系统)来说就变得格外重要.本文在分析了传统关联规则算法缺点的基础上,对关联规则挖掘算法的优化策略和时态因素的分类处理重点进行了讨论.即在利用主属性约束最后规则的同时,提出了高频属性直接入选的策略.以更快地获取有效的入侵检测规则.实验测试结果表明,优化后的算法在挖掘速度和规则的检出率等性能上有较大提高,找到了一些原来被忽略的规则并剔除了一些不重要的规则,证明此优化算法是切实有效的.

The Application of an Improved Temporal Algorithm of Association Rules to Intrusion Detection

The capability of intrusion detection system is related to its detected rules greatly,so how to get the valid intrusion detection rules quickly from network data is very important to IDS(Intrusion Detection System).In this paper the drawback of the traditional algorithm of association rule is analyzed.And then the optimizing policy about data mining algorithm and the method of disposing temporal data are discussed specially.The main attribute is used to restrict the final rules.And some attributes are included in the final rules directly according to their high frequency.The improved algorithm is more improved in mining speed and detectable probabilities of final rules.Some formerly ignored rules are discovered,at the same time some unnecessary rules are eliminated in the experimentation.The validity of the improved algorithm is proved by the experimentation.