改进的Apriori算法的入侵检测系统研究

综述了数据挖掘技术在网络入侵检测中的应用，阐述了关联规则分析在网络入侵检测中的应用原理和最新的研究与改进，并指出了目前存在的问题和未来研究的方向。改进由k阶频繁项集生成k＋1阶候选频繁项集时的连接和剪枝策略；改进对事务的处理方式，当所有联接完成时只扫描一遍Lk-1，减少Apriori算法中的模式匹配所需的时间开销。实验表明，该算法应用于此系统来提取用户行为特征和入侵模式特征，提高了整个系统的性能。

Research on the Intrusion Detection Systems Based on the Improved Apriori Algorithm

Main applications of data mining to network intrusion detection are reviewed, It describes the application theory of association rules analysis in network invasion monitoring and the latest research and improvements, and points out the existing problems and the direction for the future research, firstly, the strategy of the join step and the prune step was improved when candidate frequent （k＋ 1 ）-itemsets were generated from frequent k-itemsets; secondly, the method of dealing with transaction was improved to reduce the time of pattern matching to be used in the Apriori algorithm; in the end, the method of dealing with data base was improved, which lead to only once scanning of frequent k-itemsets during the whole course of the algorithm. The experimental results of the improved algorithm show that the improved algorithm is more efficient than the original.