摘要
入侵检测系统的性能在很大程度上与它的检测规则有关,所以如何更快更有效地从网络数据中获取有效的检测规则对于一个IDS(入侵检测系统)来说就变得格外重要.本文在分析了传统关联规则算法缺点的基础上,对关联规则挖掘算法的优化策略和时态因素的分类处理重点进行了讨论.即在利用主属性约束最后规则的同时,提出了高频属性直接入选的策略.以更快地获取有效的入侵检测规则.实验测试结果表明,优化后的算法在挖掘速度和规则的检出率等性能上有较大提高,找到了一些原来被忽略的规则并剔除了一些不重要的规则,证明此优化算法是切实有效的.
The capability of intrusion detection system is related to its detected rules greatly, so how to get the valid intrusion detection rules quickly from network data is very important to IDS（Intrusion Detection System）. In this paper the drawback of the tradi- tional algorithm of association rule is analyzed. And then the optimizing policy about data mining algorithm and the method of disposing temporal data are discussed specially. The main attribute is used to restrict the final rules. And some attributes are included in the final rules directly according to their high frequency. The improved algorithm is more improved in mining speed and detectable probabilities of final rules. Some formerly ignored rules are discovered, at the same time some unnecessary rules are eliminated in the experimentation. The validity of the improved algorithm is proved by the experimentation.
出处
《厦门大学学报（自然科学版）》
CAS
CSCD
北大核心
2006年第5期652-655,共4页
Journal of Xiamen University：Natural Science
基金
福建省教育厅科技项目(Ja05290)
厦门大学信息"985"二期创新平台项目资助
关键词
入侵检测
网络安全
时态数据
关联规则
intrusion detection
network security
temporal data
association rule
