入侵检测系统中关联规则的挖掘与过滤

The Mining and Filtering of Association Rules in Intrusion Detection Systems

在利用关联规则算法的入侵检测系统中,由频繁集生成关联规则时,关联规则可能会出现大量无意义的规则,若将这些规则用于检测,则可能会产生误导。为了获得有用的关联规则,本文对关联规则算法提出了一些改进。并运用提出的方法做了一个关联规则挖掘实验,实验结果表明挖掘得到的关联规则远远少于原算法挖掘得到的规则,并且规则易于理解,比较适合于入侵检测。

This paper discusses an intrusion detection approach based on association rules and focuses on how to optimize the association algorithm. Some mining experiments about the association rules show that the optimization of algorithm is successful and the intrusion detection system based on association rules are effective. Moreover, the association rules mined by using of proposed method are easy to understand and suitable to detect intrusion.