基于关联规则挖掘的网络安全审计技术研究

Research on Association Rules Mining Based Network Security Audit Technology

针对现有的安全审计规则及审计模型存在的准确率不高、检测效率低、规则适应性差等问题,本文设计了一种基于关联规则挖掘的网络安全审计模型,并在该模型中引入FP-Growth算法自动生成审计规则。该模型提高了安全审计的准确率以及规则的自适应能力,不仅能审计己知的异常行为,也能审计出未知的异常行为。

We present an association rules mining based network security audit model in view of the low accuracy, low detection efficiency and weak rules adaptability of the present security audit rules and audit models. We also apply FP-Growth algorithm to the model to automatically generate audit rules. Experiment shows that the model can not only improve the accuracy of security audit and rules adaptability but also can audit both known and unknown deviant behaviors.