入侵特征值识别和发现算法是误用入侵检测中的关键技术。采用数据挖掘技术从主机和网络的数据中发现入侵特征值,建立入侵行为和正常行为规则库,已经广泛用于入侵检测技术中。针对数据挖掘中经典的Apriori和AprioriTid算法中存在项集生成瓶颈问题,提出了一种基于规则约束制导的Apriori算法,考虑到强规则事件并不一定是有趣事件并且大部分入侵行为都是基于已有入侵模式基础上变异得到,加入兴趣度约束和递减支持度约束。通过实验演示,结果表明该算法可大幅提高效率并在入侵检测漏报率上有很好的改善。
Network security has been a very important issue, since the rising evolution of the Intemet. One commonly used defense measure against such malicious attacks in the Internet is Intrusion Detection System (IDS). Data mining has been extensively applied in net- work intrusion detection and prevention systems by discovering user behavior patterns from the network traffic data. Association rules and sequence roles are the main technique for data mining. Considering the classical Apriori algorithm and AprioriTid algorithm with two bot- tlenecks of frequent itemsets mining, this paper proposed a homing- constraint - rule Apriori algorithm (HCRAporiori). Experiment results indicate that the proposed method is efficient.