入侵检测中频繁模式的有效挖掘算法

在基于数据挖掘的入侵检测系统中，为了在海量审计记录中有效地提取出相关规则，需要通过利用与入侵检测相关的特定领域知识。首先对关联规则挖掘问题中的相关概念给出几个规范化定义，介绍了基本的关联规则和情节规则挖掘算法，然后结合审计记录的特点，考虑其轴属性和参照属性以及规则兴趣度，对基本挖掘算法中的候选项目集产生函数进行了改进。分析结果表明，利用规则兴趣度能够大大减小候选项目集的大小，有效提高频繁模式挖掘算法的效率。

An Efficient Mining Algorithm for Frequent Pattern in Intrusion Detection

In data mining-based intrusion detection system, we should make use of particular domain knowledge in relation to intrusion detection in order to efficiently extract relative rules from large amounts of audit records. This paper first gives some standard definitions of the notions correlative to association rules, and introduces the basic association rule algorithm and episode rule algorithm, then improves the method of generating candidate itemset in basic algorithm through considering the characteristic of audit records, axis attributes and reference attributes. The result indicates that we can remarkably decrease the candidate items and improve the efficiency of mining frequent pattern when using the interest measure.