Intrusion Detection Technology Research Based on Fast Multi-association Mining Algorithm
Fang-Cheng Shen · Computer Technology and Development · 2010
Invasion eigenvalue and discovery algorithm are the key technologies to misuse intrusion detection technology.To solve Apriori algorithm's two problems: one is that scanning the transaction database repeatedly produce large I/O load;the other is that it may have unwanted large candidate sets.Presents a fast multi-constrained Apriori algorithm,which can real-time update of intrusion detection system rule-base,improve detection performance of the entire system,effectively reduce the false alarm rate and false alarm rate.Considering that the current new attacks are derivatives of old existing attacks,many of them have same characteristics of sub-strings,and not every events with strong rules are fun events,the new algorithm adds the decreasing support constraints.Experiment results indicate that the proposed method is efficient.