Application research of constructing IDS rules library based on association rules
Fan Yang · Jisuanji gongcheng yu sheji · 2007
The performance of network intrusion detection system(IDS)depends on upgrading of rules greatly. The serious security problems require better performance on upgrading rules. Applying association rules on updating of detective rules library in IDS is as- sumed. The traditional association rules algorithm is analyzed, and some improvement is done aimed at the IDS. By giving an example of Snort, the improved association rules algorithm is applied to mine the network dataset, and the result is translated into intrusion detective rules. The experiment shows feasibility of applying the association rules to construct the IDS rules Library.