IDS Model Designing Based on Optimize Apriori Algorithm
Zhu Zong-sheng · Computers & Security · 2009
The multi-step attack is one of the primary forms of the current intrusions. How to detect these attacks is an important aspect of IDS(Intrusion Detection System) research. Through the study on patterns of the multi-step attack, a model of alert correlation which is based on self-regulate is designed. To improve eficiency of IDS,the paper applies data mining technology to IDS according to the characteristics of the system.It describes how to acquire the intrusion knowledge from the logs and detect the intrusion behaviors based on the improved Apriori algorithm.