Research on Network Intrusion Detection Method Based on Improved Association Rules
Yanyun Liu · Communications technology · 2008
The research of efficient association rules mining algorithm has important value for improving accuracy and efficiency of IDS.Because the user behavior features extracted by current IDS cannot reflect real circumstances,normal and abnormal models are not so accurate and perfect.The paper presents an intrusion detection method based on a fast mining algorithm XARM and an incremental updating algorithm SFUP.This method first constructs user normal and abnormal models by mining training data sets.Then,the real time behavior model is obtained by incrementally updating the real Internet data,and the intrusion detection is accomplished by marching the model database.These methods can distinquish normal behavior form abnormal behavior,timely update and improve IDS models.