基于关联规则的网络入侵检测方法  

Association Rules Based Network Intrusion Detection Method

作　　者：陈洪泉[1] 霍志凯 

机构地区：[1]海军大连舰艇学院信息与通信工程系,辽宁大连116018

出　　处：《电子科技大学学报》2009年第S1期94-96,共3页Journal of University of Electronic Science and Technology of China

摘　　要：介绍了基于关系代数理论的ORAR关联规则算法,分析了在KDDCUP99中选择训练数据集和选择特征的基本方法,并在此基础上利用ORAR算法进行了频繁3、4、5、6项集入侵模式的挖掘,将挖掘结果应用于测试数据集的入侵检测,从检测的准确率和误检率两个方面较为系统地对不同的频繁项集检测的结果进行了比较,得到了检测效果最好的频繁项集,仿真结果对于入侵检测方法的进一步研究具有积极的借鉴意义。ORAR association rules algorithm based on relation algebra theory is introduced. The basic method of selecting disciplined data set and features in KDD CUP 99 is analyzed. With ORAR algorithm, the mining aims at frequent three item sets, frequent four item sets, frequent five item sets, and frequent six item set. The mining patterns are used to test data collection, the results are compared according to the accuracy rate and true false rate, and the best frequent item set is achieved.

关 键 词：频繁模式 入侵检测 KDD99 ORAR 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]