应用于入侵检测系统的报警关联的改进Apriori算法  

Improved Apriori algorithm to associate alerts for intrusion detection system

作　　者：王台华[1] 万宇文[1] 郭帆[1] 余敏[1] 

机构地区：[1]江西师范大学计算机信息工程学院,南昌330022

出　　处：《计算机应用》2010年第7期1785-1788,共4页journal of Computer Applications

基　　金：国家973计划项目(2007CB316505)

摘　　要：在众多的关联规则挖掘算法中,Apriori算法是最为经典的一个,但Apriori算法有以下缺陷:需要扫描多次数据库、生成大量候选集以及迭代求解频繁项集。提出了一种一步交集操作得到最大频繁项目集的方法。支持度由交集的次数得到而无需再去扫描事务数据库,将其中一些属性进行编号能减少存储空间且方便搜索候选集列表,从而提高算法的效率。最后针对入侵检测系统形成关联规则。实验结果表明,优化后的算法能有效地提高关联规则挖掘的效率。Among a large number of association rule mining algorithms,Apriori algorithm is the most classic one,but it has three deficiencies,including scanning databases many times,generating a large number of candidate anthology,and mining frequent itemsets iteratively.This paper presented a method that solved the maximal frequent itemsets through one intersection operation.The degree of support was obtained through the times of intersection without scanning the transaction database.The method was optimized by indexing the attributes so that less memory space is needed and it is easier to search the candidate set list.It generates useful association rules for alerts in Intrusion Detection System（IDS）.The experimental results show that the optimized algorithm can effectively improve the efficiency of mining association rules.

关 键 词：数据挖掘 关联规则 APRIORI算法 项集 入侵检测系统 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]