改进的Apriori-TFP算法在入侵检测中的应用  

Application of improved Apriori-TFP algorithm in intrusion detection

作　　者：蔡伟贤[1] 滕少华[1] 

机构地区：[1]广东工业大学计算机学院,广东广州510006

出　　处：《计算机工程与设计》2011年第11期3594-3598,3715,共6页Computer Engineering and Design

基　　金：广东省自然科学基金项目(06021484;9151009001000007;9451009001002777);广东省科技计划基金项目(2008A060201011);广州市越秀区科技计划基金项目(2007-GX-075)

摘　　要：为了从检测数据中发现潜在的、有效的入侵检测规则,提高入侵检测系统的检测率,提出一个基于分类关联规则的入侵检测系统模型。系统对数据集进行预处理,再利用改进的分类关联规则挖掘算法I-Apriori-TFP(total-from-partial)来产生所有的分类关联规则,并基于已产生的分类关联规则建立一个分类器,分类器经测试数据测试后,生成检测代理,最后利用检测代理对网络数据进行检测。实验结果表明,该方法能够有效地检测出网络数据中的入侵行为。To discover potential and effective intrusion detection rules from test data, and improve the detection rate ofintrusion detection system, a model of intrusion detection system based on class-association rule （CAR） is presented. Firstly, the datasets are preprocessed by the system, and then all the CARs are generated by the use of the improved mining algorithm of CAR： I-Apriori-TFP （total-from- partial）. Moreover, a classifier based on the generated CARs is established and it is tested by test data so as to generate a detection agent. Finally, network data are detected by the detection agent. Experiments show that the proposed method could detect intrusions efficiently in the network.

关 键 词：入侵检测 数据挖掘 关联分析 分类 关联规则 分类关联规则 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]