基于数据流频繁模式挖掘的入侵检测模型  

Intrusion detection model based on frequent pattern mining over data streams

作　　者：许颖梅[1] 

机构地区：[1]商丘师范学院计算机系,河南商丘476000

出　　处：《陕西理工学院学报（自然科学版）》2011年第4期24-29,共6页Journal of Shananxi University of Technology:Natural Science Edition

基　　金：河南省科技厅科技攻关项目(112102210210)

摘　　要：计算机网络入侵通常具有高频度特性,因此,识别是否正常访问,对数据流中重复元素的挖掘,给出频度指标,是一种重要的依据。提出一种基于数据流频繁模式的改进型AFP算法,该算法采用滑动窗口树技术,单遍扫描数据流及时捕获网络上的最新模式信息,并将该算法应用在入侵检测模型中正常数据和异常数据的在线挖掘。解决了有限存储和无限数据流的矛盾。实验结果表明,该模型有较高的报警率和较低的误报率。Computer network intrusion typically has the characteristics of high frequency, Therefore, the data stream mining of repeating elements and given the frequency index are the important basis for visit to identify whether it is normal. An advanced method（AFP） for mining the frequent patterns of data streams is proposed. AFP tree algorithm uses the sliding window technique. As data stream flows, the contents of the data stream are captured with a compact prefix-tree by scanning the stream only once. And the algorithm is used in the intrusion detection model, the normal data and abnormal data mining online. The conflicts between limited memory and unlimited data flow are solved. The experimental results show that the model has a high alarming rate and a lower false rate.

关 键 词：数据流 频繁模式 入侵检测 

分 类 号：TP393.083[自动化与计算机技术—计算机应用技术]