Association rule mining in intrusion detection systems

摘要

In a modern computer system, intrusion detection has become an essential and critical component. Data mining generally refers to the process of extracting models from large stores of data. The intrusion detection system first apply data mining programs to audit data to compute frequent patterns, extract features, and then use classification algorithms to compute detection models. The most important step of this process is to determine relations between fields in the database records to construct features. The standard association rules have not enough expressiveness. Intrusion detection system can extract the association rule with negations and with varying support thresholds to get better performance rather than extract the standard association rule.