改进关联规则挖掘算法在入侵检测中的应用

摘要

The FP-Growth algorithm based on FP-Tree needs to create a large number of conditional FP-Trees recursively in the process of mining frequent patterns. It is not efficient and not good to apply in intrusion detection, in which the association rules mining include many elements. Because the intrusion includes many methods and elements, must quantitatively analyse intrusion samples. It analyzes the features of intrusion detection, proposed a new frequent pattern tree CP-Tree based on conditional frequent-items and the improved algorithms MineCPT which directly mines in the tree. Theoretical analysis and experimental results show that the MineCPT algorithm is superior to FP-Growth algorithm in memory occupancy and reliability. It has achieved better results in the field of intrusion detection.%在关联规则挖掘算法中基于FP-树的FP-Growth挖掘算法在挖掘频繁模式的过程中需要递归产生大量的条件FP—树,效率不高,FP-Growth算法不太适合应用到入侵中多种要素交叉的关联关系的挖掘中.因为入侵的方法及要素很多,在检测中需要对入侵样本进行条件约束下的定量分析.文中分析入侵检测的特点,提出基于条件频繁项的频繁模式树CP-Tree以及在此树挖掘的改进算法MineCPT.分析与实验结果表明,MineCPT算法在效率和可靠性等方面比FP-Growth 算法更优越,在入侵检测中取得了较好的效果.