An event prediction approach based on event correlations

摘要

Event prediction is very import for computer security. If a fault is predicted to occur according to some rules, administrators can do something to deal with the fault. In this paper, an event prediction approach based on event correlations is proposed. As events are recorded by logs in chronological order, the classic Apriori algorithm can't be used to analyze these events directly [1]. We improve the algorithm for adapting the correlation mining of the orderly events with probability theory. A newmethod named First Event Front Limit is proposed to deal with the problem caused by time-window overlap. We also present a tree-structure based method for fast predicting events. The experimental results show that our approach can greatly improve the efficiency and precision of event prediction.