审计日志的关联规则挖掘

研究了在入侵检测系统中利用数据挖掘技术从审计日志中挖掘关联规则的方法，针对现有关联规则算法应用于入侵检测系统引起的问题，提出了利用本质属性限制无趣规则的产生、利用行向量的位运算提高Apriori算法时间性能的一种高效改进算法。该算法不需生成候选频繁集和剪枝操作，避免了因无趣规则引起的大量运算。因而能提高入侵检测系统的效率。

The mining of the association rules from auditing data

An investigation is made of the method for mining the association rules from the auditing log with the data mining technique in an intrusion detecting system. In view of the problems arising from the application of the existing algorithm for the association rules in the intrusion detecting system, a highly efficient algorithm for limiting the generation of rebuff rules and enhancement of the Apriori algorithm time performance using the bit operation of the row vector. With this algorithm, it is not necessary to generate the candidate frequency set and lopping operation, avoiding the large amount of operations due to the rebuff rules. Hence it improves efficiency of the intrusion detecting system.