Research On Technique Of The Network Security Audit Based On Association Rule

Network Security Audit is an important factor of security management, it record the action of user in this system. At present, the character-detected are widely used in the Security Audit system, but this technique depends on the pattern stored, and renovate of pattern are difficult. It is difficult to detect the new types attack by old pattern, so there are more and more wrong alert. And along with the dissemination of Network the amount of information are increasing frequently. There are large numbers of unnecessary information in the information of Audit. The efficiency of Security Audit is very poor.This thesis produces a new mode that combines the association rule and Security Audit. During the time of analyzing, the new rule could be discovered, and the wrong alert is less and less. The similitude is introduced to detect the especial information that is different from any rule. In this way, the underlying attack is reduced. This thesis introduced a project that combine the Security Audit and association rule. The feasibility of this project is proved by theory and experiment. And this new way is better than the old character-detected way.