Association Rule-based Intrusion Detection System Design And Realization

With the rapid development of the network in recent years, network security is becoming increasingly serious. Traditional network security technologies and intrusion detection technology have been unable to detect increasingly sophisticated network attacks. How to extract the characteristics of network intrusion, as well as how to identify a new type of network attack has become the main direction study of the current intrusion detection. Data mining technology is not only good at analyzing massive data, but also extracting the characteristics rules which hide behind the data. Data mining technology applies to network intrusion detection has more important value of results.Firstly,the concept, classification and research techniques of intrusion detection are described in detail in this paper, which presents current development trends and problems of intrusion detection. Furthermore, association rule is described which advantages and disadvantages are presented in this paper. And then, the performance evaluation of current intrusion detection system is introduced and the intrusion detection evaluation method based on newsboy model is proposed that the experiment proved its feasibility,and feedback control system is proposed which can optimize the rule base automatically. This paper focuses on that the distributed feedback control intrusion detection prevention system based on snort/bro is proposed, which makes up the shortcomings of snort of only detecting the invasion of the underlying network without high-levels. While achieving the application of double-rule base , which effectively improves the accuracy of association rules.Finally, the work is summarized and the efforts and innovation and deficiencies of this paper are pointed out.The efforts and innovations have made in this paper: improved association rule algorithm based on concept lattice is proposed; performance evaluation model of intrusion detection based on newsboy model and distributed feedback control intrusion detection prevention system based on snort/bro are proposed.