Research Of Campus Network Security Audit System Based On Association Rules Algorithm

The rapid development of computer network makes data sharingapplication become more and more widespread. Meanwhile, the manage?ment of database system is more and more difficult. As one of theimportant mechanisms implementing network information security,security audit has a significant effect on establishing a set of networksecurity assurance system. However, there are some problems intraditional security audit system, such as low rate of accuracy, slow speedand poor self-adaptability. In order to solve these problems, there haspresented network security audit system based on data mining in recentyears. Data mining is a new developing and advanced intelligent datumanalytical method, which are used widely within short time. It aims atdrawing hidden prediction information from a large number of data,digging the potential mode among the data, finding out the informationwhich is otfen been neglected, and then presents the information to usersin an easy understanding way, so that it improves security audit efficiencydistinctly. So research of data mining applying in security audit systemhas the important theory and the practical signiifcance.The thesis firstly studies the current state and development trend innetwork security audit system and data mining technology. It is focusedon the algorithm of association rules, and proposes a new algorithm formining patterns based on mark FP-tree.Main achievement of the thesis is as follows: firstly, network secuiryaudit and data mining technology are studied. It finds out the combinationbetween data mining and network security audit in technology, and thesecurity audit system based on data mining is set up; secondly, we focuson the algorithm of association rules and study Apriori and FP-Growthalgorithm which have been proved to be efficient to mine associationrules. For the question that these two algorithms exist, an improvedalgorithm based on mark FP-tree is proposed. This algorithm adds markbits in each node of the FP-tree, and uses mark bits for tagging theprocessing nodes on original FP-Growth at every operation process, andthus it doesn’t need additional memory space to produce condition pattern trees, so it saves memory space and improves time efficiency greatly;Thirdly, the improved algorithm is used in network security audit systemand has realized the detection of unusual behaviors and attack, andimproves the speed of audit and the rate of accuracy.Because both data mining and network security audit system basedon data mining are focused on at present, the thesis proposes a provedalgorithm which is applied to network security audit system based on datamining. It proves through practice that the improved algorithm is supeirorto original FP-Growth both in time and space performance and has a goodscalability.