Incremental Association Rule Mining Algorithm And Its Application In Intrusion Detection

Recently,intrusion detection gradually attracted attention in the field of network security, and becomes a hot area of network protection research. Association ruleis a typical method in a wide variety of intrusion detection methods,and it is also one of the most active research points. It has a high efficiency in data mining, and is easy to understand.At the beginning of the paper, a brief summary of data mining technology is introduced, including its definition, classification, architecture, as well as detection methods and technology point of intrusion detection.Then,the feasibility and necessity of data mining applied to intrusion detection is analyzed.This kind of interdisciplinary research is increasingly favored by researchers.We analyze the classic Apriori algorithm and the mining process based on the elaborating of the concept of association rules.we take the in-depth study of the improved algorithm of Apriori, PS interesting model, and found that this type of algorithm still have some shortcomings, such as repeatedly scanning the database, not taking into account the low general efficiency of the system handle incremental data mining process will generate too much redundant low quality of the rules, never taking into account the user’s experience, knowledge and expertise.To improve intrusion detection in the presence of the above problems, this paper combines the PSA interesting model and incremental list algorithm to be a new algorithm—PSAIL, this algorithm will be applied to the intrusion detection. PSAIL algorithm is based on a linked list structure, list structure storage data flexibility and it is easy to delete or insert operations characteristics.Finally in this paper, performance test and validation test are implemented.These tests indicated that the optimization strategy for traditional Apriori algorithm is feasible and effective. It is practical to apply PSAIL to intrusion detection, and this model has a better performancewhen dealing with incremental data.