基于聚集矩陣的審計(jì)日志關(guān)聯(lián)規(guī)則更新算法

針對(duì)審計(jì)日志記錄的特性，本文提出了一種基于聚集信息矩陣的高效增量式關(guān)聯(lián)規(guī)則的挖掘算法，并解決了當(dāng)最小支持度改變以及審計(jì)數(shù)據(jù)動(dòng)態(tài)更新時(shí)相應(yīng)的關(guān)聯(lián)規(guī)則的更新問題。算法提高了審計(jì)日志數(shù)據(jù)庫關(guān)聯(lián)規(guī)則挖掘的效率，更加適用于入侵檢測系統(tǒng)，能基本滿足實(shí)時(shí)入侵檢測系統(tǒng)的需要。
關(guān)鍵詞：入侵檢測；關(guān)聯(lián)規(guī)則挖掘；聚集信息矩陣；關(guān)聯(lián)向量
Abstract: Corresponding to characteristic of the audit record, this paper proposes a high efficiency incremental association mining algorithm based on information collecting matrix. The algorithm resolve the problem that how to update the association rules in a database when minimum support changed or new transactions are added to the database. The algorithm improves the efficiency of the association mining, can fulfill the request if the real time system and apply to intrusion detection system.
Key words: Intrusion detection; Association mining; Information collecting matrix; Association vector