Intrusion Detection System Based On Data Mining

Xiuqiao Wang
Department of Computer Science
University of Jining
Qufu, China
wangxiuqiao@sina.com.cn


Abstract—In this paper, Data Mining is introduced into the 㾘᳔߭߱ᰃ㹿⫼Ѣߚᵤ䅵ㅫᴎ㔥㒰Ёⱘ᭄᥂⌕ⱘˈ᥹ⴔᇚ
Intrusion Detection System, which overcomes the defects of ݇㘨㾘߭ⱘᣪᥬ㒧ᵰ԰Ўᣪᥬⱘ䕧᭄ܹ᥂ˈҹ֓㛑ᣪᥬߎ
traditional detection technology. The nuclear association rules
algorithm applied to the intrusion detection matrix is optimized, ᳈᳝⫼ⱘ㒧ᵰDŽШ⊏ṙỂ໻ᄺⱘⷨথҎਬথሩњ݇㘨ᣪᥬ
which make it possible to reduce the Average-Case Time ೼ܹ։Ẕ⌟ᮍ䴶ⱘ䞡㽕ᑨ⫼ˈᑊϨᦤߎњϔ⾡ᮄൟⱘᑨ⫼
Complexity, improve the efficiency considerably, and make it Ѣ ᓖ ᐌ Ẕ⌟ ⱘ ໮ 䞡Ẕ ⌟ ᮍ⊩ DŽ Ҫ Ӏⱘ ⷨ お ៤ᵰ Џ 㽕೼
easy to process magnanimity data. In this way, attacks will be $'$0$XGLW 'DWD $QDO\VLV DQG 0LQLQJ ㋏ 㒳 Ё ᕫ ࠄ ᑨ
detected promptly to achieve the goal of intrusion detection.
Finally, the mining of normal connection rules in the knowledge ⫼ˈᑊϨᅲ偠㒧ᵰⳌᔧⱘ⧚ᛇDŽ$'$0 ㋏㒳೼  ᑈ
base of intrusion detection matrix will be accomplished. The '$53$ ܹ։Ẕ⌟㋏㒳䆘ԄЁ೼ᭈԧᮍ䴶ৡ߫㄀ϝˈ೼ᬏߏ
experiment indicates that the matrix is able to generate new rules Ẕ⌟㊒⹂ᗻᮍ䴶ԡѢ㄀ѠԡDŽҢℸҹৢ෎Ѣ݇㘨㾘߭ᣪᥬ
after extracting features, and also proves the validity and the
ⱘܹ։Ẕ⌟㹿ᑓ⊯ⷨおˈপᕫњࠡ᠔᳾᳝ⱘⷨお៤ᵰDŽ
feasibility of the IDS.
III. ݇㘨㾘߭ߚᵤঞ݊ㅫ⊩ⱘᬍ䖯
Keywords- Intrusion detection˗Data mining˗Association rules˗
>@
Apriori algorithm ݇㘨㾘߭ߚᵤ ᰃᣛ೼᭄᥂䆄ᔩⱘ᭄᥂乍П䯈ᣪᥬ݇
㘨݇㋏ˈᶤѯ᭄᥂乍ⱘߎ⦄乘⼎ⴔ䆹䆄ᔩЁ݊ᅗϔѯ᭄᥂
I. ᓩ㿔 乍ߎ⦄ⱘৃ㛑DŽ݇㘨ߚᵤⱘⳂⱘᰃҢᏆⶹⱘџࡵ䲚 5 Ёˈ
䱣ⴔ䅵ㅫᴎ੠㔥㒰ᡔᴃⱘ催䗳থሩˈ䅵ㅫᴎ੠㔥㒰෎ ѻ⫳᭄᥂乍䲚П䯈ⱘ݇㘨㾘ֱ߭䆕݊ᬃᣕᑺ੠㕂ֵᑺ໻
⸔䆒ᮑ៤Ў咥ᅶᬏߏⱘ䞡⚍ⳂᷛDŽ㱑✊䰆☿๭ㄝᡔᴃ㛑೼ Ѣ⫼᠋乘‫ܜ‬ᣛᅮⱘ᳔ᇣᬃᣕᑺ੠᳔ᇣ㕂ֵᑺDŽ$SULRUL ㅫ
ϔᅮ⿟ᑺϞ䘣ࠊ㔥㒰ᬏߏˈԚᰃ⬅Ѣ䖭ѯᡔᴃ䛑ᰃ䴭ᗕ ⊩ᰃ݇㘨㾘߭ᣪᥬЁⱘ㒣‫݌‬ㅫ⊩ПϔDŽ$SULRUL ㅫ⊩ⱘḌ
ⱘ ˈ ᕜ དⱘ ᅲ ᮑ ᳝ᬜ 䰆 ᡸᰃ ᮴ ⊩ ᅲ⦄ ⱘ DŽ Ԛܹ ։ Ẕ⌟ ᖗ‫ݙ‬ᆍᰃ෎Ѣ乥㐕乍䲚⧚䆎ⱘ䗦᥼ᮍ⊩DŽ䖭ᰃϔϾ෎Ѣϸ
,QWUXVLRQ'HWHFWLRQᡔᴃ>@ ᰃϔ⾡ࡼᗕⱘ䰆ᡸ᥾ 䰊↉乥㐕䲚ᗱᛇⱘᮍ⊩ˈᇚ݇㘨㾘߭ᣪᥬㅫ⊩ⱘ䆒䅵ߚ㾷
ᮑˈᅗ㛑໳ᇍ㔥㒰ᅝܼᅲᮑⲥ᥻ǃᬏߏϢডᬏߏㄝࡼᗕֱ ЎϸϾᄤ䯂乬˖
ᡸˈ೼ᶤ⾡ᛣНϞᓹ㸹њӴ㒳䴭ᗕㄪ⬹ⱘϡ䎇DŽ᭄᥂ᣪᥬ ೼䖭䞠៥Ӏᡞᬃᣕᑺ໻Ѣ᳔ᇣᬃᣕᑺⱘ᠔᳝乍
>@г⿄Ў᭄᥂ᑧЁⱘⶹ䆚থ⦄ᡔᴃ.''ˈᰃᣛҢ໻䞣ǃ  LWHPVHW 䛑 ᡒ ࠄ ˈ 䖭 ѯ 乍 䲚 㹿 ি ԰  乥 䲚 IUHTXHQW
ϡᅠܼǃ᳝ాໄǃ῵㊞ǃ䱣ᴎⱘ᭄᥂Ёথ⦄䱤৿᭄᥂Ёⱘ LWHPVHW
݇㋏ˈᓎゟ῵ൟˈᦤপ‫݋‬᳝┰೼Ӌؐǃৃֵǃᮄ乪ǃ᳝ᬜ ᥹ⴔՓ⫼Ϟϔℹᡒࠄⱘ乥䲚ᴹѻ⫳ᳳᳯⱘ㾘߭DŽ
ᑊ㛑㹿Ҏ᠔⧚㾷ⱘֵᙃ੠ⶹ䆚ⱘ䖛⿟DŽᑨ⫼Ѣܹ։Ẕ⌟ⱘ $SULRUL ㅫ⊩Փ⫼ⱘᮍ⊩㹿⿄԰䗤ሖ᧰㋶ⱘ䗁ҷᮍ
᭄᥂ᣪᥬߚᵤᮍ⊩>@Џ㽕᳝˖݇㘨ߚᵤᮍ⊩ǃᯊᑣ῵ᓣ ⊩ˈN乍䲚⫼Ѣএ᥶㋶N乍䲚DŽ佪‫ˈܜ‬ᡒߎ乥㐕 
ߚᵤᮍ⊩ǃߚ㉏ߚᵤᮍ⊩੠㘮㉏ߚᵤᮍ⊩ㄝDŽᇚ᭄᥂ᣪᥬ 乍䲚ⱘ䲚ড়䆹䲚ড়䆄԰ /DŽ/ ⫼Ѣᡒ乥㐕 乍䲚ⱘ䲚
ᡔᴃᑨ⫼Ѣܹ։Ẕ⌟㋏㒳Ёৃҹᅠ៤Ң໻䞣᭄᥂Ё㞾ࡼᦤ
ড় /ˈ/ ⫼Ѣᇏᡒ /ˈབℸϟএˈⳈࠄϡ㛑ᡒࠄ乥㐕 N
পߎ῵ൟⱘ䖛⿟DŽᡞ᭄᥂ᣪᥬᑨ⫼Ѣܹ։Ẕ⌟ᡔᴃЁህ
乍䲚DŽᡒ↣ϔϾ /N 䳔㽕ϔ⃵᭄᥂ᑧᠿᦣDŽЎ‫ޣ‬ᇥᠿᦣⱘ
ৃҹ೼ᓎゟᬏߏẔ⌟㋏㒳䖛⿟Ёˈህৃҹ⍜䰸ҎЎ಴㋴੠
⃵᭄ˈᇍ↣Ͼ乥䲚䌟ϔϾ৥䞣ᔧ⬅䭓ᑺЎ W ⱘ乥䲚ѻ⫳
⡍ᅮ಴㋴ⱘᑆᡄˈЎ݊ᓔথϔϾ᳈ࡴ㋏㒳࣪ⱘᮍ⊩DŽ䖭ᰃ
䭓ᑺЎ W ⱘ乥䲚ᯊˈህϡ䳔㽕‫ݡ‬ᠿᦣ᭄᥂ᑧˈা䳔೼Ϣ
ᴀ᭛ゴ᠔䆎䗄ⱘḌᖗ‫ݙ‬ᆍDŽ
᪡԰ৢ䅵ㅫ↣ϾѠ䖯ࠊԡϞ  ⱘϾ᭄ህৃҹᕫࠄ䆹ሲᗻ䲚
ড়೼᭄᥂ᑧЁߎ⦄ⱘ⃵᭄ˈ೼䅵ㅫϞ䗄ⱘ乥䲚ⱘᬃᣕᑺϞ
II. ෎Ѣ݇㘨㾘߭ⱘܹ։Ẕ⌟ᡔᴃ
໻໻‫ޣ‬ᇥњᠿᦣ᭄᥂ᑧ᠔⫼ⱘᯊ䯈DŽᬍ䖯ৢⱘㅫ⊩˖
೼ӫ໮ⱘ㔥㒰ܹ։Ẕ⌟㋏㒳Ёˈৃҹ⫼ⳌѦ݇㘨ⱘߚ 䕧ܹ˖㒣䖛Ꮧᇨ࣪ⱘ᭄᥂ᑧ 5᳔ᇣᬃᣕ䯜ؐ PLQBVXS
ᵤᮍ⊩ᶹߎ৘⾡㸠ЎП䯈ⱘⳌ݇㘨ᗻDŽҢ㗠ᕫߎᰃ৺᳝ܹ 䕧ߎ˖/Mˈ5 Ёⱘ乥㐕乍䲚DŽ
։㸠ЎDŽ݇㘨㾘߭ᣪᥬᰃ᭄᥂ᣪᥬ᳔Ўᑓ⊯ᑨ⫼ⱘᡔᴃП / ILQGBIUHJXHQWBBLWHPVHW5
ϔˈгᰃ᳔ᮽ⫼Ѣܹ։Ẕ⌟ⱘᡔᴃDŽ⦄೼Ꮖ᳝໮⾡݇㘨㾘 IRUN /NĮN^
߭ㅫ⊩ˈ՟བ $SULRULㅫ⊩>@ህ㹿⫼Ѣܹ։Ẕ⌟DŽ݇㘨

978-1-4244-9763-8/11/$26.00 ©2011 IEEE

3306
 &N DSULRULBJHQ/NPLQBVXS ೒  ෎Ѣ᭄᥂ᣪᥬⱘܹ։Ẕ⌟῵ൟ
IRUHDFKDę&N
ℸ῵ൟࣙᣀ᭄᥂䞛䲚ǃ᭄᥂乘໘⧚ǃ᭄᥂ᣪᥬㅫ⊩ঞ
IRUHDFKSę/N Tę/N
ᇍ䴲ℷᐌ῵ഫⱘ໘⧚ㄝDŽ
LIST D
䆹ܹ։Ẕ⌟῵ൟⱘᎹ԰ॳ⧚ᰃᇍ㔥㒰Ϟᤩ㦋ࠄⱘॳ
IRUM MQM
ྟ㔥⋯᭄᥂ˈ䳔㽕‫ܜ‬䖯㸠乘໘⧚ˈᑊϨֱᄬࠄॳྟᅵ䅵᭄
P>M@ S>M@
T>M@
᥂ᑧЁˈᔶ៤ᅵ䅵᭄᥂DŽ᭄᥂ᣪᥬᓩ᪢߽⫼ᣪᥬㅫ⊩ᑧЁ
LIP>M@ PFRXQW
ⱘㅫ⊩ᇍ䆁㒗᭄᥂䖯㸠ᣪᥬˈᦤপߎ݊⡍ᕕ੠῵ᓣˈֱᄬ
LIPFRXQW! PLQBVXS
ࠄⶹ䆚ᑧЁ˗ᇍᔧࠡⱘܹ։㸠Ў䖯㸠⡍ᕕᢑপǃ݇㘨ˈ䱣
,QVHUWBLQWRB/NW
ৢϢⶹ䆚ᑧЁⱘ῵ᓣ䖯㸠ᇍ↨ˈ‫؛‬བᰃℷᐌ῵ᓣ䙷Мህ㒻
`
㓁䖯㸠᭄᥂ᤩ㦋ˈ৺߭䕀৥‫އ‬ㄪ῵ഫDŽ‫އ‬ㄪ῵ഫ䋳䋷ᇍ䴲
UHWXUQ/ DĤ/N 
ℷᐌ῵ᓣ䖯㸠ᑨᗹ໘⧚DŽ
ㅫ⊩ⱘℹЎᬍ䖯П໘ˈᇍѢ䖲᥹᠔៤ D ⱘ
/N Ёⱘϸ৥䞣䅽݊䗤‫ܗ‬㋴ⳌϢˈ㒧ᵰ৥䞣Ё  ⱘϾ᭄ B. ෎ѢϞ䗄῵ൟⱘ᭄᥂ᣪᥬܹ։Ẕ⌟㋏㒳‫݋‬᳝ҹϟ޴⚍
ेЎ D ⱘᬃᣕᑺˈབᵰ䆹ᬃᣕᑺ໻Ѣ PLQBVXSˈ߭ᇚ݊⏏ Ӭ⚍˖
ࡴࠄ /N Ёˈߑ᭄ ,QBLQWRB/NPेᅲ⦄䆹⏏ࡴࡳ㛑DŽ
ᬍ䖯ৢⱘㅫ⊩ⱘ ,2 ᓔ䫔⧚䆎Ϟৃҹ‫ޣ‬ᇥ乥䲚ⱘ㓈᭄
⃵DŽ乘໘⧚ৢⱘ᭄᥂ᰃ⾏ᬷ࣪ⱘ䖯㸠ⱘᰃ৥䞣Ϣǃ៪䖤
ㅫˈ೼ㅫ⊩ⱘᠻ㸠䖛⿟Ёⱘᯊ䯈໡ᴖᑺ↨ॳㅫ⊩ᅗᬍ䖯ㅫ
⊩㽕ᇥ  ࠄ  ‫ⱘס‬ᯊ䯈DŽ⬅Ѣ䞛⫼Ѡ乘໘⧚⾏ᬷ࣪ⱘ
᭄᥂䞛⫼ⱘᰃѠ䖯ࠊ᭄᥂ⱘ  ੠ ˈᄬ‫ټ‬Ѣ‫ݙ‬ᄬЁˈ㋏㒳
㞾䑿ⱘ‫ݙ‬ᄬ⍜㗫㛑໳⒵䎇DŽ‫؛‬䆒ॳྟ᭄᥂᳝  ϛϾॳ
ྟ᭄᥂ˈ໘⧚ৢⱘ᭄᥂೼‫ݙ‬ᄬЁᠡ 0DŽぎ䯈໡ᴖᑺ๲
ࡴϡ໻DŽ
IV. ෎Ѣ᭄᥂ᣪᥬⱘ㔥㒰ܹ։Ẕ⌟㋏㒳῵ൟ
A. ܹ։Ẕ⌟῵ൟⱘᓎゟ
᭄᥂ᣪᥬ೼ܹ։Ẕ⌟Ёⱘᑨ⫼ˈЏ㽕ᰃ߽⫼᭄᥂ᣪᥬ
Ёⱘ᭄᥂ߚ㉏ǃ݇㘨ߚᵤ੠ᑣ߫῵ᓣᣪᥬˈᇍߎ㞾ϡৠ᭄
᥂⑤ⱘᅝܼᅵ䅵᭄᥂䖯㸠ᱎ㛑࣪ⱘߚᵤ໘⧚ˈ䗮䖛ᦤপ᭄
᥂ᴀ䑿ᄬ೼ⱘ㾘ᕟᗻˈᐂࡽ㋏㒳⫳៤ܹ։Ẕ⌟㾘߭੠ᓎゟ
ᓖᐌẔ⌟῵ൟˈ᳔໻䰤ᑺⱘ䰡Ԣ೼໘⧚ᅝܼᅵ䅵᭄᥂ᯊᇍ
‫ܜ‬偠ⶹ䆚ⱘ㽕∖DŽ݇㘨ߚᵤㅫ⊩ৃ⫼Ѣᣪᥬᦣ䗄ܹ։㸠Ў
῵ᓣⱘ݇㘨㾘߭DŽ䗮䖛䖭ѯ㾘߭䖯㸠ܹ։Ẕ⌟DŽ݊ᗱᛇ
˄˅ᱎ㛑ᗻདˈ㞾ࡼ࣪⿟ᑺ催˖
಴Ў᭄᥂ᣪᥬ䖭⾡ᮍ⊩ৃҹ‫⫼߽ߚܙ‬ᣪᥬㅫ⊩ᑧЁⱘ
ㅫ⊩㞾ࡼഄҢ᭄᥂ᑧЁᦤপߎ᭄᥂䖯㸠ᣪᥬˈথ⦄њⳈ᥹
⫼㙝ⴐ䲒ҹথ⦄ⱘ䴲ℷᐌ㔥㒰㸠Ў῵ᓣˈҢ㗠‫ޣ‬ᇥњҎᎹ
ⱘⳈ᥹খϢˈ‫ޣ‬䕏њܹ։Ẕ⌟ߚᵤਬⱘ䋳ᢙˈৠᯊᦤ催њ
Ẕ⌟ⱘ‫⹂ޚ‬ᗻ˗
˄˅Ẕ⌟ᬜ⥛催˖᭄᥂ᣪᥬৃҹ㞾ࡼഄᇍ᭄᥂乘໘
⧚໘⧚Ёⱘ᳝⫼䚼ߚ䖯㸠᭄᥂໘⧚ˈ᳝ᬜഄ‫ޣ‬ᇥ᭄᥂໘⧚
䞣ˈ಴㗠Ẕ⌟ᬜ⥛催DŽ
˄˅㞾䗖ᑨ㛑࡯ᔎ˖಴Ўৃҹ䱣ᯊҢ㔥㒰Ϟ㦋প᠔
䳔㽕ⱘ᭄᥂ˈঞᯊ䖯㸠ᖙ㽕ⱘ໘⧚ˈ᠔ҹ㞾䗖ᑨ㛑࡯ᔎˈ
ৃҹ᳝ᬜഄẔ⌟ߎᏆⶹᬏߏⱘব⾡ҹঞߎᙃⱘᮄൟᬏߏ˗
˄˅㰮᡹⥛Ԣ˖᭄᥂ᣪᥬ䖭⾡ᮍ⊩ৃҹ᳝ᬜഄࠨ䰸
ᥝ䞡໡ߎ乍ⱘᬏߏˈ಴㗠‫݋‬᳝䕗Ԣⱘ㰮᡹⥛DŽ
V. ෎ѢϞ䗄῵ൟⱘՓ⫼ᬍ䖯ⱘ݇㘨㾘߭ⱘܹ։Ẕ⌟㋏
㒳ⱘᅲ⦄
⫼Ѣܹ։Ẕ⌟ⱘᅲ偠ᴤ᭭ᴹ㞾 .''&83 ܹ։Ẕ
⌟䌘᭭䲚DŽᇚ NGGFXS ᭄᥂䲚Ёⱘ ⱘ᭄᥂㑺  ϛ
ᴵ䆄ᔩЁ䱣ᴎᢑপⱘⱘℷᐌ䖲᥹䆄ᔩ԰Ў䆁㒗䲚ˈ߽⫼
ᰃ˖Ңᅵ䅵᭄᥂៪᭄᥂⌕Ёᦤপᛳ݈䍷ⱘⶹ䆚ˈ䖭ѯⶹ䆚
㘮㉏ߚᵤЁⱘ .PHDQV ㅫ⊩ᇍ䆹䆁㒗䲚䖯㸠乘໘⧚ˈ✊ৢ
ᰃ䱤৿ⱘǃџ‫ܜ‬᳾ⶹⱘ┰೼᳝⫼ֵᙃDŽᦤপⱘⶹ䆚㸼⼎Ў
⫼ᬍ䖯ⱘ $SULRUL ㅫ⊩ᇍ乘໘⧚ৢⱘ᭄᥂䖯㸠݇㘨ᣪᥬˈ
ὖᗉǃ㾘߭ǃ㾘ᕟǃ῵ᓣㄝᔶᓣˈᑊ⫼Ϟ䗄ҟ㒡ⱘ䖭ѯ⧚
ᕫߎℷᐌ䖲᥹㾘߭DŽ‫⫼߽ݡ‬䖭ѯ㾘߭ᇍ㔥㒰䖲᥹䆄ᔩ䖯㸠
䆎ⶹ䆚এẔ⌟ᓖᐌܹ։੠Ꮖⶹⱘܹ։DŽ
߸ᮁˈབᵰᰃℷᐌ῵ᓣህ㒻㓁䖯㸠᭄᥂ᤩ㦋৺߭䕀৥‫އ‬
෎Ѣ᭄᥂ᣪᥬⱘ᭄᥂῵ൟབϟ೒  ᠔⼎˖
ㄪ῵ഫDŽ‫އ‬ㄪ῵ഫ䋳䋷ᇍ䴲ℷᐌ῵ᓣ䖯㸠ᑨᗹ໘⧚DŽ
᭄᥂䞛䲚 䞛⫼ $SULRUL ⱘᬍ䖯ㅫ⊩ᡒߎ乥㐕乍䲚ˈᑊ⬅乥㐕乍
䲚ѻ⫳݇㘨㾘߭DŽᅲ偠Ёᬃᣕᑺ䆒ᅮЎˏˈৃֵᑺЎ 
ᰃ ᭄᥂ᣪᥬㅫ⊩
᭄᥂乘໘⧚ ˒݅ᕫࠄњ ˎˍᴵ㾘߭㾘߭ᔶᓣབϟ˖
ᑧ
QRUPDO ĕ VPWS WFS FRXQWBO VUYBFRXQWB
ᣪᥬᓩ᪢ ⶹ䆚ᑧ 
ᅵ䅵䆄ᔩ
Ϟ䗄㾘߭ⱘ৿НЎ˖ᔧण䆂Ў WFSˈ᳡ࡵපЎ VPWS
ᑊϨ䖛এϸ⾦䩳‫ݙ‬䆓䯂ⱘⳂⱘッষ᭄䞣੠ⳂⱘⱘЏᴎ᭄䞣
䆁㒗᭄᥂䲚 ᇥˈ᳝߭ ⱘৃ㛑ᗻЎℷᐌ䖲᥹DŽ
‫އ‬ㄪ῵ഫ ៥Ӏᡞ≵᳝ᬍ䖯ࠡⱘㅫ⊩೼ᅲ偠Ёⱘᬃᣕᑺ‫؛‬䆒г䆒
ℷᐌ῵ᓣ 㕂ЎˏˈৃֵᑺЎ ˒ˈ߭ৃҹ݅⫳៤ ˏ㾘߭DŽ㗠ᬍ
৺ 䖯ৢⱘ $SULRUL ㅫ⊩⫳៤ⱘ ˎˍ㾘߭ህ᳝ ˎˌᴵࣙ৿
 ೼ᬍ䖯ࠡⱘㅫ⊩⫳៤ⱘ㾘߭ЁDŽ಴Ў䞛⫼ⱘ䆁㒗᭄᥂䲚ҙ

3307
᳝ .''&83 ܹ։Ẕ⌟᭄᥂䲚ⱘ ⱘ᭄᥂᠔ҹᓖᐌ
ⲥ⌟῵ഫᅲ⦄Ёⱘ䇃Ꮒ䛑೼ℷᐌⱘ㣗ೈ‫ݙ‬DŽᅲ偠䆕ᯢњᬍ
䖯ৢⱘㅫ⊩㛑໳ℷ⹂⫳៤㾘߭DŽᬍ䖯ৢⱘㅫ⊩䖤㸠ᯊ䯈੠
ᬍ䖯ࠡⱘㅫ⊩೼ৠϔৄ䅵ㅫᴎϞⱘ䖤㸠ᯊ䯈ߚ߿Ў  ߚ
 ⾦੠  ߚ˒⾦DŽ⬅ℸৃҹⳟߎ೼䖤㸠ᯊ䯈Ϟ᳝њᯢᰒ
㓽ⷁDŽҢ㗠ᦤ催њᬜ⥛DŽ
VI. 㒧ᴳ䇁
ᴀ᭛ᦤߎϔ⾡෎Ѣ᭄᥂ᣪᥬⱘܹ։Ẕ⌟῵ൟˈ݊Ḍᖗ
ᗱᛇᰃ߽⫼᭄᥂ᣪᥬⱘᮍ⊩ˈҢ㒣乘໘⧚ⱘᑊϨࣙ৿㔥㒰
䖲᥹ֵᙃⱘᅵ䅵᭄᥂Ёᦤপৃҹऎߚℷᐌ੠ܹ։ⱘ㾘߭ˈ
ᑊϨ⫼ᴹẔ⌟ᰃ৺᳝ܹ։㸠ЎDŽᑊᘏ㒧њᅗⱘӬ⚍DŽ䩜ᇍ
$SULRUL ㅫ⊩Ё∖乥㐕䲚ᯊᠿᦣ᭄᥂ᑧ ,2 䋳䕑᚞Ҏⱘ䯂
乬ᦤߎњϔ⾡ᬍ䖯ࡲ⊩DŽЎњ偠䆕䆹ㅫ⊩ⱘৃ㸠ᗻˈ೼᭛
ゴ᳔ৢᅲ⦄њ䆹ܹ։Ẕ⌟῵ൟⱘⶹ䆚ᑧЁℷᐌ䖲᥹㾘߭ⱘ
ᣪᥬDŽᅲ偠㸼ᯢ䆹῵ൟ㛑ᦤপ⡍ᕕ⫳៤ᮄ㾘߭ˈᑊ䆕ᯢњ
ᮍ⊩ⱘৃ㸠ᗻ੠᳝ᬜᗻDŽ
 [5]
㟈䇶
ᴀ䆎᭛㦋ᕫ  ᑈቅϰⳕᬭ㚆ख़㄀ϝᡍ⾥ᡔ䅵ߦ෎䞥
乍Ⳃ˄乍Ⳃৡ˖෎Ѣ㔥㒰㸠Ўⱘ㔥㒰⌟䞣ⷨおˈ乍Ⳃ㓪







3308
ো˖-/-˅੠⌢ᅕᄺ䰶  ᑈ᷵㑻෎䞥乍Ⳃ˄乍Ⳃ
ৡ˖෎Ѣ㔥㒰㸠Ўⱘ ,399 㔥㒰⌟䞣ᑨ⫼ⷨお乍Ⳃ㓪
ো˖.-/;˅ⱘ䌘ࡽˈৠᯊᛳ䇶৘ԡৠџ೼䆎᭛‫ݭ‬԰
䖛⿟Ё㒭ќⱘϧϮϞⱘᓎ䆂੠ᣛᇐDŽ᳔ৢᛳ䇶ᆊҎⱘᬃᣕ
Ϣ哧ࢅDŽ
5()(5(1&(6
[1] [1]LiuXiaoMing,XiongTao .Research on Intrusion Detection
Technology Based on Data Mining [J],Moderm Computer 2010ˈ (4)ˈ
78-79(In Chinese)
[2] [2]Yangxiangrong ,Songqinbao,Shenjunyi. Intelligentize Intrusion
Detection System BasedOn Data Mining [J] , Computer Engineering
2007, 27(9): 17-18, 102. (In Chinese)
[3] [3] WANG Jiamin; YAN Ren-wu; SHENG Ying-ying .Intrusion
Detection Technology Research Based on Data Mining [J] Science
technology and engineering, 2008,˄08˅(In Chinese)
[4] [4] Wangxuren,Xurongsheng.The research of association rule
mining.The fifth China Routh and software computer academic
conference collected papers: A collect[C].ChongQing: Computer
Science Publishing House, 2008(In Chinese)
Agrawal R, SrikantR. Fast Algorithms forMining Association Rules [A].
BoccaJB, JarkeM, ZanioloC. Proceedings of the 20th
InternationalConference on VeryLarge DatabaseBases(VLDB 94)[C].
CA:MorganKaufmann PublishersInc, 1994(10): 487-499.