基于改进Apriori算法的审计日志关联规则挖掘

doi:10.11772/j.issn.1001-9081.2016.07.1847

计算机应用 ›› 2016, Vol. 36 ›› Issue (7): 1847-1851.DOI: 10.11772/j.issn.1001-9081.2016.07.1847

基于改进Apriori算法的审计日志关联规则挖掘

徐开勇, 龚雪容, 成茂才

信息工程大学, 郑州 450001

收稿日期:2015-12-11 修回日期:2016-03-21 出版日期:2016-07-10 发布日期:2016-07-14
通讯作者: 成茂才
作者简介:徐开勇(1963-),男,河南郑州人,研究员,博士,主要研究方向:信息安全、可信计算;龚雪容(1975-),女,四川井研人,助理研究员,博士,主要研究方向:信息安全;成茂才(1991-),男,安徽芜湖人,硕士研究生,主要研究方向:信息安全。
基金资助:
国家自然科学基金资助项目（61072047）。

Audit log association rule mining based on improved Apriori algorithm

XU Kaiyong, GONG Xuerong, CHENG Maocai

Information Engineering University, Zhengzhou Henan 450001, China

Received:2015-12-11 Revised:2016-03-21 Online:2016-07-10 Published:2016-07-14
Supported by:
This work is partially supported by the National Natural Foundation of China (61072047).

摘要/Abstract

摘要： 针对安全审计系统中存在的智能程度低、日志信息没有充分利用的问题，提出一个基于关联规则挖掘的安全审计系统。该系统充分利用已有审计日志，结合数据挖掘技术，建立用户及系统的行为模式数据库，做到及时发现异常情况，提高了计算机的安全性。在传统Apriori算法的基础上提出一种改进的E-Apriori算法，该算法可以缩小待扫描事务集合的范围，降低算法的时间复杂度，提高运行效率。实验结果表明基于关联规则挖掘的审计系统对攻击类型的识别能力提升在10%以上，改进的E-Apriori算法相比经典Apriori算法和FP-GROWTH算法在性能上得到了提高，特别是在大型稀疏数据集中最高达到51%。

关键词: 安全审计系统, 审计日志, 数据挖掘, 关联规则挖掘, Apriori算法

Abstract: Aiming at the problem of low-level intelligence and low utilization of audit logs of the security audit system, a secure audit system based on association rule mining was proposed. The proposed system was able to take full advantage of the existing audit logs and establish the behavior pattern database of users and the system with data mining technique. The abnormal situation was discovered in a timely manner and the security of computer system was improved. An improved E-Apriori algorithm was proposed which could narrow the scanning range of the set of transactions, lower the time complexity, and refine the operating efficiency. The experimental results indicate that the lift of recognition capability to identify the type of attack can reach 10% in the secure audit system based on association rule mining, the proposed E-Apriori algorithm clearly outperforms the traditional Apriori algorithm and FP-GROWTH algorithm, and the maximum increase can reach 51% especially in the large sparse datasets.

Key words: security audit system, audit log, data mining, association rule mining, Apriori algorithm

中图分类号:

TP391.4

徐开勇, 龚雪容, 成茂才. 基于改进Apriori算法的审计日志关联规则挖掘[J]. 计算机应用, 2016, 36(7): 1847-1851.

XU Kaiyong, GONG Xuerong, CHENG Maocai. Audit log association rule mining based on improved Apriori algorithm[J]. Journal of Computer Applications, 2016, 36(7): 1847-1851.

参考文献

[1] 石文昌,孙玉芳.安全操作系统研究的发展[J].计算机科学,2002,29(6):5-12.(SHI W C, SUN Y F. Development of secure operating system research[J]. Computer Science, 2002, 29(6):5-12.)
[2] 丁丽萍,周博文,王永吉.基于安全操作系统的电子证据获取与存储[J].软件学报,2007,18(7):1715-1729.(DING L P, ZHOU B W, WANG Y J. Capture and storage of digital evidence based on security operating system[J]. Journal of Software, 2007, 18(7):1715-1729.)
[3] 刘海峰,卿斯汉.安全操作系统审计的设计与实现[J].计算机研究与发展,2001,38(10):1262-1268.(LIU H F, QING S H. Design and realization of auditing in secure OS[J]. Journal of Computer Research and Development, 2001, 38(10):1262-1268.)
[4] MORADI M, KEYVANPOUR M R. An analytical review of XML association rules mining[J]. Artificial Intelligence Review, 2015, 43(2):277-300.
[5] SONG S J, KIM E H, KIM H G, et al. Query-based association rule mining supporting user perspective[J]. Computing, 2011, 93(1):1-25.
[6] AGRAWAL R, SRIKANT R. Fast algorithms for mining association rules[C]//Proceedings of the 20th International Conference on Very Large Data Bases. San Francisco, CA:Morgan Kaufmann, 1994:21-30.
[7] AGRAWAL R, IMIELINSKI T SWAMI A. Mining association rules between sets of items in large databases[J]. ACM SIGMOD Record, 1993, 22(2):207-216.
[8] HAN J, PEI J, YIN Y. Mining frequent patterns without candidate generation[J]. ACM SIGMOD Record, 2000, 29(2):1-12.
[9] EL-HAJJ M, ZAIANE O R. COFI approach for mining frequent itemsets revisited[C]//Proceedings of the 2004 ACM SIGMOD Workshop on Research Issues in Data Mining and Knowledge Discovery. New York:ACM, 2004:70-75.
[10] DONG G L, RYU K S, BASHIR M, et al. Discovering medical knowledge using association rule mining in young adults with acute myocardial infarction[J]. Journal of Medical Systems, 2013, 37(2):1-10.
[11] KHALILI A, SAMI A. SysDetect:a systematic approach to critical state determination for industrial intrusion detection systems using Apriori algorithm[J]. Journal of Process Control, 2015, 2776:154-160.
[12] SAHOO J, DAS A K, GOSWAMI A. An effective association rule mining scheme using a new generic basis[J]. Knowledge and Information Systems, 2015, 43(1):127-156.
[13] KESHAVAMURTHY B N, KHAN A M, TOSHNIWAL D. Privacy preserving association rule mining over distributed databases using genetic algorithm[J]. Neural Computing & Applications, 2013, 22(Supplement 1):351-364.
[14] ROZENBERG B, GUDES E. Association rules mining in vertically partitioned databases[J]. Data & Knowledge Engineering, 2006, 59(2):378-396.
[15] DING Y, YUAN X, TANG K, et al. A fast malware detection algorithm based on objective-oriented association mining[J]. Computers & Security, 2013, 39(4):315-324.
[16] GARCKE J, GRIEBEL M. On the parallelization of the sparse grid approach for data mining[C]//LSSC 2001:Proceedings of the Third International Conference on Large-Scale Scientific Computing, LNCS 2179. Berlin:Springer, 2001:22-32.
[17] CZIBULA G, MARIAN Z, CZIBULA I G. Detecting software design defects using relational association rule mining[J]. Knowledge and Information Systems, 2015, 42(3):545-577.
[18] HILLS J, BAGNALL A, IGLESIA B D L, et al. BruteSuppres-sion:a size reduction method for Apriori rule sets[J]. Journal of Intelligent Information Systems, 2013, 40(3):431-454.
[19] LIPPMANN R, HAINES J W, FRIED D J, et al. The 1999 DARPA off-line intrusion detection evaluation[J]. Computer Networks, 2000, 34(4):579-595.

基于改进Apriori算法的审计日志关联规则挖掘

Audit log association rule mining based on improved Apriori algorithm

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

[1]	刘世泽, 秦艳君, 王晨星, 苏琳, 柯其学, 罗海勇, 孙艺, 王宝会. 基于深度残差长短记忆网络交通流量预测算法[J]. 计算机应用, 2021, 41(6): 1566-1572.
[2]	李旭娟, 皮建勇, 黄飞翔, 贾海朋. 基于自生成深度神经网络的4D航迹预测[J]. 计算机应用, 2021, 41(5): 1492-1499.
[3]	陈凯, 于彦伟, 赵金东, 宋鹏. 基于城市交通监控大数据的工作位置推理方法[J]. 计算机应用, 2021, 41(1): 177-184.
[4]	龙洋洋, 陈玉玲, 辛阳, 豆慧. 基于联盟区块链的安全能源交易方案[J]. 计算机应用, 2020, 40(6): 1668-1673.
[5]	杜旭升, 于炯, 叶乐乐, 陈嘉颖. 基于图上随机游走的离群点检测算法[J]. 计算机应用, 2020, 40(5): 1322-1328.
[6]	徐周波, 杨健, 刘华东, 黄文文. 基于XGBoost与拓扑结构信息的蛋白质复合物识别算法[J]. 计算机应用, 2020, 40(5): 1510-1514.
[7]	马董, 陈红梅, 王丽珍, 肖清. 空间亚频繁co-location模式的主导特征挖掘[J]. 计算机应用, 2020, 40(2): 465-472.
[8]	陈曦, 梅广, 张金金, 许维胜. 融合知识图谱和协同过滤的学生成绩预测方法[J]. 计算机应用, 2020, 40(2): 595-601.
[9]	李莎莎, 梁冬阳, 余杰, 纪斌, 马俊, 谭郁松, 吴庆波. 基于师门关系的研究团队挖掘算法[J]. 计算机应用, 2020, 40(11): 3198-3202.
[10]	孙鹤立, 张优优, 杨洲, 何亮, 贾晓琳. 基于时间线段树的城市可达区域搜索[J]. 计算机应用, 2020, 40(10): 2936-2941.
[11]	李博, 张晓, 颜靖艺, 李可威, 李恒, 凌玉龙, 张勇. 基于值差度量和聚类优化的K最近邻算法在银行客户行为预测中的应用[J]. 计算机应用, 2019, 39(9): 2784-2788.
[12]	纪丽娜, 陈凯, 于彦伟, 宋鹏, 王淑莹, 王成锐. 基于城市交通大数据的车辆类别挖掘及应用分析[J]. 计算机应用, 2019, 39(5): 1343-1350.
[13]	于永斌, 戚敏惠, 尼玛扎西, 王琳. 基于阈值自适应忆阻器Hopfield神经网络的关联规则挖掘算法[J]. 计算机应用, 2019, 39(3): 728-733.
[14]	叶志宇, 冯爱民, 高航. 基于深度LightGBM集成学习模型的谷歌商店顾客购买力预测[J]. 计算机应用, 2019, 39(12): 3434-3439.
[15]	袁钟, 冯山. 基于邻域值差异度量的离群点检测算法[J]. 计算机应用, 2018, 38(7): 1905-1909.