Journal of Computer Applications ›› 2016, Vol. 36 ›› Issue (7): 1847-1851.DOI: 10.11772/j.issn.1001-9081.2016.07.1847

Previous Articles     Next Articles

Audit log association rule mining based on improved Apriori algorithm

XU Kaiyong, GONG Xuerong, CHENG Maocai   

  1. Information Engineering University, Zhengzhou Henan 450001, China
  • Received:2015-12-11 Revised:2016-03-21 Online:2016-07-10 Published:2016-07-14
  • Supported by:
    This work is partially supported by the National Natural Foundation of China (61072047).

基于改进Apriori算法的审计日志关联规则挖掘

徐开勇, 龚雪容, 成茂才   

  1. 信息工程大学, 郑州 450001
  • 通讯作者: 成茂才
  • 作者简介:徐开勇(1963-),男,河南郑州人,研究员,博士,主要研究方向:信息安全、可信计算;龚雪容(1975-),女,四川井研人,助理研究员,博士,主要研究方向:信息安全;成茂才(1991-),男,安徽芜湖人,硕士研究生,主要研究方向:信息安全。
  • 基金资助:
    国家自然科学基金资助项目(61072047)。

Abstract: Aiming at the problem of low-level intelligence and low utilization of audit logs of the security audit system, a secure audit system based on association rule mining was proposed. The proposed system was able to take full advantage of the existing audit logs and establish the behavior pattern database of users and the system with data mining technique. The abnormal situation was discovered in a timely manner and the security of computer system was improved. An improved E-Apriori algorithm was proposed which could narrow the scanning range of the set of transactions, lower the time complexity, and refine the operating efficiency. The experimental results indicate that the lift of recognition capability to identify the type of attack can reach 10% in the secure audit system based on association rule mining, the proposed E-Apriori algorithm clearly outperforms the traditional Apriori algorithm and FP-GROWTH algorithm, and the maximum increase can reach 51% especially in the large sparse datasets.

Key words: security audit system, audit log, data mining, association rule mining, Apriori algorithm

摘要: 针对安全审计系统中存在的智能程度低、日志信息没有充分利用的问题,提出一个基于关联规则挖掘的安全审计系统。该系统充分利用已有审计日志,结合数据挖掘技术,建立用户及系统的行为模式数据库,做到及时发现异常情况,提高了计算机的安全性。在传统Apriori算法的基础上提出一种改进的E-Apriori算法,该算法可以缩小待扫描事务集合的范围,降低算法的时间复杂度,提高运行效率。实验结果表明基于关联规则挖掘的审计系统对攻击类型的识别能力提升在10%以上,改进的E-Apriori算法相比经典Apriori算法和FP-GROWTH算法在性能上得到了提高,特别是在大型稀疏数据集中最高达到51%。

关键词: 安全审计系统, 审计日志, 数据挖掘, 关联规则挖掘, Apriori算法

CLC Number: