Audit log association rule mining based on improved Apriori algorithm

doi:10.11772/j.issn.1001-9081.2016.07.1847

Journal of Computer Applications ›› 2016, Vol. 36 ›› Issue (7): 1847-1851.DOI: 10.11772/j.issn.1001-9081.2016.07.1847

Previous Articles Next Articles

Audit log association rule mining based on improved Apriori algorithm

XU Kaiyong, GONG Xuerong, CHENG Maocai

Information Engineering University, Zhengzhou Henan 450001, China

Received:2015-12-11 Revised:2016-03-21 Online:2016-07-10 Published:2016-07-14
Supported by:
This work is partially supported by the National Natural Foundation of China (61072047).

基于改进Apriori算法的审计日志关联规则挖掘

徐开勇, 龚雪容, 成茂才

信息工程大学, 郑州 450001

通讯作者: 成茂才
作者简介:徐开勇(1963-),男,河南郑州人,研究员,博士,主要研究方向:信息安全、可信计算;龚雪容(1975-),女,四川井研人,助理研究员,博士,主要研究方向:信息安全;成茂才(1991-),男,安徽芜湖人,硕士研究生,主要研究方向:信息安全。
基金资助:
国家自然科学基金资助项目（61072047）。

Abstract

Abstract: Aiming at the problem of low-level intelligence and low utilization of audit logs of the security audit system, a secure audit system based on association rule mining was proposed. The proposed system was able to take full advantage of the existing audit logs and establish the behavior pattern database of users and the system with data mining technique. The abnormal situation was discovered in a timely manner and the security of computer system was improved. An improved E-Apriori algorithm was proposed which could narrow the scanning range of the set of transactions, lower the time complexity, and refine the operating efficiency. The experimental results indicate that the lift of recognition capability to identify the type of attack can reach 10% in the secure audit system based on association rule mining, the proposed E-Apriori algorithm clearly outperforms the traditional Apriori algorithm and FP-GROWTH algorithm, and the maximum increase can reach 51% especially in the large sparse datasets.

Key words: security audit system, audit log, data mining, association rule mining, Apriori algorithm

摘要： 针对安全审计系统中存在的智能程度低、日志信息没有充分利用的问题，提出一个基于关联规则挖掘的安全审计系统。该系统充分利用已有审计日志，结合数据挖掘技术，建立用户及系统的行为模式数据库，做到及时发现异常情况，提高了计算机的安全性。在传统Apriori算法的基础上提出一种改进的E-Apriori算法，该算法可以缩小待扫描事务集合的范围，降低算法的时间复杂度，提高运行效率。实验结果表明基于关联规则挖掘的审计系统对攻击类型的识别能力提升在10%以上，改进的E-Apriori算法相比经典Apriori算法和FP-GROWTH算法在性能上得到了提高，特别是在大型稀疏数据集中最高达到51%。

关键词: 安全审计系统, 审计日志, 数据挖掘, 关联规则挖掘, Apriori算法

CLC Number:

TP391.4

XU Kaiyong, GONG Xuerong, CHENG Maocai. Audit log association rule mining based on improved Apriori algorithm[J]. Journal of Computer Applications, 2016, 36(7): 1847-1851.

徐开勇, 龚雪容, 成茂才. 基于改进Apriori算法的审计日志关联规则挖掘[J]. 计算机应用, 2016, 36(7): 1847-1851.

References

[1] 石文昌,孙玉芳.安全操作系统研究的发展[J].计算机科学,2002,29(6):5-12.(SHI W C, SUN Y F. Development of secure operating system research[J]. Computer Science, 2002, 29(6):5-12.)
[2] 丁丽萍,周博文,王永吉.基于安全操作系统的电子证据获取与存储[J].软件学报,2007,18(7):1715-1729.(DING L P, ZHOU B W, WANG Y J. Capture and storage of digital evidence based on security operating system[J]. Journal of Software, 2007, 18(7):1715-1729.)
[3] 刘海峰,卿斯汉.安全操作系统审计的设计与实现[J].计算机研究与发展,2001,38(10):1262-1268.(LIU H F, QING S H. Design and realization of auditing in secure OS[J]. Journal of Computer Research and Development, 2001, 38(10):1262-1268.)
[4] MORADI M, KEYVANPOUR M R. An analytical review of XML association rules mining[J]. Artificial Intelligence Review, 2015, 43(2):277-300.
[5] SONG S J, KIM E H, KIM H G, et al. Query-based association rule mining supporting user perspective[J]. Computing, 2011, 93(1):1-25.
[6] AGRAWAL R, SRIKANT R. Fast algorithms for mining association rules[C]//Proceedings of the 20th International Conference on Very Large Data Bases. San Francisco, CA:Morgan Kaufmann, 1994:21-30.
[7] AGRAWAL R, IMIELINSKI T SWAMI A. Mining association rules between sets of items in large databases[J]. ACM SIGMOD Record, 1993, 22(2):207-216.
[8] HAN J, PEI J, YIN Y. Mining frequent patterns without candidate generation[J]. ACM SIGMOD Record, 2000, 29(2):1-12.
[9] EL-HAJJ M, ZAIANE O R. COFI approach for mining frequent itemsets revisited[C]//Proceedings of the 2004 ACM SIGMOD Workshop on Research Issues in Data Mining and Knowledge Discovery. New York:ACM, 2004:70-75.
[10] DONG G L, RYU K S, BASHIR M, et al. Discovering medical knowledge using association rule mining in young adults with acute myocardial infarction[J]. Journal of Medical Systems, 2013, 37(2):1-10.
[11] KHALILI A, SAMI A. SysDetect:a systematic approach to critical state determination for industrial intrusion detection systems using Apriori algorithm[J]. Journal of Process Control, 2015, 2776:154-160.
[12] SAHOO J, DAS A K, GOSWAMI A. An effective association rule mining scheme using a new generic basis[J]. Knowledge and Information Systems, 2015, 43(1):127-156.
[13] KESHAVAMURTHY B N, KHAN A M, TOSHNIWAL D. Privacy preserving association rule mining over distributed databases using genetic algorithm[J]. Neural Computing & Applications, 2013, 22(Supplement 1):351-364.
[14] ROZENBERG B, GUDES E. Association rules mining in vertically partitioned databases[J]. Data & Knowledge Engineering, 2006, 59(2):378-396.
[15] DING Y, YUAN X, TANG K, et al. A fast malware detection algorithm based on objective-oriented association mining[J]. Computers & Security, 2013, 39(4):315-324.
[16] GARCKE J, GRIEBEL M. On the parallelization of the sparse grid approach for data mining[C]//LSSC 2001:Proceedings of the Third International Conference on Large-Scale Scientific Computing, LNCS 2179. Berlin:Springer, 2001:22-32.
[17] CZIBULA G, MARIAN Z, CZIBULA I G. Detecting software design defects using relational association rule mining[J]. Knowledge and Information Systems, 2015, 42(3):545-577.
[18] HILLS J, BAGNALL A, IGLESIA B D L, et al. BruteSuppres-sion:a size reduction method for Apriori rule sets[J]. Journal of Intelligent Information Systems, 2013, 40(3):431-454.
[19] LIPPMANN R, HAINES J W, FRIED D J, et al. The 1999 DARPA off-line intrusion detection evaluation[J]. Computer Networks, 2000, 34(4):579-595.

Audit log association rule mining based on improved Apriori algorithm

基于改进Apriori算法的审计日志关联规则挖掘

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	LIU Shize, QIN Yanjun, WANG Chenxing, SU Lin, KE Qixue, LUO Haiyong, SUN Yi, WANG Baohui. Traffic flow prediction algorithm based on deep residual long short-term memory network [J]. Journal of Computer Applications, 2021, 41(6): 1566-1572.
[2]	LI Xujuan, PI Jianyong, HUANG Feixiang, JIA Haipeng. Self-generated deep neural network based 4D trajectory prediction [J]. Journal of Computer Applications, 2021, 41(5): 1492-1499.
[3]	CHEN Kai, YU Yanwei, ZHAO Jindong, SONG Peng. Work location inference method with big data of urban traffic surveillance [J]. Journal of Computer Applications, 2021, 41(1): 177-184.
[4]	LONG Yangyang, CHEN Yuling, XIN Yang, DOU Hui. Secure energy transaction scheme based on alliance blockchain [J]. Journal of Computer Applications, 2020, 40(6): 1668-1673.
[5]	XU Zhoubo, YANG Jian, LIU Huadong, HUANG Wenwen. Protein complex identification algorithm based on XGboost and topological structural information [J]. Journal of Computer Applications, 2020, 40(5): 1510-1514.
[6]	DU Xusheng, YU Jiong, YE Lele, CHEN Jiaying. Outlier detection algorithm based on graph random walk [J]. Journal of Computer Applications, 2020, 40(5): 1322-1328.
[7]	CHEN Xi, MEI Guang, ZHANG Jinjin, XU Weisheng. Student grade prediction method based on knowledge graph and collaborative filtering [J]. Journal of Computer Applications, 2020, 40(2): 595-601.
[8]	MA Dong, CHEN Hongmei, WANG Lizhen, XIAO Qing. Dominant feature mining of spatial sub-prevalent co-location patterns [J]. Journal of Computer Applications, 2020, 40(2): 465-472.
[9]	LI Shasha, LIANG Dongyang, YU Jie, JI Bin, MA Jun, TAN Yusong, WU Qingbo. Research team mining algorithm based on teacher-student relationship [J]. Journal of Computer Applications, 2020, 40(11): 3198-3202.
[10]	SUN Heli, ZHANG Youyou, YANG Zhou, HE Liang, JIA Xiaolin. Urban reachable region search based on time segment tree [J]. Journal of Computer Applications, 2020, 40(10): 2936-2941.
[11]	LI Bo, ZHANG Xiao, YAN Jingyi, LI Kewei, LI Heng, LING Yulong, ZHANG Yong. Application of KNN algorithm based on value difference metric and clustering optimization in bank customer behavior prediction [J]. Journal of Computer Applications, 2019, 39(9): 2784-2788.
[12]	JI Lina, CHEN Kai, YU Yanwei, SONG Peng, WANG Shuying, WANG Chenrui. Vehicle type mining and application analysis based on urban traffic big data [J]. Journal of Computer Applications, 2019, 39(5): 1343-1350.
[13]	YU Yongbin, QI Minhui, Nyima Tashi, WANG Lin. Association rule mining algorithm for Hopfield neural network based on threshold adaptive memristor [J]. Journal of Computer Applications, 2019, 39(3): 728-733.
[14]	YE Zhiyu, FENG Aimin, GAO Hang. Customer purchasing power prediction of Google store based on deep LightGBM ensemble learning model [J]. Journal of Computer Applications, 2019, 39(12): 3434-3439.
[15]	YUAN Zhong, FENG Shan. Outlier detection algorithm based on neighborhood value difference metric [J]. Journal of Computer Applications, 2018, 38(7): 1905-1909.