APPLICATION OF INCREMENTAL MINING METHODS TO IDS

Abstract

This report presents an algorithm to find the correlation feature from audit data of network traffic based on the incremental association rule mining method, which was implemented as part of Intrusion Detection System (IDS) to find the abnormal activity of network attacker. Fast mining of the frequently updated dataset is the fundamentally requirements, which guarantee IDS to detect intrusion as soon as possible. However, traditional algorithm cannot effectively handle mining association rule from audit data which is constantly changing over time. In this project, we make use of incremental association rule updating technique based on negative border concept. Using this technique, when dataset is updated, we don't need scan the dataset over again or scan the updated database only once to maintain the association rule. Performance of this algorithm is analyzed and compared with other association rule mining algorithms.