An Association Mining Model for Intrusion Detection

Traditional intrusion detection model is based on the static historical data; however, the network environment is always in real-time changing, which makes the traditional model with larger error. In this paper, we propose a dynamical association mining model to conduct intrusion detection. We regard the bytes of source, bytes of destination, number of failed logins, duration, number of active I/O, Error of pages as network situation vector; treat the use of network bandwidth as input; treat the evaluation-index of the association connection rate as output, and construct a state-space model. Experimental results demonstrate this model is effective.