Data association analysis method and system for network security

Abstract

The invention discloses a data association analysis method and system for network security, and relates to the technical field of data association, and the method comprises the steps: collecting log and event information, extracting features, forming an event feature database, enabling events of the event feature database to pass through an improved data association Apriori algorithm to obtain a frequent event set, generating an association rule according to the frequent event set, generating an effective security event association rule by using a support degree, a confidence degree and a lifting degree, and detecting a security threat or attack behavior; according to the improved Apriori algorithm, the number of scanning times of a database and generated redundant intermediate sets and candidate items are reduced, so that the efficiency of the Apriori algorithm is improved, the improved algorithm can directly perform self-connection to generate a next-level frequent item set by skipping generation of the candidate items, and the efficiency of the algorithm is improved. The time generated by scanning the target database is shortened, so that the algorithm efficiency is improved, and a data association system with network security is obtained more quickly.

Description

Technical Field

[0001] The present invention relates to the technical field of data association, and in particular to a data association analysis method and system for network security. Background Art

[0002] When searching for association rules of transaction internal data, the classic Apriori algorithm uses iteration to discover frequent items. It is simple, direct and easy to understand, but it has obvious disadvantages, that is, it will generate a large number of candidate items and the algorithm overhead is very large. The basic idea of ​​the Apriori algorithm is to record multiple scan data information to generate multiple candidate item sets of different lengths. The existing Apriori algorithm cannot complete the task efficiently. The main reason is that the algorithm will spend a lot of time scanning the transaction set. At the same time, each transaction will generate a large number of candidate item sets, and each candidate item will also generate many association rules, resulting in very low execution efficiency of the algorithm.

[0003] At present, the Chinese invention patent with application number CN202411290690.9 discloses a data analysis method, device, equipment, medium and product, and provides a data analysis method, device, equipment, medium and product. Belonging to the field of network security technology, the method includes: obtaining the behavior data of employees of each institution reported by each institution; using the association rule mining algorithm to mine the correlation between the behavior data in the behavior data set to obtain the target association rule; performing cluster analysis on several behavior data in the behavior data set according to the cluster analysis algorithm to obtain the cluster analysis result; performing association analysis on the cluster analysis result according to the target association rule to generate the behavior analysis result; solving the technical problem that the related technology cannot timely and effectively identify and discover the potential risks of the system. The existing technology has the problem of frequently scanning the database and a large number of candidate items and intermediate sets, which will generate a large number of intermediate sets and candidate items. To address these problems, this paper proposes an improved Apriori algorithm to reduce the number of database scans and the redundant intermediate sets and candidate items generated, thereby improving the efficiency of the Apriori algorithm. The classic Apriori algorithm needs to perform a complete scan of the target database to delete item sets with less than the minimum support when screening candidate item sets, while the improved algorithm can skip generating candidate items and directly perform self-connection to generate the next level of frequent item sets, reducing the time generated by scanning the target database and thus improving the efficiency of the algorithm. Summary of the invention

[0004] The technical problem solved by the present invention is that the existing technology has the problem of frequently scanning the database and the large number of candidate items and intermediate sets, which will generate a large number of intermediate sets and candidate items. The classic Apriori algorithm needs to perform a complete scan of the target database to delete item sets with less than the minimum support when screening the candidate item set.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a data association analysis method for network security, comprising the following steps: Step S1: Collect log and event information from multiple different data sources; Step S2: extracting features after preprocessing the log and event information, obtaining network security event features, and forming an event feature database; Step S3: applying the improved data association Apriori algorithm to the events in the event feature database to obtain a frequent event set, and generating association rules based on the frequent event set; Step S4: Use the improved Apriori algorithm to mine frequent event sets on the processed event data, and generate effective security event association rules based on the frequent event sets using support, confidence, and lift.

[0006] Step S5: Detect potential security threats or attack behaviors through the generated association rules.

[0007] Preferably, the log and event information includes: Intrusion detection system logs, intrusion prevention system logs, firewall logs, operating system logs, application logs, network traffic data, and authentication logs; The intrusion detection system log and intrusion prevention system log record abnormal activities and signs of attacks in network traffic. The firewall log includes the status of network connections, port scans and firewall policy applications. The operating system log includes user activities, process startup and file access information on the operating system. The application log includes access logs and database logs of Web applications, which are used to record activities at the application layer. The network traffic data comes from network traffic analysis tools, which include NetFlow, sFlow and Wireshark, providing a detailed view of network traffic. The authentication log records user logins, logouts and permission changes.

[0008] Preferably, step S2 comprises: Preprocessing the log and event information includes data cleaning, timestamp standardization, data formatting, feature extraction and discretization; The timestamp standardization includes unifying the timestamp format for different time formats and time zones of different data sources; The data formatting includes converting log data into structured event records, converting timestamps into time periods and IP addresses for classification; The feature extraction includes extracting key features of network security events, wherein the key features include source IP, target IP, protocol type, attack type, event ID, timestamp, port and behavior type; The discretization includes discretizing continuous data into a number of intervals.

[0009] Preferably, feature extraction includes: Rule-based feature extraction, behavior-based feature extraction, and statistics-based feature extraction; The rule-based feature extraction includes extracting features according to predefined rules, wherein the rules include IP address, port number and protocol type; The behavior-based feature extraction includes extracting a behavior pattern of a user or a device, wherein the behavior pattern includes a login frequency and a file access pattern; The statistical-based feature extraction includes calculating statistical values, the statistical values ​​including traffic fluctuations and connection times, for identifying abnormal behavior; The features extracted based on rules, behaviors and statistics are combined into an event feature database.

[0010] Preferably, step S3 comprises: The improved data association Apriori algorithm includes: Scan the event feature database, count the frequencies of each type of event feature appearing in the event feature database, calculate the minimum support, collect items that meet the minimum support, and group the items that meet the minimum support into a first frequent item set, extract a second frequent item set based on the first frequent item set, extract a third frequent item set based on the second frequent item set, and iteratively extract a kth frequent item set until no iterative operation can be performed, where k is a constant; Extracting the a+1th frequent item set based on the ath frequent item set includes: Step S31: Connect the ath frequent item set with itself to generate candidate a item set ; Step S32: Scan the event feature database, count the number of times the a-dimensional items appear simultaneously in the database, delete the items with less than the minimum support, and obtain the next a+1th frequent item set; Repeat steps S31 and S32 until no higher-order frequent item sets can be generated.

[0011] Preferably, the number of occurrences of a-dimensional items in the a-th frequent itemset is first calculated, items whose number of occurrences is less than k in the a-th frequent itemset are found, and all frequent itemsets containing the items are deleted to obtain a smaller k-dimensional frequent itemset, and a k+1-dimensional frequent itemset is extracted according to the self-connection of the k-dimensional frequent itemset.

[0012] Preferably, generating association rules includes: Determine whether different security events belong to the same attack chain by correlating different security events, wherein the security events include IDS alerts and firewall logs; The characteristics of the time series data are freely available. The events in the event feature database are sorted according to the timestamp sequence, and the data that changes with time is extracted, and the change trend of the data that changes with time is set as the transaction feature variable.

[0013] Preferably, an association rule is constructed according to the transaction characteristic variables: The mathematical expression of the association rule is: ; Among them, A and B are frequent item sets, A is the premise, and B is the conclusion; Calculate the confidence and lift of each association rule. The mathematical expression is: ; in, Association rules The confidence level indicates the probability of B occurring when A occurs; ; in, is the lifting degree, Support(B) is the feasibility of B, and the lifting degree is used to measure the relevance of the association rules; Judging the feasibility of association rules includes: When the confidence of the association rule meets the preset confidence threshold range and the lift meets the preset lift threshold, the association rule is valid; When the confidence of the association rule does not meet the preset confidence threshold range or the lift does not meet the preset lift threshold, the association rule is invalid.

[0014] Preferably, the step S5 comprises: The event feature database and transaction feature variables are input into the improved data association Apriori algorithm to obtain network security association rules, and security threats or attack behaviors with probability of occurring are detected according to the network security association rules. When security threats or attack behaviors are detected, an alarm is automatically triggered and a security administrator is notified.

[0015] Preferably, a data association analysis system for network security includes a collection module, a processing module, an algorithm module and a detection module: The collection module is used to collect log and event information from multiple different data sources; The processing module is used to perform feature extraction after preprocessing the log and event information, obtain network security event features, and form an event feature database; The algorithm module is used to associate the events of the event feature database with the improved data Apriori algorithm to obtain a frequent event set, generate association rules based on the frequent event set, use the improved Apriori algorithm to mine the frequent event set on the processed event data, and generate effective security event association rules based on the frequent event set using support, confidence and lift; The detection module is used to detect potential security threats or attack behaviors through the generated association rules.

[0016] Beneficial effects of the present invention: The present invention proposes an improved Apriori algorithm, which reduces the number of times a database is scanned and the redundant intermediate sets and candidate items generated, thereby improving the efficiency of the Apriori algorithm. The improved algorithm can skip the generation of candidate items and directly perform self-connection to generate the next level of frequent item sets, reducing the time generated by scanning the target database and thus improving the algorithm efficiency. The improved Apriori algorithm is used to establish association rules for network security events, and a network security data association system is obtained more quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A basic flow chart of a data association analysis method for network security provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0019] Reference Figure 1 , as an embodiment of the present invention, provides a data association analysis method for network security, comprising the following steps: Step S1: Collect log and event information from multiple different data sources; Step S2: pre-processing the log and event information and then extracting features to obtain network security event features and form an event feature database; Step S3: applying the improved data association Apriori algorithm to the events in the event feature database to obtain a frequent event set, and generating association rules based on the frequent event set; Step S4: Use the improved Apriori algorithm to mine frequent event sets on the processed event data, and generate effective security event association rules based on the frequent event sets using support, confidence, and lift.

[0020] Step S5: Detect potential security threats or attack behaviors through the generated association rules.

[0021] The log and event information include: Intrusion detection system logs, intrusion prevention system logs, firewall logs, operating system logs, application logs, network traffic data, and authentication logs; The intrusion detection system log and intrusion prevention system log record abnormal activities and signs of attacks in network traffic. The firewall log includes the status of network connections, port scans and firewall policy applications. The operating system log includes user activities, process startup and file access information on the operating system. The application log includes access logs and database logs of Web applications, which are used to record activities at the application layer. The network traffic data comes from network traffic analysis tools, which include NetFlow, sFlow and Wireshark, providing a detailed view of network traffic. The authentication log records user logins, logouts and permission changes.

[0022] The step S2 comprises: Preprocessing the log and event information includes data cleaning, timestamp standardization, data formatting, feature extraction and discretization; The timestamp standardization includes unifying the timestamp format of different time formats and time zones of different data sources to ensure that the data can be arranged in chronological order; The data formatting includes converting log data into structured event records, converting timestamps into time periods and IP addresses for classification; The feature extraction includes extracting key features of network security events, wherein the key features include source IP, target IP, protocol type, attack type, event ID, timestamp, port and behavior type; The discretization includes discretizing continuous data into several intervals, such as time and flow.

[0023] Feature extraction includes: Rule-based feature extraction, behavior-based feature extraction, and statistics-based feature extraction; The rule-based feature extraction includes extracting features according to predefined rules, wherein the rules include IP address, port number and protocol type; The behavior-based feature extraction includes extracting a behavior pattern of a user or a device, wherein the behavior pattern includes a login frequency and a file access pattern; The statistical-based feature extraction includes calculating statistical values, the statistical values ​​including traffic fluctuations and connection times, for identifying abnormal behavior; The features extracted based on rules, behaviors and statistics are combined into an event feature database.

[0024] The step S3 comprises: The improved data association Apriori algorithm includes: Scan the event feature database, count the frequencies of each type of event feature appearing in the event feature database, calculate the minimum support, collect items that meet the minimum support, and group the items that meet the minimum support into a first frequent item set, extract a second frequent item set based on the first frequent item set, extract a third frequent item set based on the second frequent item set, and iteratively extract a kth frequent item set until no iterative operation can be performed, where k is a constant; The minimum support is a threshold set by the user, which determines the minimum frequency of occurrence that an item set needs to reach in the data in order to be considered a "frequent item set". Only item sets with a support greater than or equal to the minimum support will be considered frequent item sets and association rule mining will continue; Extracting the a+1th frequent item set based on the ath frequent item set includes: Step S31: Connect the ath frequent item set with itself to generate candidate a item set ; Step S32: Scan the event feature database, count the number of times the a-dimensional items appear simultaneously in the database, delete the items with less than the minimum support, and obtain the next a+1th frequent item set; Repeat steps S31 and S32 until no higher-order frequent item sets can be generated.

[0025] In actual analysis, it is found that there are a large number of transactions that cannot generate frequent itemsets when counting the candidate item set Ck. Therefore, reducing the occurrence of these transactions is the core of the improved algorithm in this paper.

[0026] If the number of times item a appears in the a-th frequent item set is less than k, then the k+1-dimensional item set composed of item a and other items cannot be a frequent item set. Since the item set composed of a cannot be a frequent item set, there is no need to let a participate in the connection, thereby reducing the candidate item set; First, calculate the number of occurrences of a-dimensional items in the a-th frequent itemset, find out the items whose occurrences are less than k in the a-th frequent itemset, and delete all frequent itemsets containing the items to obtain a smaller k-dimensional frequent itemset, and extract the k+1-dimensional frequent itemset based on the self-connection of the k-dimensional frequent itemset.

[0027] The frequent itemsets generated by this method avoid multiple generation of candidate items and pruning and filtering of candidate items, thus improving the efficiency of the algorithm; The algorithm pseudo code is as follows: Input: target database D, minimum support min_sup; output: frequent item set L in D; L1 = find_frequent_1(D) / / Frequent 1 item set; for(k=2;Lk-1!=NULL;k++); for each item in Lk; for each i in item; if(i in item); i.count++; for each item in Lk; if(i.count <k) ; Delete Li / / Delete the itemset containing this transaction; Concatenate(item, Lk) / / Self-connection generates new frequent item sets.

[0028] Generate association rules including: Determine whether different security events belong to the same attack chain by correlating them, including IDS alerts and firewall logs. For example, detecting a large number of login failures on a device followed by network scanning behavior may indicate a brute force attack. The characteristics of the time series data are freely available. The events in the event feature database are sorted according to the timestamp sequence, and the data that changes with time is extracted, and the change trend of the data that changes with time is set as the transaction feature variable.

[0029] Construct association rules based on the transaction feature variables: The mathematical expression of the association rule is: ; Among them, A and B are frequent item sets, A is the premise, and B is the conclusion; Calculate the confidence and lift of each association rule. The mathematical expression is: ; in, Association rules The confidence level indicates the probability of B occurring when A occurs; ; in, is the lifting degree, Support(B) is the feasibility of B, and the lifting degree is used to measure the relevance of the association rules; Judging the feasibility of association rules includes: When the confidence of the association rule meets the preset confidence threshold range and the lift meets the preset lift threshold, the association rule is valid; When the confidence of the association rule does not meet the preset confidence threshold range or the lift does not meet the preset lift threshold, the association rule is invalid.

[0030] The step S5 comprises: The event feature database and transaction feature variables are input into the improved data association Apriori algorithm to obtain network security association rules, and security threats or attack behaviors with probability of occurring are detected according to the network security association rules. When security threats or attack behaviors are detected, an alarm is automatically triggered and a security administrator is notified.

[0031] By mining patterns and associations in security data, abnormal behaviors can be identified in a timely manner and alerts or automatic responses can be provided. Combining real-time monitoring, rule optimization, and multiple detection methods can effectively improve the security of the system and reduce the risk of false positives and false negatives.

[0032] A data association analysis system for network security, comprising a collection module, a processing module, an algorithm module and a detection module: The collection module is used to collect log and event information from multiple different data sources; The processing module is used to perform feature extraction after pre-processing the log and event information, obtain network security event features, and form an event feature database; The algorithm module is used to associate the events of the event feature database with the improved data Apriori algorithm to obtain a frequent event set, generate association rules based on the frequent event set, use the improved Apriori algorithm to mine the frequent event set on the processed event data, and generate effective security event association rules based on the frequent event set using support, confidence and lift; The detection module is used to detect potential security threats or attack behaviors through the generated association rules.

[0033] The present invention proposes an improved Apriori algorithm, which reduces the number of times a database is scanned and the redundant intermediate sets and candidate items generated, thereby improving the efficiency of the Apriori algorithm. The improved algorithm can skip the generation of candidate items and directly perform self-connection to generate the frequent item sets of the next level, reducing the time generated by scanning the target database and thus improving the algorithm efficiency. The improved Apriori algorithm is used to establish association rules for network security events, and a network security data association system is obtained more quickly.

[0034] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes. Among them, the storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, magnetic disk or optical disk. These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0035] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data association analysis method for network security, characterized in that: The following steps are involved: Step S1: Collect log and event information from multiple different data sources; Step S2: extracting features after preprocessing the log and event information, obtaining network security event features, and forming an event feature database; Step S3: applying the improved data association Apriori algorithm to the events in the event feature database to obtain a frequent event set, and generating association rules based on the frequent event set; Step S4: Use the improved Apriori algorithm to mine frequent event sets on the processed event data, and generate effective security event association rules based on the frequent event sets using support, confidence, and lift; Step S5: Detect potential security threats or attack behaviors through the generated association rules; The step S3 comprises: The improved data association Apriori algorithm includes: Scan the event feature database, count the frequencies of each type of event feature appearing in the event feature database, calculate the minimum support, collect items that meet the minimum support, and group the items that meet the minimum support into a first frequent item set, extract a second frequent item set based on the first frequent item set, extract a third frequent item set based on the second frequent item set, and iteratively extract a kth frequent item set until no iterative operation can be performed, where k is a constant; Extracting the a+1th frequent item set based on the ath frequent item set includes: Step S31: Connect the ath frequent item set with itself to generate candidate a item set ; Step S32: Scan the event feature database, count the number of times the a-dimensional items appear simultaneously in the database, delete the items with less than the minimum support, and obtain the next a+1th frequent item set; Repeat step S31 and step S32 until no higher-order frequent item sets can be generated; First, calculate the number of occurrences of a-dimensional items in the a-th frequent itemset, find out the items whose occurrences are less than k in the a-th frequent itemset, and delete all frequent itemsets containing the items to obtain a smaller k-dimensional frequent itemset, and extract the k+1-dimensional frequent itemset based on the self-connection of the k-dimensional frequent itemset.

2. The data association analysis method for network security according to claim 1, characterized in that: The log and event information include: Intrusion detection system logs, intrusion prevention system logs, firewall logs, operating system logs, application logs, network traffic data, and authentication logs; The intrusion detection system log and intrusion prevention system log record abnormal activities and signs of attacks in network traffic. The firewall log includes the status of network connections, port scans and firewall policy applications. The operating system log includes user activities, process startup and file access information on the operating system. The application log includes access logs and database logs of Web applications, which are used to record activities at the application layer. The network traffic data comes from network traffic analysis tools, which include NetFlow, sFlow and Wireshark, providing a detailed view of network traffic. The authentication log records user logins, logouts and permission changes.

3. The data association analysis method for network security according to claim 1, characterized in that: The step S2 comprises: Preprocessing the log and event information includes data cleaning, timestamp standardization, data formatting, feature extraction and discretization; The timestamp standardization includes unifying the timestamp format for different time formats and time zones of different data sources; The data formatting includes converting log data into structured event records, converting timestamps into time periods and IP addresses for classification; The feature extraction includes extracting key features of network security events, wherein the key features include source IP, target IP, protocol type, attack type, event ID, timestamp, port and behavior type; The discretization includes discretizing continuous data into a number of intervals.

4. The data association analysis method for network security according to claim 3, characterized in that: Feature extraction includes: Rule-based feature extraction, behavior-based feature extraction, and statistics-based feature extraction; The rule-based feature extraction includes extracting features according to predefined rules, wherein the rules include IP address, port number and protocol type; The behavior-based feature extraction includes extracting a behavior pattern of a user or a device, wherein the behavior pattern includes a login frequency and a file access pattern; The statistical-based feature extraction includes calculating statistical values, the statistical values ​​including traffic fluctuations and connection times, for identifying abnormal behavior; The features extracted based on rules, behaviors and statistics are combined into an event feature database.

5. The data association analysis method for network security according to claim 4, characterized in that: Generate association rules including: Determine whether different security events belong to the same attack chain by correlating different security events, wherein the security events include IDS alerts and firewall logs; The characteristics of the time series data are freely available. The events in the event feature database are sorted according to the timestamp sequence, and the data that changes with time is extracted, and the change trend of the data that changes with time is set as the transaction feature variable.

6. The data association analysis method for network security according to claim 5, characterized in that: Construct association rules based on the transaction feature variables: The mathematical expression of the association rule is: A ⇒ B; Among them, A and B are frequent item sets, A is the premise, and B is the conclusion; Calculate the confidence and lift of each association rule. The mathematical expression is: Confidence(A⇒B)=P(A∪B) / P(A); Among them, Confidence(A⇒B) is the confidence of the association rule A⇒B, which means the probability of B occurring when A occurs; Lift(A⇒B)=Confidence(A⇒B) / Support(B); Wherein, Lift(A⇒B) is the lift, Support(B) is the feasibility of B, and the lift is used to measure the relevance of the association rules; Judging the feasibility of association rules includes: When the confidence of the association rule meets the preset confidence threshold range and the lift meets the preset lift threshold, the association rule is valid; When the confidence of the association rule does not meet the preset confidence threshold range or the lift does not meet the preset lift threshold, the association rule is invalid.

7. The data association analysis method for network security according to claim 6, characterized in that: The step S5 comprises: The event feature database and transaction feature variables are input into the improved data association Apriori algorithm to obtain network security association rules, and security threats or attack behaviors with probability of occurring are detected according to the network security association rules. When security threats or attack behaviors are detected, an alarm is automatically triggered and a security administrator is notified.

8. A data association analysis system for network security, characterized in that: Including collection module, processing module, algorithm module and detection module: The collection module is used to collect log and event information from multiple different data sources; The processing module is used to perform feature extraction after pre-processing the log and event information, obtain network security event features, and form an event feature database; The algorithm module is used to obtain frequent event sets through the improved data association Apriori algorithm for events in the event feature database, generate association rules based on the frequent event sets, use the improved Apriori algorithm to mine frequent event sets on the processed event data, and generate effective security event association rules based on the frequent event sets using support, confidence and lift. The improved data association Apriori algorithm includes: Scan the event feature database, count the frequencies of each type of event feature appearing in the event feature database, calculate the minimum support, collect items that meet the minimum support, and group the items that meet the minimum support into a first frequent item set, extract a second frequent item set based on the first frequent item set, extract a third frequent item set based on the second frequent item set, and iteratively extract a kth frequent item set until no iterative operation can be performed, where k is a constant; Extracting the a+1th frequent item set based on the ath frequent item set includes: Step S31: Connect the ath frequent item set with itself to generate candidate a item set ; Step S32: Scan the event feature database, count the number of times the a-dimensional items appear simultaneously in the database, delete the items with less than the minimum support, and obtain the next a+1th frequent item set; Repeat step S31 and step S32 until no higher-order frequent item sets can be generated; First, calculate the number of occurrences of the a-dimensional item in the a-th frequent item set, find the item whose number of occurrences is less than k in the a-th frequent item set, and delete all frequent item sets containing the item to obtain a smaller k-dimensional frequent item set, and extract the k+1-dimensional frequent item set according to the self-connection of the k-dimensional frequent item set; The detection module is used to detect potential security threats or attack behaviors through the generated association rules.

Images