An Alert Correlation Analysis Oriented Incremental Mining Algorithm of Closed Sequential Patterns with Gap Constraints

Hui He, Dong Wang, Gui Chen, Weizhe Zhang
2014 Applied Mathematics & Information Sciences  
Large-scale network attacks will bring great damage to the network. Although the existing detection systems are able to detect a large number of known attacks, when facing large-scale network attacks, log data generated by these systems usually increases rapidly, which forms vast amount of alert information in a short period of time. This paper researches on picking up alert information efficiently and timely, which is an important need. According to the characteristics of intrusion detection
more » ... g, we put forward the method of using incremental mining algorithm of closed sequential patterns with gap constraints -cispan algorithm to analyze the growing log database, we also compare the performance of cispan algorithm, prefixspan algorithm and clospan algorithm in analyzing intrusion detection log, and proves that cispan algorithm has higher efficiency in analyzing alert log.
doi:10.12785/amis/081l06 fatcat:towx2y4375eplgxvcfoqi7va3u