Applying mining fuzzy association rules to intrusion detection based on sequences of system calls

摘要: Intrusion detection is an important technique for computer and information system. S. Forrest coworkers present us that short sequences of system calls are good signature descriptions anomalous intrusion [10]. This paper extends their works by applying mining fuzzy association rules to detection. After giving a primary classification based on threat level its identifier numbers, we generate series sendmail trace data transform them into expression. Then extract the Most Dangerous Sequences Database (MDSD) from expression data, according specific threshold. For MDSD database, apply detect each sequence “normal” or “abnormal”. The prototype experimental results demonstrate proposed method gives enough ability