关键词: 数据挖掘, 入侵检测, 改进, K-means算法, Apriori算法

Abstract: Aiming to the existing problem of the powerless, high false negative rate, low detection efficiency and the lack of the rule base automatic extension mechanism to unknown aggressive behavior for existing detection mechanisms, combining the relevant knowledge of data mining technology, this paper designs one improved network intrusion detection system model based on data mining, combining misuse detection and anomaly detection. The model selects the K-means algorithm in clustering analysis and the Apriori algorithm in association rule mining and improves it. It applies the improved K-means algorithm to achieving normal behavior classes and data separation module, then utilizes the improved Apriori algorithm to achieve automatic extension of the rule base. By the experiment it verifies the function of the two algorithms.

Key words: data mining, intrusion detection, improved, K-means algorithm, Apriori algorithm