Abstract
Intrusion Detection Systems (IDSs) can easily create thousands of alerts per day, up to 99% of which are false positives (i.e. alerts that are triggered incorrectly by benign events). This makes it extremely hard for to analyze and react to attacks. Data mining generally refers to the process of extracting models from large stores of data. The intrusion detection system first apply data mining programs to audit data to compute frequent patterns, extract features, and then use classification algorithms to compute detection models. The most important step of this process is to determine relations between fields in the database records to construct features. The standard association rules have not enough expressiveness. Intrusion detection system can extract the association rule with negations and with varying support thresholds to get better performance rather than extract the standard association rule. This paper presents a novel method for handling IDS alerts more efficiently some important features of association rule mining to IDS. In this paper, we integrate fuzzy association rules to design and implement an abnormal network intrusion detection system. Since the association rules used in traditional information detection cannot effectively deal with changes in network behavior, it will better meet the actual needs of abnormal detection to introduce the concept of fuzzy association rules to strengthen the adaptability.
