Application of sequential patterns based on user’s interest in intrusion detection

There are a mass of pattern rules in network audit record database, however users may be interested in only a part of them, if the pattern rules are mined only by setting the support threshold without any constraint, it will cause lots of redundant pattern rules which are not interested by users, and it is also hard to understand. In this paper, we mainly discuss such a method how to refine the pattern rules and reduce redundant rules as soon as possible according to userspsila interest in intrusion detection. Thereby, the axis attributes and constraint condition are introduced to improve the sequential pattern mining algorithm PrefixSpan, which could be applied in data mining module of NIDS. The analysis of results shows that the optimized algorithm is able to mine the set of frequent episode rules which users interest effectively in network audit database.