Journal
APPLIED INTELLIGENCE
Volume 51, Issue 6, Pages 4043-4057Publisher
SPRINGER
DOI: 10.1007/s10489-020-02007-5
Keywords
Security logs; Association rules; Data mining; Cyber intrusion
Categories
Funding
- National Natural Science Foundation Committee (NSFC) of China [51905397]
- Fundamental Research Funds for the Central Universities [WUT:2018III069GX, WUT:2019III071GX]
Ask authors/readers for more resources
This paper proposes a new method for detecting various intrusion behaviors in the cloud computing platform by mining association rules from multi-source logs. Experimental results show that the proposed method outperforms other algorithms in terms of calculation speed and performance metrics such as precision, recall, and f-measure.
Security logs in cloud environment like intrusion detection system (IDS) logs, firewall logs, and system logs provide historical information describing potential security risks. However, the use of logs for cyber intrusion detection relies heavily on expert knowledge. It is very difficult for the non-expert to identify these intrusion behaviors. This paper proposes a new method for mining association rules from multi-source logs to detect various intrusion behaviors in the cloud computing platform. In this method, a rule base is constructed to detect cyber intrusion. An adaptive approach is used to speed up the calculation of the association rule mining, in which the decision depends on the time complexity of the algorithm. Various cyber-attacks are simulated in the verification experiments which show the calculation speed of the proposed method is faster than other algorithms. Furthermore, compared with other methods, the performance of the proposed intrusion detection method is better than others in term of precision, recall, and f-measure.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available