Discovery of Network Information Content Security Incidents Based on Association Rules and Its Implementation in Map-Reduce

A multi-dimension association analysis method of users behavioral characteristics based on association rules is proposed for the discovery of information content security incidents in network. The users multi- dimension data which generate in communication can be mined. An inspection standard based on Bonferronis correction is put forward to deal with the problem of false alarm. In order to meet the demand for the implementation of the method in a massive database, a distributed power set Apriori algorithm in Map-Reduce framework is proposed. Experimental results demonstrate that the proposed method and its corresponding algorithm have strong ability in parallel computing. The algorithm has a great detection rate in the case of low false alarm rate and missing detection rate. The running time is short and it can achieve a fast convergences rate.