An efficient mining algorithm for dependent patterns

Since many current IDSs are constructed by manual encoding of expert knowledge, updating of IDSs are expensive and slow. It is very clear that the frequent patterns mined from audit data can be used as reliable intrusion detection models. We propose efficiently parallel methods to extract an extensive set of features that describe each network connection and learn frequent patterns that accurately capture the behavior of intrusions and normal activities, which are employed to facilitate model construction and incremental updates.