DoS detections based on association rules and frequent itemsets

To detect the DoS in networks by applying association rules mining techniques, we propose that association rules and frequent itemsets can be employed to find DoS pattern in packet streams which describe traffic and user behaviors. The method extracts information from the log analysis of submitted packets using the algorithm which depends on the definition of the intrusion. Large itemsets were extracted to represent the super facts to build the association analysis for the intrusion. Network data files were analysed for experiments. The analysis and experimental results are encouraging with better performance as packet frequency number increases.