# Application of Data Mining Technology in Software Intrusion Detection and Information Processing

Authors: Xuemin Zhao
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

In order to improve the efficiency of the software intrusion detection system, the author proposes an application based on data mining technology in software intrusion detection and information processing. Apply data mining technology to software intrusion detection; first, analyze and research software intrusion detection technology and data mining technology, including the basic concepts of software intrusion detection, the realization technology of software intrusion detection, the classification of software intrusion detection systems, and the typical software intrusion detection system situation. By detecting and analyzing known intrusion data and using association rules, constructing the inspection system rule base enables the system to learn independently and improve itself and has good scalability, while improving the degree of automation and complete intrusion detection. Experimental results show that under the same test sample, the accuracy of the detection system model designed in this paper is 95.67%, higher than the other three detection systems, and the false alarm rate is lower than other systems, which has certain advantages. It is proved that the system in this paper can help improve the accuracy of software intrusion detection, significantly reduce the false alarm rate and false alarm rate of software intrusion detection, and provide reference for the optimization and improvement of software intrusion detection system and information processing. The system has a certain degree of self-adaptation, which can effectively detect external intrusions.


---

## Body

## 1. Introduction

In recent years, with the rapid development of the Internet, the Internet has a wider range of applications; the scale of Internet users has grown rapidly; the explosive increase of Internet information greatly promotes information exchange, interaction, and information sharing; and it greatly promotes the improvement of work efficiency and the simplicity and convenience of daily life [1]. However, the Internet has its own characteristics of individuality and openness. More and more computers are connected to become computer networks, and every computer on the network may become the target of attack, which makes the information security problem of the Internet more prominent. [2]. The information security of the Internet includes malicious issues such as network information tampering and counterfeiting, viruses, and hacking; it also includes nonmalicious security issues caused by information users who do not pay attention to information security and do not follow information security regulations; malicious information security and nonmalicious security are both serious threats to the information security of the Internet. Figure 1 shows a new data mining technology in the software intrusion detection framework [3]. Software intrusion detection refers to the process of identifying intrusions through various means; specifically, it refers to the collection of various user activity behavior data inside and outside the system; it also comprehensively analyzes various internal and external user activity data to discover and identify abnormal behaviors of the system.Figure 1
Data mining technology in the software intrusion detection framework.In response to Internet network information security issues, research institutions and equipment manufacturers increase the research and application of Internet network information security technology and products, and a relatively complete firewall system, unified authentication, user authority management system, software intrusion detection system, secure router equipment, and other Internet information security products have been formed. Devices, including firewall systems and unified authentication systems, usually focus on defense functions and focus on preventing the system from being illegally invaded. However, Internet network information security requires equipment that prevents the system from being illegally invaded, and network software intrusion detection systems are also needed to monitor, attack, and counter-attack network security in real time [4]. At present, many research institutions and manufacturers have done a lot of research and practice on software intrusion detection technology and system application. However, improving the accuracy of software intrusion detection and reducing the false alarm rate and false alarm rate of software intrusion detection is the constant pursuit of research and application, which has strong theoretical and practical significance for the research of software intrusion detection technology [5]. Under the current trend of social life informatization, the application of software intrusion detection system is of great significance to financial institutions, government agencies, national defense and military departments, and other security-sensitive units. Timely detection and appropriate response to an intrusion can greatly reduce the damage and impact and help to quickly identify and bring perpetrators to justice [6]. Using data mining technology in updating the intrusion detection model, we should not only improve the accuracy of new intrusion data, but also remove the relatively backward detection data in the intrusion detection model in time, so as to comprehensively improve the performance of intrusion detection.Based on this research, the author proposes an application of data mining technology in software intrusion detection and information processing, obtain hidden and unknown potentially useful information by mining a large amount of data, accurately obtain the correlation characteristics between intrusion data, avoid the huge workload caused by manual analysis and the interference of human factors, and reduce the operation and maintenance costs.


## 2. Literature Review

Data mining technology can be widely used in the computer field. Data mining refers to the automatic extraction of potential and useful new technology from the database; it is mainly used to find the internal connection between data and data, so as to make reasonable and appropriate inductive reasoning and make prediction judgments for extracting data from this [7]. Lin, P. L. and others used data mining technology for collaborative intrusion detection and propose a collaborative intrusion rule generation algorithm based on data mining; using distributed collaborative intrusion detection technology based on data mining, it can effectively detect coordinated intrusions, and it also has the ability to detect unknown coordinated attack patterns [8]. Wei, J. et al. analyzed the role of data mining technology in intrusion feature search; a feature mining model is applied in a mixed mode intrusion detection system based on network; and host is proposed [9]. Wan, J. and others analyzed how artificial intelligence methods are applied to intrusion detection systems and discussed the main related technical issues, and a case is used to illustrate the effect of applying clustering methods on enhancing the classification performance of network connections [10]. In order to effectively improve information security, Alidjinou, E. K. and others improve the performance of computer intrusion detection system, and data mining technology can be used and gradually play a very important function and role [11]. Mustiko et al., etc. through information screening or through the information already mastered, it can detect abnormal and known intrusions based on the correlation between different information, so as to comprehensively and scientifically verify the data in the computer, can effectively guarantee information security, at the same time, it can be the first time insecure or unknown in the network, or filter the hidden information, comprehensively improve the security of computer databases [12]. Wang, X. and others applied data mining technology in intrusion detection system, while giving full play to the characteristics of data mining technology, and a new type of intrusion detection model has also been formed [13]. By verifying the experimental data of the intrusion detection prototype experimental system based on data mining, Ngulde, S.I. et al. compared and analyzed the algorithm of the single intrusion detection model.Experimental results further confirm that the data mining model based on association rules and decision tree proposed in this paper is effective, especially in reducing the false positive rate of obvious effect, and has strong practical application [14]. Battini, N. et al. discussed the process of designing and implementing a network intrusion detection system based on data mining and used experiments to verify the prototype system of intrusion detection and to optimize and improve existing problems [15]. J. Zhou et al. used the research of intrusion detection technology based on data mining method as the core, discussed how to apply the clustering algorithm in data mining method in intrusion detection, and tried and proposed a nearest neighbor first algorithm based on the idea of “similar to the same kind” and the shortest distance algorithm [16]. Lin, Z. and others believe that computer intrusion detection systems have very distinct advantages, which is incomparable to previous detection systems. Data mining technology is widely used in intrusion detection system and greatly improved the performance of the intrusion detection system [17].


## 3. Research Methods

In the computer database, the application of software intrusion detection system plays a very important role and can effectively improve the stability of the computer; it can ensure the safety and efficiency of computer operation to a large extent. At the same time, in the computer database, the application software intrusion detection system can also guarantee the security of information.


### 3.1. Software Intrusion Detection

#### 3.1.1. Software Intrusion Detection Technology and Classification

Software intrusion detection technology (intrusion detection system, IDS) in the 1980s, as a proactive defense technology, was proposed, by collecting key information in the computer for analysis; then, it can be concluded whether there are violations of security policies and attacked behaviors in the network [18]. Intrusion behavior is divided into internal invasion and external invasion. Internal intrusion mainly refers to the ultra vires behavior of legitimate users; external intrusion refers to the intrusion of hackers or illegal users; intrusion will threaten the integrity, validity, and privacy of network data; and the focus of different intrusion detection technologies is different [19]. Classification of intrusion detection, according to the different results of different objects, anomaly detection, and misuse detection, is divided according to different detection technologies. Network-based and host-based are divided according to different data sources. According to the detection time, it can be divided into real time and nonreal time. The software intrusion detection system model has a unified model and a Snort model, and it is mainly composed of event generator, response unit, and database. The model is shown in Figure 2.Figure 2
Software intrusion detection system model.


#### 3.1.2. Process Analysis of Software Intrusion Detection

Faced with intrusions, the detection of the network system mainly consists of 4 steps: ① data collection stage, through external sensors or different proxy hosts, in order to search for the initial information of the system, which mainly include user behavior and status and basic data of the network; ② data processing stage, for the different types of data collected, process it, transformed into a uniform format recognized by the computer, and improve the timeliness of testing; ③ data analysis, perform a preliminary analysis of the collected information, through pattern matching with known databases or statistical analysis using probability theory, and transmit the obtained uncertain dangerous data to the control module; and ④ system response, by matching with the rule base, take corresponding countermeasures, such as reconfiguring the router, isolating the intruder’s IP, and modifying file attributes. The software intrusion detection process is shown in Figure3.Figure 3
Software intrusion detection process.


### 3.2. Application of Data Mining in Software Intrusion Detection and Information Processing

#### 3.2.1. Data Mining Technology

Data mining is in a large amount of fuzzy, noisy, and irregular data and discovers potential and relevant patterns or rules. The realization of data mining is mainly composed of 3 processes: ① the data preparation stage, including data target selection and discovery of operation objects, preprocessing and noise elimination of different types of data, and dimensionality reduction and transformation of data; ② data mining, according to different data mining models, determine the matching mining algorithm and discover potentially relevant data from a large amount of incomplete and irregular data, in order to predict the results; and ③ data representation and evaluation, perform association rules, classification, and cluster analysis on the information obtained by data mining, so as to get the value of mining data, and then express it in a simple and easy-to-understand form and realize the visualization of data. The structure of the data mining system is shown in Figure4.Figure 4
Data mining system structure.


#### 3.2.2. Data Mining Algorithm for Software Intrusion Detection

Data mining algorithm for intrusion detection of intrusion software is the most important part of the software intrusion detection system; different data mining algorithms have different advantages and disadvantages for different models; and statistical analysis, feature analysis, change and deviation analysis, and clustering are the frequently used analysis methods of data mining; the association rules are the focus of data mining algorithms and represent the relationship between data. The mathematical description of association rules is as follows: Suppose there is a databaseD, there are m pieces of information in the database, each message is Ti, each piece of information is composed of n units I, and the relationship between them is described as D=T1,T2,⋯,Tm,T=I1,I2,⋯,In. The subset of the database is represented byA; if there isA=K, then call the item setAasK; databaseDcontains the support degree of item setA, denoted byCX. If there are item setsAandB, then, the association rules between them are(1)SupportA⇒B=PA∪B,(2)ConfidenceA⇒B=PAB,where support (A) is the support degree of item set A in database D, ConfidenceA is the confidence level, and the calculation method is
(3)SupportA/%=CxD×100.Therefore, we can use the support and confidence between item setA and B, in order to determine the association rules between the two projects, assuming that the confidence level ConfidenceA⇒B of association rule A⇒B is not less than the minimum confidence level of the item set, and the support of A⇒B is greater than or equal to the minimum support; that means there is a strong association rule between item sets A and B; on the contrary, it means that the association rules between them are extremely weak. The correlation between item sets A and Bcan also be expressed by measurement.
(4)rA,B=∑A−A¯B−B¯n−1σAσB,where the average value of A and B is A¯,B¯ and the standard deviation is σA,σB.Association rules can extract the correlation between intrusions, and it can then discover potential and related intrusion patterns or rules; through the Apriori algorithm, data mining is performed on the existing intrusion data and get the association rules, and part of the code is:Pseudocode 1.
AprioribeginLI=find_frequent_1-itemset(D);For(k=2;Lk-1≠φ;k++);{Cx=apriori(Lk-1, min_sup);ForeachtransactiontD;//Scan database DCt=subset(Ck,t);//Select an associated subset from the candidate setforeachcandidatecCt:returnTRUE:returnFALSE


### 3.3. Design of Software Intrusion Detection System Based on Data Mining

In the computer database, using intrusion detection system can effectively improve the efficiency and quality of data detection. In turn, the application of data mining technology can also effectively improve the function and role of the intrusion detection system. The two are in the process of structuring; the main method of use or the method of key use is the correlation analysis method. Through the autonomous function of computer system, we can find the different correlation between them. When the network connection is successful, the system can use the function of network connection to completely analyze the attributes of different parts, in order to analyze and sort out the internal relationship between them, and to effectively analyze from the original data of the network. The results can be summarized through scientific, accurate, and objective analysis of the data without omission. Through the scientific, accurate, and objective analysis of the data, the analysis results can be summarized.


### 3.4. Overall Design of Software Intrusion Detection System

The performance requirements of the software intrusion detection prototype system mainly include the user scale of the system, concurrent processing capacity, and system response time limit; the specific performance requirements of the software intrusion detection prototype system are shown in Table1.Table 1
Performance requirements of software intrusion detection prototype system.
System performance indexSpecific performance requirements1. The scale of system usersAccording to the user group scale of the software intrusion detection prototype system, the user scale of the intrusion detection prototype system is about 300 users2. System response time limitSoftware intrusion detection prototype system needs to provide business processing and response capabilities for 50 concurrent users3. Concurrent processing capabilities of the systemThe software intrusion detection prototype system page takes no more than 3 seconds to open; data query response time does not exceed 5 secondsIn order to realize timely and effective analysis of network data, the author puts the core of the overall design of the software intrusion detection system, defined as the association rules between mining data and the sequence rules between data, according to the classification and identification defined by the rules. Since different system models correspond to different data mining algorithms, therefore, we first need to find a suitable software intrusion detection system. The Snort detection model is a lightweight open source software intrusion detection system and can effectively deal with most cyberattacks; however, the Snort detection model is not efficient, has false positives and false negatives, and cannot perform dynamic detection in real time; therefore, the Snort detection model needs to be improved [20, 21]. The overall design idea is as follows:
(1)
Add a normal behavior module to the traditional Snort detection model, targeted rule association analysis, and cluster analysis of network behavior; filter out most of the known behavior information according to these rules; and then get abnormal data(2)
Match the abnormal data by adding a rule matching module, while reducing false positives and false negatives, improve the detection effect of the system(3)
Increase the rule dynamic generation module, so that the new system has a dynamic expansion mechanism; update and iterate the rule base in a timely and effective manner; and improve the completeness of the rule baseThe improved Snort system model is shown in Figure5.Figure 5
Improved Snort system model.


#### 3.4.1. The Realization of Software Intrusion Detection System and Information Processing

Network software intrusion detection based on data mining, through mining and analysis of a large amount of known data, finds out the attack characteristics as the basis for detection. First, data collection is required, and the completeness and accuracy of data collection are the key to system implementation. The author uses the typical representative KDDCUP99 data set, in which the data set is rich in information, contains untrained network data as a test set and a marked training set, and simulates the real network attack environment [22]. The training set contains complete basic information: DOS represents data with attack characteristics, normal represents normal behavior data, U2R represents cross-level access by internal low-level users, R2L represents abnormal visits by external programs, and probing represents the detection and surveillance activities of the system itself. Since the collected raw data contains noise, redundant information cannot do data mining directly; therefore, it is necessary to standardize the data, and the data after the standardized processing, the Apriori decision tree algorithm is used to obtain the association rules and then realize data mining [23, 24]. The algorithm implementation process is as follows:
(1)
Standardize the collected data and find and discover the decision tree item set(2)
Loop processing to obtain the k-item set of the decision tree of the training set(3)
Experience each target data to be tested, and obtain the support frequency of the decision tree item set of the target data(4)
By calculating the support frequency of the network data packet and the normal option set of the decision tree, in order to determine whether it is abnormal data or normal data and then realize the network software intrusion detection


## 3.1. Software Intrusion Detection

### 3.1.1. Software Intrusion Detection Technology and Classification

Software intrusion detection technology (intrusion detection system, IDS) in the 1980s, as a proactive defense technology, was proposed, by collecting key information in the computer for analysis; then, it can be concluded whether there are violations of security policies and attacked behaviors in the network [18]. Intrusion behavior is divided into internal invasion and external invasion. Internal intrusion mainly refers to the ultra vires behavior of legitimate users; external intrusion refers to the intrusion of hackers or illegal users; intrusion will threaten the integrity, validity, and privacy of network data; and the focus of different intrusion detection technologies is different [19]. Classification of intrusion detection, according to the different results of different objects, anomaly detection, and misuse detection, is divided according to different detection technologies. Network-based and host-based are divided according to different data sources. According to the detection time, it can be divided into real time and nonreal time. The software intrusion detection system model has a unified model and a Snort model, and it is mainly composed of event generator, response unit, and database. The model is shown in Figure 2.Figure 2
Software intrusion detection system model.


### 3.1.2. Process Analysis of Software Intrusion Detection

Faced with intrusions, the detection of the network system mainly consists of 4 steps: ① data collection stage, through external sensors or different proxy hosts, in order to search for the initial information of the system, which mainly include user behavior and status and basic data of the network; ② data processing stage, for the different types of data collected, process it, transformed into a uniform format recognized by the computer, and improve the timeliness of testing; ③ data analysis, perform a preliminary analysis of the collected information, through pattern matching with known databases or statistical analysis using probability theory, and transmit the obtained uncertain dangerous data to the control module; and ④ system response, by matching with the rule base, take corresponding countermeasures, such as reconfiguring the router, isolating the intruder’s IP, and modifying file attributes. The software intrusion detection process is shown in Figure3.Figure 3
Software intrusion detection process.


## 3.1.1. Software Intrusion Detection Technology and Classification

Software intrusion detection technology (intrusion detection system, IDS) in the 1980s, as a proactive defense technology, was proposed, by collecting key information in the computer for analysis; then, it can be concluded whether there are violations of security policies and attacked behaviors in the network [18]. Intrusion behavior is divided into internal invasion and external invasion. Internal intrusion mainly refers to the ultra vires behavior of legitimate users; external intrusion refers to the intrusion of hackers or illegal users; intrusion will threaten the integrity, validity, and privacy of network data; and the focus of different intrusion detection technologies is different [19]. Classification of intrusion detection, according to the different results of different objects, anomaly detection, and misuse detection, is divided according to different detection technologies. Network-based and host-based are divided according to different data sources. According to the detection time, it can be divided into real time and nonreal time. The software intrusion detection system model has a unified model and a Snort model, and it is mainly composed of event generator, response unit, and database. The model is shown in Figure 2.Figure 2
Software intrusion detection system model.


## 3.1.2. Process Analysis of Software Intrusion Detection

Faced with intrusions, the detection of the network system mainly consists of 4 steps: ① data collection stage, through external sensors or different proxy hosts, in order to search for the initial information of the system, which mainly include user behavior and status and basic data of the network; ② data processing stage, for the different types of data collected, process it, transformed into a uniform format recognized by the computer, and improve the timeliness of testing; ③ data analysis, perform a preliminary analysis of the collected information, through pattern matching with known databases or statistical analysis using probability theory, and transmit the obtained uncertain dangerous data to the control module; and ④ system response, by matching with the rule base, take corresponding countermeasures, such as reconfiguring the router, isolating the intruder’s IP, and modifying file attributes. The software intrusion detection process is shown in Figure3.Figure 3
Software intrusion detection process.


## 3.2. Application of Data Mining in Software Intrusion Detection and Information Processing

### 3.2.1. Data Mining Technology

Data mining is in a large amount of fuzzy, noisy, and irregular data and discovers potential and relevant patterns or rules. The realization of data mining is mainly composed of 3 processes: ① the data preparation stage, including data target selection and discovery of operation objects, preprocessing and noise elimination of different types of data, and dimensionality reduction and transformation of data; ② data mining, according to different data mining models, determine the matching mining algorithm and discover potentially relevant data from a large amount of incomplete and irregular data, in order to predict the results; and ③ data representation and evaluation, perform association rules, classification, and cluster analysis on the information obtained by data mining, so as to get the value of mining data, and then express it in a simple and easy-to-understand form and realize the visualization of data. The structure of the data mining system is shown in Figure4.Figure 4
Data mining system structure.


### 3.2.2. Data Mining Algorithm for Software Intrusion Detection

Data mining algorithm for intrusion detection of intrusion software is the most important part of the software intrusion detection system; different data mining algorithms have different advantages and disadvantages for different models; and statistical analysis, feature analysis, change and deviation analysis, and clustering are the frequently used analysis methods of data mining; the association rules are the focus of data mining algorithms and represent the relationship between data. The mathematical description of association rules is as follows: Suppose there is a databaseD, there are m pieces of information in the database, each message is Ti, each piece of information is composed of n units I, and the relationship between them is described as D=T1,T2,⋯,Tm,T=I1,I2,⋯,In. The subset of the database is represented byA; if there isA=K, then call the item setAasK; databaseDcontains the support degree of item setA, denoted byCX. If there are item setsAandB, then, the association rules between them are(1)SupportA⇒B=PA∪B,(2)ConfidenceA⇒B=PAB,where support (A) is the support degree of item set A in database D, ConfidenceA is the confidence level, and the calculation method is
(3)SupportA/%=CxD×100.Therefore, we can use the support and confidence between item setA and B, in order to determine the association rules between the two projects, assuming that the confidence level ConfidenceA⇒B of association rule A⇒B is not less than the minimum confidence level of the item set, and the support of A⇒B is greater than or equal to the minimum support; that means there is a strong association rule between item sets A and B; on the contrary, it means that the association rules between them are extremely weak. The correlation between item sets A and Bcan also be expressed by measurement.
(4)rA,B=∑A−A¯B−B¯n−1σAσB,where the average value of A and B is A¯,B¯ and the standard deviation is σA,σB.Association rules can extract the correlation between intrusions, and it can then discover potential and related intrusion patterns or rules; through the Apriori algorithm, data mining is performed on the existing intrusion data and get the association rules, and part of the code is:Pseudocode 1.
AprioribeginLI=find_frequent_1-itemset(D);For(k=2;Lk-1≠φ;k++);{Cx=apriori(Lk-1, min_sup);ForeachtransactiontD;//Scan database DCt=subset(Ck,t);//Select an associated subset from the candidate setforeachcandidatecCt:returnTRUE:returnFALSE


## 3.2.1. Data Mining Technology

Data mining is in a large amount of fuzzy, noisy, and irregular data and discovers potential and relevant patterns or rules. The realization of data mining is mainly composed of 3 processes: ① the data preparation stage, including data target selection and discovery of operation objects, preprocessing and noise elimination of different types of data, and dimensionality reduction and transformation of data; ② data mining, according to different data mining models, determine the matching mining algorithm and discover potentially relevant data from a large amount of incomplete and irregular data, in order to predict the results; and ③ data representation and evaluation, perform association rules, classification, and cluster analysis on the information obtained by data mining, so as to get the value of mining data, and then express it in a simple and easy-to-understand form and realize the visualization of data. The structure of the data mining system is shown in Figure4.Figure 4
Data mining system structure.


## 3.2.2. Data Mining Algorithm for Software Intrusion Detection

Data mining algorithm for intrusion detection of intrusion software is the most important part of the software intrusion detection system; different data mining algorithms have different advantages and disadvantages for different models; and statistical analysis, feature analysis, change and deviation analysis, and clustering are the frequently used analysis methods of data mining; the association rules are the focus of data mining algorithms and represent the relationship between data. The mathematical description of association rules is as follows: Suppose there is a databaseD, there are m pieces of information in the database, each message is Ti, each piece of information is composed of n units I, and the relationship between them is described as D=T1,T2,⋯,Tm,T=I1,I2,⋯,In. The subset of the database is represented byA; if there isA=K, then call the item setAasK; databaseDcontains the support degree of item setA, denoted byCX. If there are item setsAandB, then, the association rules between them are(1)SupportA⇒B=PA∪B,(2)ConfidenceA⇒B=PAB,where support (A) is the support degree of item set A in database D, ConfidenceA is the confidence level, and the calculation method is
(3)SupportA/%=CxD×100.Therefore, we can use the support and confidence between item setA and B, in order to determine the association rules between the two projects, assuming that the confidence level ConfidenceA⇒B of association rule A⇒B is not less than the minimum confidence level of the item set, and the support of A⇒B is greater than or equal to the minimum support; that means there is a strong association rule between item sets A and B; on the contrary, it means that the association rules between them are extremely weak. The correlation between item sets A and Bcan also be expressed by measurement.
(4)rA,B=∑A−A¯B−B¯n−1σAσB,where the average value of A and B is A¯,B¯ and the standard deviation is σA,σB.Association rules can extract the correlation between intrusions, and it can then discover potential and related intrusion patterns or rules; through the Apriori algorithm, data mining is performed on the existing intrusion data and get the association rules, and part of the code is:Pseudocode 1.
AprioribeginLI=find_frequent_1-itemset(D);For(k=2;Lk-1≠φ;k++);{Cx=apriori(Lk-1, min_sup);ForeachtransactiontD;//Scan database DCt=subset(Ck,t);//Select an associated subset from the candidate setforeachcandidatecCt:returnTRUE:returnFALSE


## 3.3. Design of Software Intrusion Detection System Based on Data Mining

In the computer database, using intrusion detection system can effectively improve the efficiency and quality of data detection. In turn, the application of data mining technology can also effectively improve the function and role of the intrusion detection system. The two are in the process of structuring; the main method of use or the method of key use is the correlation analysis method. Through the autonomous function of computer system, we can find the different correlation between them. When the network connection is successful, the system can use the function of network connection to completely analyze the attributes of different parts, in order to analyze and sort out the internal relationship between them, and to effectively analyze from the original data of the network. The results can be summarized through scientific, accurate, and objective analysis of the data without omission. Through the scientific, accurate, and objective analysis of the data, the analysis results can be summarized.


## 3.4. Overall Design of Software Intrusion Detection System

The performance requirements of the software intrusion detection prototype system mainly include the user scale of the system, concurrent processing capacity, and system response time limit; the specific performance requirements of the software intrusion detection prototype system are shown in Table1.Table 1
Performance requirements of software intrusion detection prototype system.
System performance indexSpecific performance requirements1. The scale of system usersAccording to the user group scale of the software intrusion detection prototype system, the user scale of the intrusion detection prototype system is about 300 users2. System response time limitSoftware intrusion detection prototype system needs to provide business processing and response capabilities for 50 concurrent users3. Concurrent processing capabilities of the systemThe software intrusion detection prototype system page takes no more than 3 seconds to open; data query response time does not exceed 5 secondsIn order to realize timely and effective analysis of network data, the author puts the core of the overall design of the software intrusion detection system, defined as the association rules between mining data and the sequence rules between data, according to the classification and identification defined by the rules. Since different system models correspond to different data mining algorithms, therefore, we first need to find a suitable software intrusion detection system. The Snort detection model is a lightweight open source software intrusion detection system and can effectively deal with most cyberattacks; however, the Snort detection model is not efficient, has false positives and false negatives, and cannot perform dynamic detection in real time; therefore, the Snort detection model needs to be improved [20, 21]. The overall design idea is as follows:
(1)
Add a normal behavior module to the traditional Snort detection model, targeted rule association analysis, and cluster analysis of network behavior; filter out most of the known behavior information according to these rules; and then get abnormal data(2)
Match the abnormal data by adding a rule matching module, while reducing false positives and false negatives, improve the detection effect of the system(3)
Increase the rule dynamic generation module, so that the new system has a dynamic expansion mechanism; update and iterate the rule base in a timely and effective manner; and improve the completeness of the rule baseThe improved Snort system model is shown in Figure5.Figure 5
Improved Snort system model.


### 3.4.1. The Realization of Software Intrusion Detection System and Information Processing

Network software intrusion detection based on data mining, through mining and analysis of a large amount of known data, finds out the attack characteristics as the basis for detection. First, data collection is required, and the completeness and accuracy of data collection are the key to system implementation. The author uses the typical representative KDDCUP99 data set, in which the data set is rich in information, contains untrained network data as a test set and a marked training set, and simulates the real network attack environment [22]. The training set contains complete basic information: DOS represents data with attack characteristics, normal represents normal behavior data, U2R represents cross-level access by internal low-level users, R2L represents abnormal visits by external programs, and probing represents the detection and surveillance activities of the system itself. Since the collected raw data contains noise, redundant information cannot do data mining directly; therefore, it is necessary to standardize the data, and the data after the standardized processing, the Apriori decision tree algorithm is used to obtain the association rules and then realize data mining [23, 24]. The algorithm implementation process is as follows:
(1)
Standardize the collected data and find and discover the decision tree item set(2)
Loop processing to obtain the k-item set of the decision tree of the training set(3)
Experience each target data to be tested, and obtain the support frequency of the decision tree item set of the target data(4)
By calculating the support frequency of the network data packet and the normal option set of the decision tree, in order to determine whether it is abnormal data or normal data and then realize the network software intrusion detection


## 3.4.1. The Realization of Software Intrusion Detection System and Information Processing

Network software intrusion detection based on data mining, through mining and analysis of a large amount of known data, finds out the attack characteristics as the basis for detection. First, data collection is required, and the completeness and accuracy of data collection are the key to system implementation. The author uses the typical representative KDDCUP99 data set, in which the data set is rich in information, contains untrained network data as a test set and a marked training set, and simulates the real network attack environment [22]. The training set contains complete basic information: DOS represents data with attack characteristics, normal represents normal behavior data, U2R represents cross-level access by internal low-level users, R2L represents abnormal visits by external programs, and probing represents the detection and surveillance activities of the system itself. Since the collected raw data contains noise, redundant information cannot do data mining directly; therefore, it is necessary to standardize the data, and the data after the standardized processing, the Apriori decision tree algorithm is used to obtain the association rules and then realize data mining [23, 24]. The algorithm implementation process is as follows:
(1)
Standardize the collected data and find and discover the decision tree item set(2)
Loop processing to obtain the k-item set of the decision tree of the training set(3)
Experience each target data to be tested, and obtain the support frequency of the decision tree item set of the target data(4)
By calculating the support frequency of the network data packet and the normal option set of the decision tree, in order to determine whether it is abnormal data or normal data and then realize the network software intrusion detection


## 4. Results Discussion

Experimental verification first needs to build a software and hardware environment; the host server used by the author is Inteli7 processor, 32G memory, and 1 T hard disk; the software environment is VC++6.0 as the development language; the experimental data set is KDDCUP99; the database adopts MySQL8.0.11 version; and the operating system is Windows 7; by verifying the false-positive rate, false-negative rate, and detection time of different network software intrusion detection systems, in order to evaluate the effectiveness of the system, the comparison results of the detection performance of different algorithms are shown in Figure6.Figure 6
Comparison of detection performance of different algorithms.It can be seen from Figure6 that the detection system model designed by the author is under the same test sample, and the accuracy rate is 95.67%, which is higher than the other three detection systems; at the same time, the rate of false positives and false negatives is also lower than other systems and has certain advantages. At the same time, in order to verify the timeliness of the algorithm, it is necessary to compare the detection time of different algorithms.In order to verify the detection efficiency of the system, all test sets were used to verify the universality of the system. The specific effect is shown in Figure 7.Figure 7
Comparison of different system performance.It can be seen from Figure7 that while the algorithm guarantees the detection accuracy, compared with other systems, the detection time also has certain advantages and has certain theoretical and application value.


## 5. Conclusion

Applying data mining technology to software intrusion detection system can quickly and efficiently perform feature selection, establish a suitable detection model, better improve the software intrusion detection capability of the software intrusion detection system, and reduce its false-positive rate and false-negative rate. The host agent designs the software intrusion detection system. Security software intrusion detection can serve the network server well and avoid losses caused by intrusion and destruction of network servers by unsafe behaviors. Design of the software intrusion detection system management decision center can effectively improve the safety factor of the database and strengthen the security of data information. Research is only one part of data security protection design, and the related technical methods need to be improved. In the computer software intrusion detection system, the application of data mining technology can effectively filter and integrate information, thereby enhancing the role and function of computer software intrusion detection.



---

*Source: 3829160-2022-06-09.xml*