Association Rule Mining
This step is to collect and extract these attributes from the
collected log file data, to do Apriori analysis. The extracted
attributes consist of protocol (TCP or UDP), direction
(incoming or outgoing), source IP, destination IP, source port,
destination port, and action (accept or deny). Furthermore,
these attributes are defined as nominal to avoid any functional
significance for its values. A sample line of Linux firewall log
is shown in Fig. 3. Also the protocol is limited to be either TCP
or UDP for our study.