Aiming to increase network security auditing efficiency, an audit system with good efficiency has been generated through Agent and log mining technology. This paper improves the traditional association rule mining algorithm Apriori and designs a new data structure in which each brother node is in a parallel alignment, each child node has a pointer directing to their children node and sibling node, the audit system can only scan the database once. Experiments show that compared with traditional Apriori, the improved algorithm has greatly reduced the I/O expenditure of the system, having obvious superiority.
