Abstract:Network intrusion detection is the problem of detecting unauthorised use of, or access to, computer systems over a network. Two broad approaches exist to tackle this problem: anomaly detection and misuse detection. An anomaly detection system is trained only on examples of normal connections, and thus has the potential to detect novel attacks. However, many anomaly detection systems simply report the anomalous activity, rather than analysing it further in order to report higher-level information that is of more use to a security officer. On the other hand, misuse detection systems recognise known attack patterns, thereby allowing them to provide more detailed information about an intrusion. However, such systems cannot detect novel attacks. A hybrid system is presented in this paper with the aim of combining the advantages of both approaches. Specifically, anomalous network connections are initially detected using an artificial immune system. Connections that are flagged as anomalous are then categorised using a Kohonen Self Organising Map, allowing higher-level information, in the form of cluster membership, to be extracted. Experimental results on the KDD 1999 Cup dataset show a low false positive rate and a detection and classification rate for Denial-of-Service and User-to-Root attacks that is higher than those in a sample of other works.

An Intrusion Detection System Model Based on Self-Organizing Map

Application of Supervised SOM Neural Network in Intrusion Detection

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

Intrusion detection method based on improved self-organization mapping

A hybrid neural network approach to the classification of novel attacks for intrusion detection

Research on Intrusion Detection Based on an Improved SOM Neural Network

Multi-agent based hybrid Intrusion detection system

Intrusion Detection Model Based on Hybrid AIS/SOM

Intrusion detection based on dynamic self-organizing map neural network clustering

Intrusion Detection Classifier Based on Dynamic SOM and Swarm Intelligence Clustering

A Model Based on Hybrid Support Vector Machine and Self-Organizing Map for Anomaly Detection

Correlating Intrusion Alerts Into Attack Scenarios Based On Improved Evolving Self-Organizing Maps

Quantum Self Organized Map-based intrusion detection system

Self-Organizing Map assisted Deep Autoencoding Gaussian Mixture Model for Intrusion Detection

Quantum Growing Hierarchical Self Organized Map-Based Intrusion Detection System

Model of Intrusion Detection System Based on ODM

A hybrid artificial immune system and Self Organising Map for network intrusion detection

Creating an Explainable Intrusion Detection System Using Self Organizing Maps

An Adaptive Growing Hierarchical Self Organizing Map for Network Intrusion Detection

An Abnormal Detection Model Based on Hybrid Clustering and Self Organizing Map

Intrusion detection using PCASOM neural networks