Intrusion detection method based on improved growing hierarchical self-organizing map

Abstract

Considering that growing hierarchical self-organizing map (GHSOM) ignores the influence of individual component in sample vector analysis, and its accurate rate in detecting unknown network attacks is relatively lower, an improved GHSOM method combined with mutual information is proposed. After theoretical analysis, experiments are conducted to illustrate the effectiveness of the proposed method by accurately clustering the input data. Based on different clusters, the complex relationship within the data can be revealed effectively.

Keywords

growing hierarchical self-organizing map(GHSOM) / hierarchical structure / mutual information / intrusion detection / network security

References

[1] Lei Guanjun. Present situation and development trend of network intrusion detection technology[J]. Journal of Hubei Correspondence University, 2011, 24(6): 81-110.

[2] Corey V, Peterman C, Shearin S, et al. Network forensics analysis[J]. IEEE Internet Computing, 2002, 6(6): 60-66.

[3] Qing S, Jiang J, Ma H, et al. Research on intrusion detection techniques: A survey[J]. Journal of China Institute of Communications, 2004, 25(7): 19-29.

[4] Palomo E J, North J, Elizondo D, et al. Application of growing hierarchical SOM for visualization of network forensics traffic data[J]. Neural Networks, 2012, 32: 275-284.

[5] Zolotukhin M, Hämäläinen T, Juvonen A. Online anomaly detection by using N-gram model and growing hierarchical self-organizing maps[C]. 2012 8th International Wireless Communications and Mobile Computing Conference(IWCMC), 2012.

[6] Ippoliti D, Zhou X. A-GHSOM: An adaptive growing hierarchical self organizing map for network anomaly detection[J]. Journal of Parallel and Distributed Computing, 2012, 72(12): 1576-1590.

[7] Brugger T. KDD Cup’99 Dataset Considered Harmful[R], 2007, Davis, USA: Department of Computer Science, University of California.

[8] Huang S Y, Tsaih R H. The prediction approach with growing hierarchical self-organizing map[C]. The 2012 In ternational Joint Conference on Neural Networks (IJCNN), 2012.

[9] Huang S Y, Huang Y. Network forensic analysis using growing hierarchical SOM[C]. 2013 IEEE 13th International Conference on Data Mining Workshops (ICDMW), 2013.

[10] You L Z, Mu Z C. Based on improved GHSOM network to predict customer's trick behavior[J]. Computer Engineering and Applications, 2007, 43(11): 193-196.

[11] Yang Y H, Jiang D B, Shen Q N, et al. Research on intrusion detection based on an improved GHSOM[J]. Journal on Communications, 2011, 32(1): 121-126.

[12] Brugger S T. Data Mining Methods for Network Intrusion Detection[R], 2004, Davis, USA: University of California.

[13] Palomo E J, Domínguez E, Luque R M, et al. An intrusion detection system based on hierarchical self-organization [C]. Proceedings of the International Workshop on Computational Intelligence in Security for Information Systems, 2008.

[14] Chen N, Ribeiro B, Vieira A, et al. Clustering and visualization of bankruptcy trajectory using self-organizing map[J]. Expert Systems with Applications, 2013, 40(1): 385-393.

[15] Kopylova Y, Buell D A, Huang C T, et al. Mutual information applied to anomaly detection[J]. Journal of Communications and Networks, 2008, 10(1): 89-97.

[16] Abe N, Zadrozny B, Langford J. Outlier detection by active learning[C]. Proceedings of the 12th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2006.