Network Intrusion Detection based on Dynamic Self-Organizing Map.docVIP

Network Intrusion Detection based on Dynamic Self-Organizing Map 　　Abstract: Self-organizing Map (SOM) is getting more attention in the intrusion detection. Considering current intrusion detection system with high false alarm rate and low detection rate, this paper introduces a simple modification to the SOM that eliminates learning rate, weight update and trust degree, and adds automatic clustering. The improved SOM (DSOM) is implemented and applied to the intrusion detection. The validities and feasibilities of the DSOM are confirmed through experiments on KDD Cup 99 dataset. The experimental result shows that the detection rate has been increased by employing the DSOM. 　　Key words: intrusion detection; neural networks; self-organizing map; learning rate. 　　1 Introduction 　　An intrusion can be defined as a series of activities aiming at compromising the security of a computer network system. Intrusions may take many forms: external attacks, internal misuses, network-based attacks, information gathering and denial of service, and so on. Intrusion detection is an important step of protecting the computer network system from intrusions. Intrusion detection systems (IDSs) are used to detect, identify and stop intruders. The administrators can rely on them to find out successful attacks and prevent a future use of known exploits. IDSs are also considered as a complementary solution to firewall technology by recognizing attacks against the network that are missed by the firewall. 　　Intrusion detection techniques can be mapped into four classes: anomaly detection, misuse detection, specification-based detection and model-based detection. Anomaly detection consists of establishing normal behavior profile for user and system activity and observing significant deviations of actual user activity with respect to the established habitual pattern. Misuse detection refers to intrusions that follow well defined attack patterns that exploit weaknesses in system and applic