By Topic

Network-based anomaly intrusion detection system using SOMs

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

4 Author(s)
M. O. Depren ; Bogazici Univ., Istanbul, Turkey ; M. Topallar ; E. Anarim ; K. Ciliz

Network-based anomaly intrusion detection systems using artificial neural networks are investigated. From knowledge of only normal traffic data, a mathematical model describing normal traffic is constructed and a test is conducted based on the deviations from the mathematical model. A self-organizing map (SOM) structure is used for constructing the mathematical model describing normal traffic and anomaly detection. The SOM structure preserves topological mappings between representations. A feature which is desired when classifying normal or intrusive behavior for network data, our hypothesis is that normal traffic representing normal behavior would be clustered around one or more cluster centers and any irregular traffic representing abnormal, and possibly suspicious, behavior would be clustered outside of the normal clustering or inside with high quantization error. The SOM is trained with normal traffic data and by considering the best matching unit or clustering region and the quantization error, the type of traffic is determined.

Published in:

Signal Processing and Communications Applications Conference, 2004. Proceedings of the IEEE 12th

Date of Conference:

28-30 April 2004