Network intrusion prevention by using hierarchical self-organizing maps and probability-based labeling

Authors:
Andres Ortiz;Julio Ortega;Antonio F. Díaz;Alberto Prieto
Affiliations:
Communications Engineering Department. University of Malaga, Malaga, Spain;Department of Computer Architecture and Technology. University of Granada, Granada, Spain;Department of Computer Architecture and Technology. University of Granada, Granada, Spain;Department of Computer Architecture and Technology. University of Granada, Granada, Spain
Venue:
IWANN'11 Proceedings of the 11th international conference on Artificial neural networks conference on Advances in computational intelligence - Volume Part I
Year:
2011

Citing 7
Cited 0

Self-Organizing Maps

Self-Organizing Maps
Detecting Anomalous and Unknown Intrusions Against Programs

ACSAC '98 Proceedings of the 14th Annual Computer Security Applications Conference
Intrusion detection using hierarchical neural networks

Pattern Recognition Letters
On the versatility of radial basis function neural networks: A case study in the field of intrusion detection

Information Sciences: an International Journal
Network security using growing hierarchical self-organizing maps

ICANNGA'09 Proceedings of the 9th international conference on Adaptive and natural computing algorithms
Selection of effective network parameters in attacks for intrusion detection

ICDM'10 Proceedings of the 10th industrial conference on Advances in data mining: applications and theoretical aspects
The growing hierarchical self-organizing map: exploratory analysis of high-dimensional data

IEEE Transactions on Neural Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

Nowadays, the growth of the computer networks and the expansion of the Internet have made the security to be a critical issue. In fact, many proposals for Intrusion Detection/Prevention Systems (IDS/IPS) have been proposed. These proposals try to avoid that corrupt or anomalous traffic reaches the user application or the operating system. Nevertheless, most of the IDS/IPS proposals only distinguish between normal traffic and anomalous traffic that can be suspected to be a potential attack. In this paper, we present a IDS/IPS approach based on Growing Hierarchical Self-Organizing Maps (GHSOM) which can not only differentiate between normal and anomalous traffic but also identify different known attacks. The proposed system has been trained and tested using the well-known DARPA/NSL-KDD datasets and the results obtained are promising since we can detect over 99,4% of the normal traffic and over 99,2 % of attacker traffic. Moreover, the system can be trained on-line by using the probability labeling method presented on this paper.