The detection of temporally distributed network attacks using an adaptive hierarchical neural network

The accurate detection of attacks in ad hoc computer networks is made significantly more difficult if the components of the attack sequence are distributed throughout the network data stream. Since current approaches to detecting network intrusions rely on associating individual network actions the temporal distribution of an attack throughout a network makes it extremely difficult to accurately identify the intrusion. This paper describes an approach to detecting temporally distributed attacks based on a modified Hierarchical Quilted Self-Organizing Map (HQSOM). The HQSOM approach emulates some aspects of biological neural networks by distributing the reasoning capability throughout a hierarchical structure. The approach described here combines an adaptive learning parameter with variable spatial and temporal clustering to associate the components of the attack. The results of the evaluation of the approach and opportunities for additional research are also described.