Network-based anomaly intrusion detection system using SOMs

Network-based anomaly intrusion detection systems using artificial neural networks are investigated. From knowledge of only normal traffic data, a mathematical model describing normal traffic is constructed and a test is conducted based on the deviations from the mathematical model. A self-organizing map (SOM) structure is used for constructing the mathematical model describing normal traffic and anomaly detection. The SOM structure preserves topological mappings between representations. A feature which is desired when classifying normal or intrusive behavior for network data, our hypothesis is that normal traffic representing normal behavior would be clustered around one or more cluster centers and any irregular traffic representing abnormal, and possibly suspicious, behavior would be clustered outside of the normal clustering or inside with high quantization error. The SOM is trained with normal traffic data and by considering the best matching unit or clustering region and the quantization error, the type of traffic is determined.