An enhanced GHSOM for the intrusion detection

According to the improvement of data mining technologies, big data now is a hot topic in various areas, such as Internet, finance, healthcare etc. As well as known, big data is collected and accumulated across a wide variety of fields fast and in real time. It is very important to find the structure from big data. In this paper, we focus on the neral network algorithm, Growing Hierarchical Self-Organizing Maps (GHSOM). GHSOM is considered that it can provide structured clustering. However, the hierarchical growing mechanism of GHSOM is faulty. This paper proposes a new enhanced GHSOM, called sGHSOM. sGHSOM solves the issue of the growing mechanism in GHSOM. We use the KDD Cup 1999 Data as the benchmark for estimating the performance of sGHSOM. The experiment results show that sGHSOM has a higher precision than GHSOM on classification. Furthermore, this paper uses actual measured DNS queries to show that sGHSOM can visualize the structure of DNS queries in time series exactly for detecting infected computers comparing with GHSOM.