Skip to main content
Article
Hierarchical Kohonenen Net for Anomaly Detection in Network Security
IEEE Transactions on Systems, Man, and Cybernetics
  • Suseela T. Sarasamma, University of Nebraska at Omaha
  • Qiuming Zhu, University of Nebraska at Omaha
  • Julie Huff
Document Type
Article
Publication Date
4-1-2005
Disciplines
Abstract
A novel multilevel hierarchicalKohonen Net (K-Map) for an intrusion detection system is presented. Each level of the hierarchical map is modeled as a simple winner-take-all K-Map. One significant advantage of this multilevel hierarchical K-Map is its computational efficiency. Unlike other statistical anomaly detection methods such as nearest neighbor approach, K-means clustering or probabilistic analysis that employ distance computation in the feature space to identify the outliers, our approach does not involve costly point-to-point computation in organizing the data into clusters. Another advantage is the reduced network size. We use the classification capability of the K-Map on selected dimensions of data set in detecting anomalies. Randomly selected subsets that contain both attacks and normal records from the KDD Cup 1999 benchmark data are used to train the hierarchical net. We use a confidence measure to label the clusters. Then we use the test set from the same KDD Cup 1999 benchmark to test the hierarchical net. We show that a hierarchical K-Map in which each layer operates on a small subset of the feature space is superior to a single-layer K-Map operating on the whole feature space in detecting a variety of attacks in terms of detection rate as well as false positive rate.
Comments

© 2005 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.”

Citation Information
Suseela T. Sarasamma, Qiuming Zhu and Julie Huff. "Hierarchical Kohonenen Net for Anomaly Detection in Network Security" IEEE Transactions on Systems, Man, and Cybernetics Vol. 35 Iss. 2 (2005) p. 302 - 312
Available at: http://works.bepress.com/qiuming-zhu/15/