Hierarchical Kohonenen Net for anomaly detection in network security

IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics

Volumn 35, Issue 2, 2005, Pages 302-312

  Sarasamma, Suseela T ^a   Zhu, Qiuming A ^b   Huff, Julie ^a  

^a NORTHROP GRUMMAN MISSION SYSTEMS   (United States)

^b UNIVERSITY OF NEBRASKA AT OMAHA   (United States)

Author keywords

Computer network security; Neural network applications; Self organizing feature maps

Indexed keywords

COMPUTATIONAL METHODS; COMPUTER CRIME; HIERARCHICAL SYSTEMS; MATHEMATICAL MODELS; NEURAL NETWORKS; PROBABILITY; SECURITY OF DATA; SECURITY SYSTEMS; SELF ORGANIZING MAPS; STATISTICAL METHODS;

ANOMALY DETECTION; COMPUTER NETWORK SECURITY; DETECTION RATES; HIERARCHICAL KOHONENEN NET; INTRUSION DETECTION SYSTEM; NETWORK SECURITY; NEURAL NETWORK APPLICATIONS;

COMPUTER NETWORKS;

ALGORITHM; ARTICLE; ARTIFICIAL INTELLIGENCE; ARTIFICIAL NEURAL NETWORK; AUTOMATED PATTERN RECOGNITION; COMPARATIVE STUDY; COMPUTER NETWORK; COMPUTER SECURITY; COMPUTER SIMULATION; EVALUATION; METHODOLOGY; STATISTICAL MODEL; VALIDATION STUDY;

ALGORITHMS; ARTIFICIAL INTELLIGENCE; COMPUTER COMMUNICATION NETWORKS; COMPUTER SECURITY; COMPUTER SIMULATION; MODELS, STATISTICAL; NEURAL NETWORKS (COMPUTER); PATTERN RECOGNITION, AUTOMATED;

EID: 17444432965     PISSN: 10834419     EISSN: None     Source Type: Journal    
DOI: 10.1109/TSMCB.2005.843274     Document Type: Article

References (27)

1. W. Lee, S. Stolfo, and K. Mok, "A data mining framework for building intrusion detection models," in Proc. 1999 IEEE Symp. Security and Privacy, 1999, pp. 120-132.
2. S. Stolfo, W. Fan, W. Lee, A. Prodromidis, and P. Chan, "Cost-based modeling and evaluation for fraud and intrusion detection: Results from the JAM project," in Proc. DARPA Information Survivabilty Conf. and Expo., vol. II, 2000, pp. 130-144.
3. S. Stolfo et al.. (2002) The Third International Knowledge Discovery and Data Mining Tools Competition. Online. Available: http://kdd.ics.uci.edu/databases/kddCup99/kddCup99.html
4. P. Wasserman, Neural Computing Theory and Practice. New York: Van Nostrand, 1989.
5. S. Northcut and J. Novak, Network Intrusion Detection, 3rd ed. Indianapolis, IN: New Riders, 2002.
6. K. Fox, R. Henning, and J. Reed, "A neural network approach toward intrusion detection," in Proc. 13th Nat. Computer Security Conf., Washington, DC, 1990.
7. J. Cannady and J. Mahaffey, "The application of artificial intelligence to misuse detection," in Proc. 1st Recent Advances in Intrusion Detection (RAID) Conf., Louvain-la-Neuve, Belgium, 1998.
8. B. Rhodes, J. Mahaffey, and J. Cannady, "Multiple self-organizing maps for intrusion detection," in Proc. 23rd Nat. Information Systems Security Conf., Baltimore, MD, Oct. 2000.
9. C. Jirapummin, N. Wattanapongsakorn, and P. Kanthamanon. Hybrid Neural Networks for Intrusion Detection Systems. Online. Available: http://dbvis.fmi.uni-konstanz-de/members/panse/seminar_ws0203/
10. H. Kayacik, A. Zincir-Heywood, and M. Heywood, "On the capability of an SOM based intrusion detection system," in Proc. IEEE Int. Joint Conf. Neural Networks (IJCNN'03), pp. 1808-1813.
11. W. Lee, S. Stolfo, P. Chan, E. Eskin, W. Fan, M. Miller, S. Hershkop, and J. Zhang, "Real time data mining-based intrusion detection," in Proc. 2nd DARPA Information Survivability Conf. and Expo., vol. 1, 2001, pp. 89-100.
12. D. Denning, "An intrusion-detection model," IEEE Trans. Software Eng., vol. SE-13, no. 2, pp. 222-232, Feb. 1987.
13. R. P. LippMann, D. J. Fried, I. Graf, J. W. Haines, K. R. Kendall, D. McClung, D. Weber, S. E. Webster, D. Wyschogrod, R. K. Cunningham, and M. A. Zissman, "Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation," in Proc. DARPA Information Survivability Conf. and Expo., vol. 2, 2000, pp. 12-26.
14. J. McHugh, "Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln laboratory," ACM Trans. Inform. Syst. Security, vol. 3, pp. 262-294, 2000.
15. R. A. Maxion and K. M. C. Tan, "Benchmarking Anomaly-based detection systems," in Proc. 1st Int. Conf. Dependable Systems and Networks New York, pp. 623-630.
16. R. A. Maxion and K. M. C. Tan, "Anomaly detection in embedded systems," IEEE Trans. Comput., vol. 51, no. 2, pp. 108-120, Feb. 2002.
17. K. M. C. Tan and R. A. Maxion, "Determining the operational limits of an anomaly-based intrusion detector," IEEE J. Select. Areas Commun. vol. 21, no. 1, pp. 96-110, Jan. 2003.
18. T. Kohonen, Self-Organizing Maps, 3rd extended ed, ser. Information Sciences. Berlin, Germany: Springer, 2001, vol. 30.
19. H. Ying, T. Feng, J. Cao, X. Ding, and Y. Zhou, "Research on some problems in the Kohonen SOM algorithm," in Proc. Int. Conf. Machine Learning and Cybernetics, vol. 3, Nov. 2002, pp. 1279-1282.
20. R. A. Kemmerer and G. Vigna, "Intrusion detection: A brief history and overview," Computer, vol. 35, no. 4, pp. 27-30, Apr. 2002.
21. S. Cho, "Incorporating soft computing techniques into a probabilistic intrusion detection system," IEEE Trans. Syst., Man, Cybern., pt. C, vol. 32, no. 2, pp. 154-160, May 2002.
22. N. Ye, S. M. Emran, Q. Chen, and S. Vilbert, "Multivariate statistical analysis of audit trails for host-based intrusion detection," IEEE Trans. Comput., vol. 51, no. 7, pp. 810-820, Jul. 2002.
23. M. Hagenbuchner, A. Sperduti, and A. Tsoi, "A self-organizing map for adaptive processing of structured data," IEEE Trans. Neural Netw. vol. 14, no. 3, pp. 491-505, May 2003.
24. H. Yin, "ViSOM - A novel method for multivariate data projection and structure visualization," IEEE Trans. Neural Netw., vol. 13, no. 1, pp. 237-243, Jan. 2002.
25. C. Manikopoulos and S. Papavassiliou, "Network intrusion and fault detection: A statistical anomaly approach," IEEE Commun. Mag., vol. 40, no. 10, pp. 76-82, Oct. 2002.
26. N. Ye, Y. Zhang, and C. M. Borror, "Robustness of the Markov-chain model for cyber-attack detection," IEEE Trans. Rel., vol. 53, no. 1, pp. 116-123, Mar. 2004.
27. A. H. Sung and S. Mukkamala, "Identifying important features for intrusion detection using support vector machines and neural networks," in Proc. 2003 Symp. Applications and the Internet, Jan. 2003, pp. 209-216.