Detecting anomalous network traffic with self-organizing maps

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 2820, Issue , 2003, Pages 36-54

  Ramadas, Manikantan ^a   Ostermann, Shawn ^a   Tjaden, Brett ^b  

^a OHIO UNIVERSITY   (United States)

^b JAMES MADISON UNIVERSITY   (United States)

Author keywords

Anomaly Detection; Intrusion Detection; Self Organizing Maps

Indexed keywords

CONFORMAL MAPPING; INTRUSION DETECTION; MERCURY (METAL); NEURONS;

ANOMALY DETECTION; DIMENSIONAL VECTORS; INTEGRATED NETWORKS; NETWORK BASED INTRUSION DETECTION SYSTEMS; NETWORK CONNECTION; REAL-TIME OPERATION; SELF ORGANIZING MAP ALGORITHM; TWO-DIMENSIONAL LATTICES;

SELF ORGANIZING MAPS;

EID: 35248842651     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-45248-5_3     Document Type: Article

References (25)

1. Bind named 8.2.x Remote Exploit. http://downloads.securityfocus.com/vulnerabilities/exploits/tsig.c.
2. HTTP Tunnel, http://www.nocrew.org/software/httptunnel.html.
3. Snort - The Open Source Network Intrusion Detection System. http://www.snort.org.
4. SOM Toolbox for Matlab. http://www.cis.hut.fi/projects/somtoolbox.
5. SOM_PAK. http://www.cis.hut.fi/research/som_lvq_pak.shtml.
6. VU#196945 ISC BIND 8 Buffer Overflow in TSIG Handling Code. http://www.kb.cert.org/vuls/id/196945.
7. Phillip A. Porras and Alfonso Valdes. Live Traffic Analysis of TCP/IP Gateways. In Proceedings of the ISOC Symposium on Network and Distributed Systems Security, 1998.
8. T. Berners-Lee, R. Fielding, and H. Frystyk. Hypertext Transfer Protocol - HTTP/1.0, May 1996. RFC 1945.
9. Ethan Blanton. TCPurify. http://irg.cs.ohiou.edu/∼eblanton/tcpurify.
10. James Cannady and Jim Mahaffey. The Application of Artificial Intelligence to Misuse Detection. In Proceedings of the First Recent Advances in Intrusion Detection (RAID) Conference, 1998.
11. Internet Software Consortium. Bind. http://www.isc.org/products/BIND.
12. Internet Software Consortium. Internet Domain Survey, Jan 2003. http://www.isc.org/ds/WWW-200301/index.html.
13. R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and T. Berners-Lee. Hypertext Transfer Protocol - HTTP/1.1, June 1999. RFC 2616.
14. J. Hollmen. Principal Component Analysis. http://www.cis.hut.fi/∼jhollmen/dippa/node29.html.
15. Chaivat Jirapummin, Naruemon Wattanapongsakorn, and Prasert Kanthamanon. Hybrid Neural Networks for Intrusion Detection System, 2002.
16. K. Tan and B. Collie. Detection and Classification of TCP/IP Network Services. In Proceedings of the 13th Annual Computer Security Applications Conference, 1997.
17. Peter Lichodzijewski, A.Nur Zincir-Heywood, and Malcolm I. Heywopd. Dynamic Intrusion Detection Using Self-Organizing Maps. In The 14th Annual Canadian Information Technology Security Symposium (CITSS), 2002.
18. Peter Lichodzijewski, A.Nur Zincir-Heywood, and Malcolm I. Heywood. Host-based Intrusion Detection Using Self-Organizing Maps. In The IEEE World Congress on Computational Intelligence, International Joint Conference on Neural Networks, IJCNN'02, 2002.
19. Shawn Ostermann. Tcptrace - TCP Connection Analysis Tool. http://www.tcptrace.org.
20. P.A. Porras and P.G. Neumann. EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances. In Proceedings of the National Information Security Conference, pages 353-365, Oct 1997.
21. P. Mockapetris. Domain Names - Concepts and Facilities, November 1987. RFC 1034.
22. Manikantan Ramadas. Detecting Anomalous Network Traffic with Self-Organizing Maps. Master's thesis, Ohio University, Mar 2003. http://irg.cs.ohiou.edu/∼mramadas/documents/MS-Thesis/thesis.pdf.
23. Brandon Craig Rhodes, James A. Mahaffey, and James D.Cannady. Multiple Self-Organizing Maps for Intrusion Detection. In Proceedings of the 23rd National Information Systems Security Conference, 2000.
24. The Sendmail Consortium. Sendmail. http://www.sendmail.org.
25. T. Kohonen. Self Organizing Maps. Springer, third edition, 2001.