A-GHSOM: An adaptive growing hierarchical self organizing map for network anomaly detection

Journal of Parallel and Distributed Computing

Volumn 72, Issue 12, 2012, Pages 1576-1590

  Ippoliti, Dennis ^a   Zhou, Xiaobo ^a  

^a University of Colorado at Colorado Springs   (United States)

Author keywords

Detection accuracy; False positive rate; Growing hierarchical self organizing map; Network anomaly detection; Online adaptation

Indexed keywords

DETECTION ACCURACY; FALSE POSITIVE RATES; GROWING HIERARCHICAL SELF-ORGANIZING MAPS; NETWORK ANOMALY DETECTION; ON-LINE ADAPTATION;

DATA PROCESSING;

INTRUSION DETECTION;

EID: 84867826492     PISSN: 07437315     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.jpdc.2012.09.004     Document Type: Article

References (38)

1. N. Abe, B. Zadrozny, J. Langford, Outlier detection by active learning, in: Proceedings of the 12th ACM SIGKDD Int'l Conference on Knowledge Discovery and Data Mining, KDD, 2006.
2. C.C. Aggarwal, P.S. YU, Outlier detection with uncertain data, in: Proceedings of the SIAM Int'l Conference on Data Mining, SDM, 2008.
3. Y. Bouzida, F. Cuppens, N. Cuppens-Boulahia, S. Gombault, Efficient intrusion detection using principal component analysis, in: Proceedings of the 3eme Conference Surla Securite et Architectures Reseaux, SAR, 2004.
4. S.-T. Brugger, KDD Cup'99 dataset considered harmful, Position Letter, KD Nuggets newsletter, vol. 07 (18), 2007.
5. S.-T. Brugger, J. Chow, An assessment of the DARPA IDS evaluation dataset using Snort, Technical Report CSE-2007-1, University of California, Davis, Department of Computer Science, Davis, CA, 2007.
6. J. Cannady, J. Mahaffey, The application of artificial intelligence to misuse detection, in: Proceedings of the First Recent Advances in Intrusion Detection Conference, RAID, 1998.
7. B. Caswell, M. Roesch, Snort: the open source network intrusion detection system, 2004. http://www.snort.org/.
8. V. Chandola, A. Banerjee, and V. Kumar Anomaly detection: a survey ACM Computing Surveys 41 3 2009
9. W.-H. Chen, S.-H. Hsu, and H.-P. Shen Application of SVM and ANN for intrusion detection Computer and Operations Research 32 2005 2617 2634
10. K. Das, J. Schneider, Detecting anomalous records in categorical datasets, in: Proceedings of the 13th ACM SIGKDD Int'l Conference on Knowledge Discovery and Data Mining, KDD, 2007.
11. D. Denning An intrusion-detection model IEEE Transactions on Softwre Engineering 13 2 1987
12. O. Depren, M. Topallar, E. Anarim, and M.K. CilizAn An intelligent intrusion detection system for anomaly and misuse detection in computer networks Expert Systems with Applications 29 2005 713 722
13. M. Dittenbach, D. Merkl, A. Rauber, The growing hierarchical self organizing map, in: Proceedings of the Int'l Joint Conference on Neural Networks, 2000.
14. E. Eskin, A. Arnold, M. Prerau, L. Portnoy, and S. Stolfo A geometric framework for unsupervised anomaly detection: detecting intrusions in unlabeled data Applications of Data Mining in Cumputer Security 2002 (Chapter 4)
15. V. Golovko, P. Kachurka, L. Vaitsekhovich, Neural network ensembles for intrusion detection, in: Proceedings of IEEE Int'l Workshop on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications, 2007.
16. K.K. Gupta, B. Nath, and R. Kotagiri Layered approach using conditional random fields for intrusion detection IEEE Transactions on Dependable and Secure Computing 7 1 2010 35 49
17. S. Hettich, S. Bay, The UCI KDD archive, University of California, Irvine, 1999. http://kdd.ics.uci.edu.
18. D. Ippoliti, X. Zhou, An adaptive growing hierarchical self organizing map for network intrusion detection, in: Proceedings of the 19th IEEE Int'l Conference on Computer Communications and Networks, ICCCN, pp. 1-7, 2010.
19. D. Jiang, Y. Yang, M. Xia, Research on intrusion detection based on an improved SOM neural network, in: Proceedings of the Fifth Int'l Conference on Information Assurance and Security, 2009.
20. H.G. Kayacik, Z.-H. Nur, and M.I. Heywood A hierarchical SOM-based intrusion detection system Engineering Applications of Artificial Intelligence 20 2007
21. H.G. Kayacik, Z.-H. Nur, M.I. Heywood, On the capability of an SOM based intrusion detection system, in: Proceedings of the Int'l Joint Conference on Neural Networks, vol. 3, 2003.
22. LBNL/ICSI enterprise tracing project. http://www.icir.org/enterprise- tracing/.
23. Y. Li, B. Fang, L. Guo, Y. Chen, Network anomaly detection based on TCM-KNN algorithm, in: Proceedings of ACM Symposium on Information, Computer and Communications Security, 2007.
24. R.P. Lippmann, D.J. Fried, I. Graf, J.W. Haines, K. Kendall, D. McClung, D. Weber, S. Webster, D. Wyschogrod, R.K. Cunningham, M. Zissman, Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation, in: Proceedings of the DARPA Information Survivability Conference and Exposition, 2000.
25. M.V. Mahoney, P.K. Chan, An analysis of the 1999 DARPA/Lincoln laboratory evaluation data for network anomaly detection, in: Proceedings of the 6th International Symposium on Recent Advances in Intrusion Detection, RAID, 2003.
26. J. McHugh Testing intrusion detection systems: a critique of the 1998 and 1999 darpa intrusion detection system evaluations as performed by Lincoln laboratory ACM Transactions on Information and System Security 3 4 2000 262 294
27. The MetaSploit project. http://www.metasploit.com/.
28. NMAP security scanner. http://nmap.org/.
29. E. Palomo, E. Dominguez, R. Luque, J. Munoz, A new GHSOM model applied to network security, in: Proceedings of the 18th Int'l Conference on Artificial Neural Networks, 2008.
30. B. Rhodes, J. Mahaffey, J. Cannady, Multiple self-organizing maps for intrusion detection, in: Proceedings of the 23rd National Information Systems Security Conference, 2000.
31. S. Sarasamma, Q. Zhu, and J. Huff Hierarchical Kohonenen net for anomaly detection in network security IEEE Transaction on Systems, Man, and Cybernetics - Part B: Cybernetics 35 2 2005 302 312
32. M.G. Schultz, E. Eskin, E. Zadok, S.J. Stolfo, Data mining methods for detection of new malicious executables, in: Proceedings of the IEEE Symposium on Security and Privacy, 2001.
33. S.L. Scott A Bayesian paradigm for designing intrusion detection systems Computational Statistics and Data Analysis 45 2004 69 83
34. G. Shu, D. Lee, Testing security properties of protocol implementations - a machine learning based approach, in: Proceedings of IEEE Int'l Conference on Distributed Computing Systems, ICDCS, 2007.
35. M. Thottan, and C. Ji Anomaly detection in IP networks IEEE Transactions on Signal Processing 51 8 2003 2191 2204
36. C. Tsai, Y. Hsu, C. Lin, and W. Lin Intrusion detection by machine learning: a review Expert Systems with Applications 36 10 2009 11994 12000
37. WireShark network protocol analyzer. http://www.wireshark.org/.
38. Z. Yu, J. Tsai, and T. Weigert An adaptive automatically tuning intrusion detection system ACM Transactions on Autonomous and Adaptive Systems 3 3 2008