Hierarchical Kohonenen net for anomaly detection in network security.

Area of Science:

• Computer Science
• Artificial Intelligence
• Network Security

Background:

• Intrusion detection systems (IDS) are crucial for network security.
• Traditional anomaly detection methods often involve computationally expensive distance calculations.
• Existing methods may struggle with large, high-dimensional datasets.

Purpose of the Study:

• To introduce a novel multilevel hierarchical Kohonen Net (K-Map) for enhanced intrusion detection.
• To demonstrate the computational efficiency and reduced network size of the proposed hierarchical K-Map.
• To evaluate the effectiveness of the hierarchical K-Map in detecting network attacks.

Main Methods:

• The proposed system utilizes a multilevel hierarchical Kohonen Map (K-Map) architecture.
• Each level of the hierarchy is a winner-take-all K-Map operating on selected data dimensions.
• The system was trained and tested using the KDD Cup 1999 benchmark dataset, employing a confidence measure for cluster labeling.

Main Results:

• The hierarchical K-Map demonstrates superior computational efficiency compared to traditional methods like nearest neighbor or K-means.
• The approach results in a reduced network size, enhancing practicality.
• The multilevel hierarchical K-Map achieved higher detection rates and lower false positive rates for various attacks than a single-layer K-Map.

Conclusions:

• A multilevel hierarchical K-Map provides an efficient and effective solution for intrusion detection.
• Operating on subsets of the feature space in each layer enhances anomaly detection performance.
• This method offers a promising alternative to computationally intensive anomaly detection techniques.