Intrusion Detection Based on Self-Organizing Map and Artificial Immunisation Algorithm

Abstract

The rate of false positives which caused by the variability of environment and user behavior limits the applications of intrusion detecting system in real world. Intrusion detection is an important technique in the defense-in-depth network security framework and a hot topic in computer security in recent years. To solve the intrusion detection question, we introduce the self-organizing map and artificial immunisation algorithm into intrusion detection. In this paper, we give an method of rule extraction based on self-organizing map and artificial immunisation algorithm and used in intrusion detection. After illustrating our model with a representative dataset and applying it to the real-world datasets MIT lpr system calls. The experimental result shown that We propose an idea of learning different representations for system call arguments. Results indicate that this information can be effectively used for detecting more attacks with reasonable space and time overhead. So our experiment is feasible and effective that using in intrusion detection.

Multistep Attack Detection and Alert Correlation in Intrusion Detection Systems

“…Several papers propose clustering algorithms, support vector machines [6] and neural networks as the main detection engine for the implementation of anomaly-based network intrusion detection systems. In particular, the use of Self-Organizing Maps (SOM) for the implementation of an anomaly-based IDS was proposed in [13], [8] and [1]. Unlike previous literature mainly oriented to anomaly detection, in this paper we propose SOM and clustering algorithms for the postprocessing of security alerts generated by a signature-based NIDS.…”

“…The correlation value between two alerts is always normalized in [0,1]. This definition of correlation is commutative, and it does not express any causality correlation.…”