SELF-ORGANIZING MAPS FOR INTRUSION/ANOMALY DETECTION

Abstract

In this report, a complete procedure for detecting anomalies in network traffic data is introduced. As the kernel of this procedure, Self Organizing Map is applied as an unsupervised learning method. Useful features for detecting certain types of attacks are discussed and tested. The method for selecting these features is also introduced. The result shows that Self Organizing Map is suitable to be applied on the areas of detecting anomalies on the TCP layer, and it is also promising to be applied to detect more specific anomalies on application layer protocols such as HTTP as well as lower level protocols such as ICMP.