Self-Organizing Maps versus Growing Neural Gas in Detecting Data Outliers for Security Applications

  • Zorana Banković
  • David Fraga
  • Juan Carlos Vallejo
  • José M. Moya
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7209)


Our previous work has demonstrated that clustering-based outlier detection approach offers numerous advantages for detecting attacks in Wireless Sensor Networks, above all adaptability and the possibility to detect unknown attacks. In this work we provide a comparison of Self-organizing maps (SOM) and Growing Neural Gas (GNG) used for this purpose. Our results reveal that GNG is superior to SOM when it comes to the level of presence of anomalous data during the training, as GNG is capable of detecting the attack even with small portion of normal data during the training, while SOM need the majority of the training data to be normal in order to detect it. On the other hand, after both being trained with normal data, SOM performs somewhat better as the attack becomes more aggressive, i.e. it exhibits higher detection rate, although both are capable of detecting the attack in each case.


Self-organizing maps growing neural gas outliers wireless sensor networks 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Banković, Z., Moya, J.M., Araujo, A., Fraga, D., Vallejo, J.C., de Goyeneche, J.M.: Distributed Intrusion Detection System for WSNs based on a Reputation System coupled with Kernel Self-Organizing Maps. Int. Comp. Aided Design 17(2), 87–102 (2010)Google Scholar
  2. 2.
    Haykin, S.: Neural networks - A comprehensive foundation, 2nd edn. Prentice-Hall (1999)Google Scholar
  3. 3.
    Fritzke, B.: Growing Neural Gas Network Learns Topologies. In: Tesauro, G., Touretzky, D.S., Leen, T.K. (eds.) Advances in Neural Information Processing Systems, vol. 7, pp. 625–632. MIT Press, Cambridge (1995)Google Scholar
  4. 4.
    Roosta, T.G.: Attacks and Defenses on Ubiquitous Sensor Networks, Ph. D. Dissertation. University of California at Berkeley (2008)Google Scholar
  5. 5.
    Rieck, K., Laskov, P.: Linear Time Computation of Similarity for Sequential Data. J. Mach. Learn. Res. 9, 23–48Google Scholar
  6. 6.
    Muñoz, A., Muruzábal, J.: Self-Organizing Maps for Outlier Detection. Neurocomputing 18(1-3), 33–60 (1998)CrossRefGoogle Scholar
  7. 7.
    Krontiris, I., Giannetsos, T., Dimitriou, T.: LIDeA: A Distributed Lightweight Intrusion Detection Architecture for Sensor Networks. In: 4th International Conference on Security and Privacy for Communication Networks. ACM (2008)Google Scholar
  8. 8.
    Onat, I., Miri, A.: A Real-Time Node-Based Traffic Anomaly Detection Algorithm for Wireless Sensor Networks. In: Systems Communications, pp. 422–427. IEEE Press (2005)Google Scholar
  9. 9.
    Kaplantzis, S., Shilton, A., Mani, N.: Sekercioglu, Y.A.:Detecting Selective Forwarding Attacks in WSNs using Support Vector Machines. In: Proc. Conf. Int. Sensors, Sensor Networks and Inf., pp. 335–340. IEEE Press (2007)Google Scholar
  10. 10.
    Wallenta, C., Kim, J., Bentley, P.J., Hailes, S.: Detecting Interest Cache Poisoning in Sensor Networks using an Artificial Immune Algorithm. Appl. Intell. 32, 1–26 (2010)CrossRefGoogle Scholar
  11. 11.
    Loo, C.E., Ng, M.Y., Leckie, C., Palaniswami, M.: Intrusion Detection for Routing Attacks in Sensor Networks. Int. J. of Dist. Sens. Net. 2(4), 313–332 (2006)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Zorana Banković
    • 1
  • David Fraga
    • 1
  • Juan Carlos Vallejo
    • 1
  • José M. Moya
    • 1
  1. 1.ETSI TelecomunicaciónUniv. Politécnica de MadridMadridSpain

Personalised recommendations