Network Intrusion Detection Based on Dynamic Self-Organizing Map

Conference paper
Part of the Lecture Notes in Electrical Engineering book series (LNEE, volume 223)


Self-organizing map (SOM) is getting more attention in the intrusion detection. Considering current intrusion detection system with high false alarm rate and low detection rate, this paper introduces a simple modification to the SOM that eliminates learning rate, weight update, and trust degree, and adds automatic clustering. The improved SOM (DSOM) is implemented and applied to the intrusion detection. The validities and feasibilities of the DSOM are confirmed through experiments on KDD Cup 99 dataset. The experimental result shows that the detection rate has been increased by employing the DSOM.


Intrusion detection Neural networks Self-organizing map Learning Rate 


  1. 1.
    Kohonen T (2006) Self-organizing neural projects. Neural Netw 19:723–733MATHCrossRefGoogle Scholar
  2. 2.
    Depren O, Topallar M, Anarim E, Ciliz MK (2005) An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks. Expert Syst Appl 29:713–722CrossRefGoogle Scholar
  3. 3.
    Ramadas M, Ostermann S, Tjaden B (2003) Detecting anomalous network traffic with self-organizing maps, vol 9. In: Sixth international symposium on recent advances in intrusion detection, pp 36–38Google Scholar
  4. 4.
    Zhang Z-L, Sun S-H, Zheng F-C (2001) Image fusion based on median filters and SOM neural networks: a three-step scheme, vol 2. Signal Processing, EURASIP, pp 1325–1330Google Scholar
  5. 5.
    Heywood M, Lichodzijewski P, Zincir-Heywood N (2006) Dynamic intrusion detection using self-organizing maps, vol 9. In: The annual Canadian information technology security symposium, pp 101–105Google Scholar
  6. 6.
    Binh Viet N (2006) Self organizing map (SOM) for anomaly detection, Expert Syst Appl 2:35–38Google Scholar
  7. 7.
    Lichodzijewski P, Zincir Heywood AN, Heywood MI (2002) Host-based intrusion detection using self-organizing maps, vol 1. In: The proceedings of the 2002 IEEE world congress on computational intelligence, Honolulu, HI, pp 1714–1719Google Scholar
  8. 8.
    Wasniowski RA (2005) Using self-organizing networks for intrusion detection, vol 6. In: Proceedings of the 6th WSEAS international conference on neural networks, Lisbon, Portugal, pp 90–94Google Scholar
  9. 9.
    Patole VA, Pachghare VK, Parag K (2010) Self organizing maps to build intrusion detection system. Int J Comput Appl 1(8):975–977Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  1. 1.Department of Information Engineering Henan Radio and Television UniversityZhengzhouChina

Personalised recommendations