Hybrid model of self-organizing map and kernel auto-associator for internet intrusion detection
Hybrid model of self-organizing map and kernel auto-associator for internet intrusion detection
复制标题
用于互联网入侵检测的自组织映射和内核自动关联器的混合模型
DOI：
--
复制
发表时间：
2012
影响因子：
4.3
通讯作者：
Wenjin Lu
中科院分区：
文献类型：
--
作者：
Bailing Zhang;Yungang Zhang;Wenjin Lu
Purpose – The task of internet intrusion detection is to detect anomalous network connections caused by intrusive activities. There have been many intrusion detection schemes proposed, most of which apply both normal and intrusion data to construct classifiers. However, normal data and intrusion data are often seriously imbalanced because intrusive connection data are usually difficult to collect. Internet intrusion detection can be considered as a novelty detection problem, which is the identification of new or unknown data, to which a learning system has not been exposed during training. This paper aims to address this issue.Design/methodology/approach – In this paper, a novelty detection‐based intrusion detection system is proposed by combining the self‐organizing map (SOM) and the kernel auto‐associator (KAA) model proposed earlier by the first author. The KAA model is a generalization of auto‐associative networks by training to recall the inputs through kernel subspace. For anomaly detection, the SOM...
