The University of Southampton
University of Southampton Institutional Repository

A Hybrid Artificial Immune System and Self Organising Map for Network Intrusion Detection

Record type: Article

Network intrusion detection is the problem of detecting unauthorised use of, or access to, computer systems over a network. Two broad approaches exist to tackle this problem: anomaly detection and misuse detection. An anomaly detection system is trained only on examples of normal connections, and thus has the potential to detect novel attacks. However, many anomaly detection systems simply report the anomalous activity, rather than analysing it further in order to report higher-level information that is of more use to a security officer. On the other hand, misuse detection systems recognise known attack patterns, thereby allowing them to provide more detailed information about an intrusion. However, such systems cannot detect novel attacks. A hybrid system is presented in this paper with the aim of combining the advantages of both approaches. Specifically, anomalous network connections are initially detected using an artificial immune system. Connections that are flagged as anomalous are then categorised using a Kohonen Self Organising Map, allowing higher-level information, in the form of cluster membership, to be extracted. Experimental results on the KDD 1999 Cup dataset show a low false positive rate and a detection and classification rate for Denial-of-Service and User-to-Root attacks that is higher than those in a sample of other works.

Full text not available from this repository.

Citation

Powers, Simon T and He, Jun (2008) A Hybrid Artificial Immune System and Self Organising Map for Network Intrusion Detection Information Sciences, 178, (15), pp. 3024-3042. (doi:10.1016/j.ins.2007.11.028).

More information

Published date: August 2008
Keywords: Artificial Immune System, Self Organizing Map, Intrusion detection, Negative selection, Anomaly detection, Genetic algorithm
Organisations: Electronics & Computer Science

Identifiers

Local EPrints ID: 264908
URI: http://eprints.soton.ac.uk/id/eprint/264908
ISSN: 0020-0255
PURE UUID: 96469041-e322-44ba-b787-02104610003f

Catalogue record

Date deposited: 28 Nov 2007 11:58
Last modified: 18 Jul 2017 07:31

Export record

Altmetrics

Contributors

Author: Simon T Powers
Author: Jun He

University divisions


Download statistics

Downloads from ePrints over the past year. Other digital versions may also be available to download e.g. from the publisher's website.

View more statistics

Atom RSS 1.0 RSS 2.0

Contact ePrints Soton: eprints@soton.ac.uk

ePrints Soton supports OAI 2.0 with a base URL of http://eprints.soton.ac.uk/cgi/oai2

This repository has been built using EPrints software, developed at the University of Southampton, but available to everyone to use.

We use cookies to ensure that we give you the best experience on our website. If you continue without changing your settings, we will assume that you are happy to receive cookies on the University of Southampton website.

×