Network Anomaly Detection Based on DSOM and ACO Clustering

@inproceedings{Feng07, abstract = {An approach to network anomaly detection is investigated, based on dynamic self-organizing maps (DSOM) and ant colony optimization (ACO) clustering. The basic idea of the method is to produce the cluster by DSOM and ACO. With the classified data instances, anomaly data clusters can be easily identified by normal cluster ratio. And then the identified cluster can be used in real data detection. In the traditional clustering-based intrusion detection algorithms, clustering using a simple distance-based metric and detection based on the centers of clusters, which generally degrade detection accuracy and efficiency. Our approach based on DSOM and ACO clustering can settle these problems effectively. The experiment results show that our approach can detect unknown intrusions efficiently in the real network connections.}, author = {Feng, Yong and Zhong, Jiang and Xiong, Zhong-Yang and Ye, Chun-Xiao and Wu, Kai-Gui }, booktitle = {Advances in Neural Networks – ISNN 2007}, citeulike-article-id = {3040004}, doi = {http://dx.doi.org/10.1007/978-3-540-72393-6\_113}, journal = {Advances in Neural Networks – ISNN 2007}, keywords = {cas\_chapter, ids, security, som}, pages = {947--955}, posted-at = {2008-07-24 15:50:59}, priority = {5}, series = {LNCS}, title = {Network Anomaly Detection Based on DSOM and ACO Clustering}, url = {http://dx.doi.org/10.1007/978-3-540-72393-6\_113}, year = {2007} }

TY - CONF ID - Feng07 L3 - citeulike-article-id:3040004 TI - Network Anomaly Detection Based on DSOM and ACO Clustering T2 - Advances in Neural Networks – ISNN 2007 SE - LNCS JF - Advances in Neural Networks – ISNN 2007 SP - 947 EP - 955 N2 - An approach to network anomaly detection is investigated, based on dynamic self-organizing maps (DSOM) and ant colony optimization (ACO) clustering. The basic idea of the method is to produce the cluster by DSOM and ACO. With the classified data instances, anomaly data clusters can be easily identified by normal cluster ratio. And then the identified cluster can be used in real data detection. In the traditional clustering-based intrusion detection algorithms, clustering using a simple distance-based metric and detection based on the centers of clusters, which generally degrade detection accuracy and efficiency. Our approach based on DSOM and ACO clustering can settle these problems effectively. The experiment results show that our approach can detect unknown intrusions efficiently in the real network connections. KW - cas_chapter KW - ids KW - security KW - som AU - Feng, Yong AU - Zhong, Jiang AU - Xiong, Zhong-Yang AU - Ye, Chun-Xiao AU - Wu, Kai-Gui PY - 2007/// UR - http://dx.doi.org/10.1007/978-3-540-72393-6_113 ER -