The International Symposium on Parallel Architectures, Algorithms, and Networks (i-span 2008) Growing Hierarchical Self-Organizing Map for Filtering Intrusion Detection Alarms May 07-May 09 ISBN: 978-0-7695-3125-0
A Network Intrusion Detection System (NIDS) monitors all network actions and generates alarms when it detects suspicious attempts. We present a data mining technique to assist network administrators to analyze and reduce false positive alarms that are produced by a NIDS. Our data mining technique is based on a Growing Hierarchical Self-Organizing Map (GHSOM) that adjusts its architecture during an unsupervised training process according to the characteristics of the input alarm data. GHSOM clusters these alarms in a way that supports network administrators in making decisions about true and false alarms. Our empirical results show that our technique is useful for real-world intrusion data.
Index Terms:
alarm filtering, computer security, growing hierarchical self-organizing map, intrusion detection, self-organizing map
Citation:
Maya Shehab, Nashat Mansour, Ahmad Faour, "Growing Hierarchical Self-Organizing Map for Filtering Intrusion Detection Alarms," ispan, pp.167-172, The International Symposium on Parallel Architectures, Algorithms, and Networks (i-span 2008), 2008 Usage of this product signifies your acceptance of the Terms of Use. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb