Fourth IEEE International Workshop on Information Assurance (IWIA'06)
POSEIDON: a 2-tier Anomaly-based Network Intrusion Detection System
Royal Holloway, United Kingdom
April 13-April 14
ISBN: 0-7695-2564-4
We present POSEIDON, a new anomaly-based network intrusion detection system. POSEIDON is payload-based, and has a two-tier architecture: the first stage consists of a Self-Organizing Map, while the second one is a modified PAYL system. Our benchmarks on the 1999 DARPA data set show a higher detection rate and lower number of false positives than PAYL and PHAD.
Citation:
Damiano Bolzoni, Sandro Etalle, Pieter Hartel, Emmanuele Zambon, "POSEIDON: a 2-tier Anomaly-based Network Intrusion Detection System," iwia, pp.144-156, Fourth IEEE International Workshop on Information Assurance (IWIA'06), 2006