Statistics-enhanced direct batch growth self-organizing mapping for efficient dos attack detection

Abstract

As an artificial neural network method, self-organizing mapping facilities efficient complete and visualize high-dimensional data topology representation, valid in a number of applications such as network intrusion detection. However, there remains a challenge to accurately depict the topology of network traffic data with unbalanced distribution, which deteriorates the performance of e.g. DoS attack detection. Hence, we propose a new model of the 'statistic-enhanced directed batch growth self-organizing mapping', renew the definition of the growth threshold used to evaluate/control neuron expansion, and first introduce the inner distribution factor for fine-grained data distinguishing. The numerical experiments based on two datasets, KDD99, and CICIDS2017, demonstrate that the key performance in DoS attack detection including the detection rate, the false positive rate, and the training time are greatly enhanced thanks to the statistic concepts consulted in the proposed model.