Anomaly detection using fast SOFM

Abstract

Different with the host-based anomaly detection, the huge volume of network traffic requires machine learning algorithms more efficient in the network-based anomaly detection. In this paper, the more efficient detection frame based on the SOFM algorithm with the fast nearest-neighbor searching strategy to detect the attack is proposed. We apply the detection frame to DARPA Intrusion Detection Evaluation Dataset. It is shown that the network attacks are detected with relatively low false alarms and more efficiency. The performance of anomaly detection model is improved greatly. © Springer-Verlag 2004.