基于改进的自组织映射入侵检测方法

Intrusion detection method based on improved self-organization mapping

入侵检测作为保障互联网安全的主要措施之一,对于网络入侵的识别和诊断有着重要的意义。将自组织映射(SOM)的思想引入网络入侵检测中,提出了一种基于SOM的网络入侵检测算法。算法通过对SOM神经网络中输出神经元的邻域密度进行排名,同时结合受试者工作特征(ROC)曲线设置邻域密度阈值等方法,使得入侵检测的结果通过输出神经元的邻域密度进行表达,克服了SOM神经网络训练时容易产生畸变导致输出神经元自身的聚类结果难以理解的缺点。通过对算法仿真实验,表明该算法不仅有效而且拥有相当可观的检测率。

Intrusion detection is one of the main measures to ensure the Internet safety, and has important significance to recognize and diagnose the network intrusion. In this paper, the thought of self-organization mapping （SOM） is introduced into the network intrusion detection, and a network intrusion detection algorithm based on SOM is proposed. The neighborhood densi- ty of output neurone in SOM neural network is ranked. The method of setting the neighborhood density threshold in combination with receiver operating characteristic （ROC） curve makes the intrusion detection results express by neighborhood density of the output neurone. The disadvantage that the clustering results of output neurone itself are hard to understand has been overcome, which is caused by the distortion generating in SOM neural network training. The simulation experiments of the algorithm show that the algorithm is effective, and has appreciable detection rate.