Detection of TCP Attacks Using SOM with Fast Nearest-Neighbor Search

Abstract:- A new approach of anomaly intrusion detection (AID) is proposed in this paper. The Self-Organizing Map (SOM) is used to construct the normal usage profiles of network traffic, and in the training phase and detection phase, the Vector Elimination Nearest-Neighbor Search (VENNS) algorithm is designed and implemented. The design procedure optimizes the performance of AID by jointly accounting for accurate usage profile modeling by SOM codebook and fast vector similarity measure using the fast Nearest-Neighbor search. In data processing, according to the characters of TCP attacks, a novel feature extraction approach of TCP flow state is implemented. Using the DARPA Intrusion Detection Evaluation Data Set, we implement the performance evaluation and comparison analysis. It is shown that the performance and efficiency of anomaly intrusion detection are improved greatly: the training time cost can be shortened about by four times and seven times for detection time cost. Key-Words:- anomaly intrusion detection; Self-Organizing Map; fast Nearest-Neighbor search; normal usage profile; codebook; quantization error