Computer Network Intrusion Detection: an Integrated Approach Using Self Organizing Maps and Fuzzy Cognitive Maps

A typical problem that arises when deploying intrusion detection sensors is their affinities of producing high rate of false alerts. Thus, it needs huge analysis efforts and time consuming odd jobs at higher levels. In this study, we have investigated an approach to anomaly intrusion detection based on causal knowledge reasoning. The approach is anomaly-based and utilizes causal knowledge inference based fuzzy cognitive maps (FCM) and self organizing maps (SOM). A set of parallel neural network classifiers (SOM) are used to do an initial recognition of the network traffic flow to detect abnormal behaviors. The FCM is incorporated to eliminate ambiguities of odd neurons and making final decisions. Based on the domain knowledge of network data the SOM/FCM combination presents quantitative and qualitative matching correspondences which in turn reduce the number of suspicious neurons i.e. reduce the number of false alerts. This method works as a unique fuzzy clustering approach and we have demonstrated its performance using DARPA 1999 network traffic data set. The method has also the flexibility of features selection for further exploration.