自组织映射神经网络在入侵检测中的应用  

Application of self-organization map neural network in intrusion detection

作　　者：贾伟峰[1,2] 张凤荔[1] 童彬[1] 万明成[1] 

机构地区：[1]电子科技大学计算机科学与工程学院,成都610054 [2]安阳师范学院,河南安阳455000

出　　处：《计算机工程与应用》2009年第23期115-117,共3页Computer Engineering and Applications

基　　金：国家242信息安全计划项目No.2006C27~~

摘　　要：提出了一种基于SOM神经网络的入侵检测方法。该方法采用有标签的数据训练SOM神经网络,然后根据训练的结果标记正常数据和异常数据聚类的神经元。检测时则根据被检测数据的最佳匹配神经元的标签判断攻击是否发生。为验证检测的有效性,采用KDD cup99的训练集与测试集,将基于SOM的检测方法与基于SVM的检测方法的检测效果做了对比。实验结果表明:基于SOM的入侵检测方法具有检测率高、训练时间短和通用性强等特点。An intrusion detection method based on SOM is proposed.At training phase of the intrusion detection,SOM neural network is trained with labeled dataset and then label neurons with ＇normal＇ or ＇attack＇ according to the training result.During the procedure of detection,unknown data is determined whether it is normal or not according its＇ BMU＇s label.For validate the performance of this method,resuh of detection using SVM is compared to method proposed in this paper with KDD cup99 dataset,and the experiment shows that SOM based intrusion detection method has a better detection rate while consuming limit time.

关 键 词：自组织映射 入侵检测 网络安全 神经网络 支持向量机 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]