A hierarchical SOM-based intrusion detection system

H. Gunes Kayacik, A.Nur Zincir-Heywood, Malcolm I. Heywood

    Research output: Contribution to journalArticlepeer-review

    115 Citations (Scopus)


    Purely based on a hierarchy of self-organizing feature maps (SOMs), an approach to network intrusion detection is investigated. Our principle interest is to establish just how far such an approach can be taken in practice. To do so, the KDD benchmark data set from the International Knowledge Discovery and Data Mining Tools Competition is employed. Extensive analysis is conducted in order to assess the significance of the features employed, the partitioning of training data and the complexity of the architecture. Contributions that follow from such a holistic evaluation of the SOM include recognizing that (1) best performance is achieved using a two-layer SOM hierarchy, based on all 41-features from the KDD data set. (2) Only 40% of the original training data is sufficient for training purposes. (3) The ‘Protocol’ feature provides the basis for a switching parameter, thus supporting modular solutions to the detection problem. The ensuing detector provides false positive and detection rates of 1.38% and 90.4% under test conditions; where this represents the best performance to date of a detector based on an unsupervised learning algorithm.
    Original languageEnglish
    Pages (from-to)439-451
    Number of pages13
    JournalEngineering Applications of Artificial Intelligence
    Issue number4
    Early online date13 Nov 2006
    Publication statusPublished - 1 Jun 2007


    • intrusion detection systems
    • self-organizing map
    • unsupervised learning
    • benchmarking
    • hierarchical neural network


    Dive into the research topics of 'A hierarchical SOM-based intrusion detection system'. Together they form a unique fingerprint.

    Cite this