Growing hierarchical self-organizing map for alarm filtering in network intrusion detection systems

Ahmad Faour (1) , Philippe Leray (2) , Bassam Eter

1 LITIS - Laboratoire d'Informatique, de Traitement de l'Information et des Systèmes
2 LINA - Laboratoire d'Informatique de Nantes Atlantique

It is a well-known problem that intrusion detection systems overload their human operators by triggering thousands of alarms per day. This paper presents a new approach for handling intrusion detection alarms more efficiently. Neural Network analyses based on the self-organizing map (SOM) and the growing hierarchical self-organizing map (GHSOM) are used to discover interrest patterns signs of potential scenarios of attacks aiming each machine in the network. The GHSOM addresses two main limits of SOM which are caused, on the one hand, by the static architecture of this model, as well as, on the other hand, by the limited capabilities for the representation of hierarchical relations of the data. The experiments conducted on several logs extracted from the SNORT NIDS, confirm that the GHSOM can form an adaptive architecture, which grows in size and depth during its training process, thus to unfold the hierarchical structure of the analyzed logs of alerts.

Domaines: Apprentissage [cs.LG]

Ahmad Faour, Philippe Leray, Bassam Eter. Growing hierarchical self-organizing map for alarm filtering in network intrusion detection systems. NTMS'07, 2007, Paris, France. pp.CDROM, ⟨10.1007/978-1-4020-6270-4_58⟩. ⟨hal-00412943⟩