A-GHSOM: Adaptive Growing Hierarchical Self Organizing Map for Network Intrusion Detection

 Anomaly detection and misuse detection are two major types of network intrusion detection systems.  Machine learning approaches have been used for anomaly detection. In particular, approaches based on self-organizing maps (SOMs) of artificial neural networks have shown effectiveness at identifying “unknown” attacks.  Effectiveness of using traditional SOM models is limited by the static nature of the model architecture. The size and dimensionality of the SOM model is fixed prior to the training process and is determined by trial and error.  GHSOM is an SOM model that does not use a predetermined map topology. Instead, the size and the dimensionality of the map dynamically grow during the training process to optimally fit the training set based on user defined parameters.