NSOM: A Tool To Detect Denial Of Service Attacks Using Self-Organizing Maps

An implementation of a network based Intrusion Detection System using a SelfOrganizing Map (SOM) as a clustering tool is described. The system uses a SOM to classify Ethernet data in real-time. A graphical tool constantly displays the clustered data to reflect network activities. The impact of using different techniques for data collection, data preprocessing and classifier design is discussed. The system shows promise in its ability to classify regular traffic verses irregular traffic as a result of a Denial of Service (DoS) attack on a given host.