ar X iv : c s / 05 11 04 3 v 1 [ cs . C R ] 1 1 N ov 2 00 5 Poseidon : a 2 - tier Anomaly - based Intrusion Detection System ∗

We present Poseidon, a new anomaly based intrusion detection system. Poseidon is payload-based, and presents a two-tier architecture: the first stage consists of a Self-Organizing Map, while the second one is a modified PAYL system [22]. Our benchmarks on the 1999 DARPA data set [15] show a higher detection rate and lower number of false positives than PAYL and PHAD.