| As an important component of current Internet security architecture, an intrusion detection system is to distinguish between normal behaviour and abnormal behaviour. Intrusion detection systems based on neural network solve the problems of traditional rule-based or pattern-based expert systems; meanwhile, they bring high negative rate and high false rate problem. They also have slow learning processes and large computation. These problems are relative to the features inputted to neural network.On research of primary characteristics and algorithms of neural network, it is found that big number of dimensions of inputted data leads to expanding of neural network and large computation. In recognizing patterns, these inputted data's effect is not the same. Some features have effect, but the others have less or even none.The physical locations of the neurons that similar patterns fired are neighboring. It is based on the learning algorithm of self-organizing feature map neural network, and proved in the paper. To a pattern, competitiveness of neurons in competitive layer decrease in a certain area which the center is the fired neuron. The class of an inputted pattern is represented by a certain area of the fired neuron.Using this characteristic of self-organizing feature map neural network, the intrusion behavior is detected with a series of features combination. This method can reduce the computation effectively by selecting features and deleting unnecessary features, and it is proved in the paper. The experiment shows that this method can improve negative rate and false rate of current intrusion detection systems based on neural networks.A model of intrusion detection system based on neural networks is proposed. The detection procedure of the system is described. All modules and relationship of these modules are discussed in details. |
