GHSOM Intrusion Detection Based On Dempster-shafer Theory

The current intrusion detection technology still has many deficiencies in practical application, such as high false positive rate and false negative rate, low detection efficiency and low degree of intelligent. In order to improve the detection accuracy and reduce false positive rate and false negative rate, researchers most had focused on the choice of suitable data sources and data attributes, improvement of existing detection algorithm, or to research new and better algorithms and improve the framework of the intrusion detection model and so on.The existing intrusion detection systems are mostly based on technology of misuse detection and anomaly detection technology. Misuse detection is relatively simple. This method uses feature detection methods. There is a higher detection accuracy. The disadvantages are also obvious. It cannot test some disguised malicious acts or which had been added signature database for accurate determination invasion. Anomaly detection technology will estimate abnormal standard by according to the characteristic of the average of the previous attacks. The extent of the intrusion is the exception to determine the need for a specific threshold. This threshold level is very difficult to determine. If the threshold values too low, there will be a lot of false positives,making the false positive rate more higher. If too high, intrusion detection will miss true invasion and cannot play its due role.In response to the problem, on the basis of incremental GHSOM can unsupervised rely on feature data to deal with the fault clustering and recognition.The neural network can also be hierarchical and dynamic growth, analyzing data,clearing the inner level to modular analysis, and ultimately clustering data recognition by fuzzy to clear. Also it can be noted that if only observed separately for each data, it is difficult to judge the legitimacy of the behavior is an intrusion. If many contextual data unified investigation, expert system which according to experience will work well. This method can instead of the traditional detectionmethod.On the basis of incremental GHSOM, the GHSOM neural network intrusion detection based on the theory of evidence reasoning method is put forward. It can deal with the uncertainty caused by randomness and fuzziness, as well as can constantly narrow assumptions set by accumulating the evidence, effectively control dynamic growth of network and keep a good accuracy in fuzzy data set.Experiments show that GHSOM intrusion detection method based on the Dempster Shafer theory realized the dynamic control for the scale of expended subnet during the process of detection. It has the better detection accuracy in fuzzy data set and it improves the adaptability and extensibility of incremental GHSOM neural network intrusion detection method when the scale of network is expanded.