An Intrusion Detection Method Based On Improved Growing Hierarchical Self-Organizing Map

With the wide application of computer networks,the means of network intrusion are becoming diversity,network security issues become the focus of research in the computer field,traditional technical methods such as the firewall have not defense all kinds of network attack,intrusion detection technology has become an important method to defense network attack and protect the safety of network,intrusion detection method based on neural network is important direction of intrusion detection technology?SOM(Self-Organizing Map)and GHSOM(Growing Hierarchical Self-Organizing Map)are the two major neural network detection model,have the ability of detecting network attacks predictably,self-organizing and self-learning,but whether GHSOM or SOM are only considered the learning rate and the relationship between the input mode with the weight of neighborhood,ignoring the importance of each component in the input mode network structure for further study,ignoring the relationship between the component of input mode with the weights of all the competing neurons,network intrusion detection need to improve the accuracy further.For the issue that the limitations of SOM and GHSOM against in the weight adjustment process which led to the low detection rate of network attack,we introduce the mutual information algorithm of the information theory,and it will be combined with GHSOM.Using the feature that the mutual information can clearly reflect the interdependence relationship between two random variables,and comprehensive analysis that the mutual information between the input component and the output layer neurons.The correlation coefficient of the mutual information is introduced to the core step that adjusting the weights of GHSOM in the training process,effectively enhance the ability of the output layer neurons self-organizing learning,avoiding too much redundant information of doping,less loss of information,able to detect network intrusion behavior at low error rate.Using the KDD CUP99 dataset to do intrusion detection experiments,the improved algorithm based on GHSOM and the mutual information have the different degrees of increase for the detection rates of Probe,R2 L and U2 R,especially for Probe and R2 L these two network attacks,the Probe detection rate increased from 92.83% to 95.93%,R2 L increased from 87.56% to 91.49%,verifying the effectiveness of the method,.Finally,the introduction of visualization technology to display the experimental results and do further analysis shows that GHSOM combined with the mutual information has significant increase of the attack detection rate,it has great advantages in terms of network intrusion detection,having high practical value.