IAWorkshop 2006 - Attack Characterization and Intrusion Detection using an Ensemble of Self-Organizing Maps

7^th Annual IEEE Information Assurance Workshop

21-23 June 2006

"The West Point Workshop"

United States Military Academy, West Point, New York

Chair: LTC Ronald Dodge, Ronald.Dodge@usma.edu	http://www.itoc.usma.edu/workshop/2006

Attack Characterization and Intrusion Detection using an Ensemble of Self-Organizing Maps

Lori DeLooze

The 7th IEEE Information Assurance Workshop (IAWorkshop 2006)
West Point, New York, USA, June 21-23, 2006

Abstract

Self-Organized Maps (SOM) use an unsupervised learning technique to independently organize a set of input patterns into various classes. In this paper, we use an ensemble of SOMs to identify computer attacks and characterize them appropriately using the major classes of computer attacks (Denial of Service, Probe, User-to-Root and Remote-to-Local). The procedure produces a set of confidence levels for each connection as a way to describe the connection’s behavior.

START Conference Manager (V2.52.3)

Maintainer: rrgerber@softconf.com

The IEEE Information Assurance Workshop is sponsored by the IEEE Systems Man and Cybernetics Society, supported by the National Security Agency, and hosted by the Information Technology Operations Center, Department of Electrical Engineering and Computer Science, at the United States Military Academy, West Point, New York.