Hybrid Classification Approach Using Self-Organizing Map and Back Propagation Artificial Neural Networks for Intrusion Detection

Abstract

the study is intended to enhance the accuracy of intrusion detection systems by combining supervised and unsupervised machine learning techniques. In this work a combination of hybrid approach is implemented, in which a supervised and unsupervised machine learning techniques are used. The unsupervised Self-Organization Map (SOM) is used to identify normal/up-normal activities. In this case a Back Propagation Neural Network (BPNN) is used for the classification of attack traffic into various types. This approach resulted in a NSL_KDD dataset of various normal/up-normal records, represented by 41 features. The obtained results show that the proposed approach has improved the performance and accuracy of the intrusion detection system. From the results it can be seen that the implemented approach achieved up to 98% detection rate, compared to previous methods that at best achieved 96% detection rate. From the study and the result obtained it can be concluded that the combination of multi-tire classification approach has improved the detection rate of the IDS. The choice of combining SOM and BPNN has proven to be an efficient approach. It is intended to extend this work by implementing different combination strategies that involve methods that would results in further detection rate enhancement.