Host-based intrusion detection using self-organizing maps
Peter Lichodzijewski, Nur Zincir-Heywood, Malcolm Iain Heywood · 2003
Hierarchical SOMs are applied to the problem of host based intrusion detection on computer networks. Unlike systems based on operating system audit trails, the approach operates on real-time data without extensive off-line training and with minimal expert knowledge. Specific recommendations are made regarding the representation of time, network parameters and SOM architecture.