Attack Characterization and Intrusion Detection using an Ensemble of Self-Organizing Maps

Self-organized maps (SOM) use an unsupervised learning technique to independently organize a set of input patterns into various classes. In this paper, we use an ensemble of SOMs to identify computer attacks and characterize them appropriately using the major classes of computer attacks (denial of service, probe, user-to-root and remote-to-local). The procedure produces a set of confidence levels for each connection as a way to describe the connection´s behavior.