Reason for Hierarchical Self Organized Map-Based Intrusion Detection System Incapable of Increasing Detection Rate

When the single-layered self organized map (SOM) is used for anomaly detection, ldquooverlaprdquo exists for five types of samples. The hierarchical SOM system, which increases classification granularity, can not effectively enhance the detection rate. Through analysis to clustering details in the hierarchical SOM system, the reason for a low detection rate of attack was found, and improvement were proposed based on the reason.