Network intrusion detection by using self-organizing maps

Anomali detection in netwokr traffic is one of the most challenging topics in the study of computer science and networking. This work introduces a classification method for analyzing network traffic behavior. In order to distinguish the normal traffic with well-known anomalies such as port scanning and DOS attacks, Self Organizing Maps, one of the well-known artificial neural network architecture, is used. In the first part of this work, Simple Network Management Protocol(SNMP) performs the measurment of network traffic. In the second part, the dataset prepared by KDD is used. Unlike first part, the dataset is subjected to Principal Component Analysis. In this part, the result we obtained implies that if optimum number of Principle Components is used the decision rate of system is improved. It is worth to mention that impressively satisfactory results have been obtained.