On dataset biases in a learning system with minimum a priori information for intrusion detection

摘要: A critical design decision in the construction of intrusion detection systems is often selection features describing characteristics data being learnt. Selecting requires a priori or expert knowledge and may lead to introduction specific attack biases ntended otherwise. To this end, summarized network connections from DARPA 98 Lincoln Labs dataset are employed for training testing driven learning architecture. The architecture composed hierarchy self-organizing feature maps. Such scheme entirely unsupervised, thus quality system directly influenced by dataset. Dataset investigated through three different partitions: 10% KDD (default dataset); normal alone; 50/50 mix normal. resulting appear be competitive with alternative cluster based data-mining approaches.