Author(s)

Xiaofei Qu, Mu Li

Corresponding Author

Xiaofei Qu

Abstract

In this paper, an improved growing hierarchical self-organizing map (IGHSOM) approach based on growing self-organizing mapping (GSOM) is proposed to detect the DOS flooding attacks. The IGHSOM is a layered architecture, which can be extended from both horizontal and vertical, and utilized to represent the topological relation of data space and the hierarchical relation of data. Compared with the traditional growing hierarchical self-organizing mapping (GHSOM) approach, which has the potential disadvantage of inaccurate mapping of data topological relationships on DOS flooding attack detection, the proposed scheme can accurately represent the topological relationship of data space, increase the DOS detection rate and then reduce the false alarm rate. Through the numerical experiments on KDD data, the results show that the proposed IGHSOM approach can achieve better performance than traditional GHSOM in terms of DOS flooding attack detection, and can further improve the detection rate and reduce the false positive rate.

Keywords

DOS flooding attacks, Growing self-organizing map, Growing hierarchical self-organizing map, Improved growing hierarchical SOM