A Practical Intrusion Visualization Analyzer based on Self-organizing Map

In the era of big data, devices and services are interconnected through the network. For the purpose of ensuring the security and reliability of network communication and resisting the threat of intrusions, Network Intrusion Detection Systems (NIDS) have become an infrastructure in the Internet ecosystem. It is challenging to develop an effective NIDS which can provide visualization ability due to the high-dimensional characteristic of network traffic. In our work, a practical NIDS based on the Self-Organizing Map (SOM) neuron network is presented. The proposed method can arrange high-dimensional data in a 2D topological graph in an orderly manner, which enables an easy-to-understand insight of the distribution of normal or abnormal data. With the training, similar data is grouped together, based on which intrusions can be identified. In addition, a hybrid preprocessing model that combines two different feature selection methods is adopted to accelerate the detection process. In order to evaluate the performance of the proposed framework in terms of several different metrics, experiments are performed over a benchmark dataset UNSWNB15 which is widely used in intrusion detection research. Experiment results show that the proposed approach provides a user-friendly visualization and enhances the detection of intrusions.