{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,2]],"date-time":"2025-08-02T17:55:18Z","timestamp":1754157318307,"version":"3.41.2"},"reference-count":35,"publisher":"Emerald","issue":"4","license":[{"start":{"date-parts":[[2012,11,23]],"date-time":"2012-11-23T00:00:00Z","timestamp":1353628800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2012,11,23]]},"abstract":"<jats:sec><jats:title content-type=\"abstract-heading\">Purpose<\/jats:title><jats:p>The task of internet intrusion detection is to detect anomalous network connections caused by intrusive activities. There have been many intrusion detection schemes proposed, most of which apply both normal and intrusion data to construct classifiers. However, normal data and intrusion data are often seriously imbalanced because intrusive connection data are usually difficult to collect. Internet intrusion detection can be considered as a novelty detection problem, which is the identification of new or unknown data, to which a learning system has not been exposed during training. This paper aims to address this issue.<\/jats:p><\/jats:sec><jats:sec><jats:title content-type=\"abstract-heading\">Design\/methodology\/approach<\/jats:title><jats:p>In this paper, a novelty detection\u2010based intrusion detection system is proposed by combining the self\u2010organizing map (SOM) and the kernel auto\u2010associator (KAA) model proposed earlier by the first author. The KAA model is a generalization of auto\u2010associative networks by training to recall the inputs through kernel subspace. For anomaly detection, the SOM organizes the prototypes of samples while the KAA provides data description for the normal connection patterns. The hybrid SOM\/KAA model can also be applied to classify different types of attacks.<\/jats:p><\/jats:sec><jats:sec><jats:title content-type=\"abstract-heading\">Findings<\/jats:title><jats:p>Using the KDD CUP, 1999 dataset, the performance of the proposed scheme in separating normal connection patterns from intrusive connection patterns was compared with some state\u2010of\u2010art novelty detection methods, showing marked improvements in terms of the high intrusion detection accuracy and low false positives. Simulations on the classification of attack categories also demonstrate favorable results of the accuracy, which are comparable to the entries from the KDD CUP, 1999 data mining competition.<\/jats:p><\/jats:sec><jats:sec><jats:title content-type=\"abstract-heading\">Originality\/value<\/jats:title><jats:p>The hybrid model of SOM and the KAA model can achieve significant results for intrusion detection.<\/jats:p><\/jats:sec>","DOI":"10.1108\/17563781211282286","type":"journal-article","created":{"date-parts":[[2012,11,22]],"date-time":"2012-11-22T05:19:12Z","timestamp":1353561552000},"page":"566-581","source":"Crossref","is-referenced-by-count":4,"title":["Hybrid model of self\u2010organizing map and kernel auto\u2010associator for internet intrusion detection"],"prefix":"10.1108","volume":"5","author":[{"given":"Bailing","family":"Zhang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yungang","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenjin","family":"Lu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"140","reference":[{"key":"key2022012720223487700_b30","doi-asserted-by":"crossref","unstructured":"Bao, Y. and Liu, Z. (2006), \u201cA fast grid search method in support vector regression forecasting time series\u201d, Lecture Notes in Computer Science, Vol. 4224, pp. 504\u201011.","DOI":"10.1007\/11875581_61"},{"key":"key2022012720223487700_b8","unstructured":"Cannady, J. (1998), \u201cArtificial neural networks for misuse detection\u201d, Proceedings of National Information Systems Security Conference (NISSC'98), Arlington, VA, pp. 443\u201056."},{"key":"key2022012720223487700_b29","doi-asserted-by":"crossref","unstructured":"Garc\u00eda\u2010Teodoro, P. (2009), \u201cAnomaly\u2010based network intrusion detection: techniques, systems and challenges\u201d, Computers & Security, Vol. 28, pp. 18\u201028.","DOI":"10.1016\/j.cose.2008.08.003"},{"key":"key2022012720223487700_b5","doi-asserted-by":"crossref","unstructured":"Heady, R., Luger, G., Maccabe, A. and Servilla, M. (1990), \u201cThe architecture of a network level intrusion detection system\u201d, Technical Report, Computer Science Department, University of New Mexico, Albuquerque, NM, August.","DOI":"10.2172\/425295"},{"key":"key2022012720223487700_b28","doi-asserted-by":"crossref","unstructured":"Helali, R.G.M. (2010), \u201cData mining based network intrusion detection system: a survey\u201d, in Sobh, T. (Ed.), Novel Algorithms and Techniques in Telecommunications and Networking, Springer, Berlin, pp. 501\u20105.","DOI":"10.1007\/978-90-481-3662-9_86"},{"key":"key2022012720223487700_b21","doi-asserted-by":"crossref","unstructured":"Hertz, J., Krogh, A. and Palmer, R. (1991), Introduction to the Theory of Neural Computation, Perseus Books, Jackson, TN.","DOI":"10.1063\/1.2810360"},{"key":"key2022012720223487700_b32","doi-asserted-by":"crossref","unstructured":"Horng, S.\u2010J., Su, M.\u2010Y., Chen, Y.\u2010H., Kao, T.\u2010W., Chen, R.\u2010J., Lai, J.\u2010L. and Perkasa, C.D. (2011), \u201cA novel intrusion detection system based on hierarchical clustering and support vector machines\u201d, Expert Systems with Applications, Vol. 38, pp. 306\u201013.","DOI":"10.1016\/j.eswa.2010.06.066"},{"key":"key2022012720223487700_b24","doi-asserted-by":"crossref","unstructured":"Jia, F., Martin, E.B. and Morris, A.J. (2000), \u201cNon\u2010linear principal components analysis with application to process fault detection\u201d, International Journal of Systems Science, Vol. 31 No. 11, pp. 1473\u201087.","DOI":"10.1080\/00207720050197848"},{"key":"key2022012720223487700_b2","unstructured":"Kabiri, P. and Ghorbani, A. (2005), \u201cResearch on intrusion detection and response: a survey\u201d, International Journal of Network Security, Vol. 1, pp. 84\u2010102."},{"key":"key2022012720223487700_b4","unstructured":"KDD CUP (1999), The Third International Knowledge Discovery and Data Mining Tools Competition, University of California, Irvine, CA, available at: http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html."},{"key":"key2022012720223487700_b10","doi-asserted-by":"crossref","unstructured":"Kohonen, T. (1989), Self\u2010organization and Associative Memory, Springer, Berlin.","DOI":"10.1007\/978-3-642-88163-3"},{"key":"key2022012720223487700_b7","doi-asserted-by":"crossref","unstructured":"Kramer, M.A. (1991), \u201cNonlinear principal component analysis using auto\u2010associative neural networks\u201d, AIChE Journal, Vol. 37, pp. 233\u201043.","DOI":"10.1002\/aic.690370209"},{"key":"key2022012720223487700_b11","doi-asserted-by":"crossref","unstructured":"Lee, S.C. and Heinbuch, D.V. (2001), \u201cTraining a neural network based intrusion detector to recognize novel attacks\u201d, IEEE Transactions on Systems, Man and Cybernetics, Part A, Vol. 31, pp. 294\u20109.","DOI":"10.1109\/3468.935046"},{"key":"key2022012720223487700_b34","doi-asserted-by":"crossref","unstructured":"Levin, I. (2000), \u201cKDD\u201099 classifier learning contest LLSoft's results overview\u201d, SIGKDD Explorations, Vol. 1 No. 2, pp. 67\u201075.","DOI":"10.1145\/846183.846201"},{"key":"key2022012720223487700_b1","doi-asserted-by":"crossref","unstructured":"McHugh, J. (2001), \u201cIntrusion and intrusion detection\u201d, Journal of Information Security, Vol. 1, pp. 14\u201035.","DOI":"10.1007\/s102070100001"},{"key":"key2022012720223487700_b13","doi-asserted-by":"crossref","unstructured":"Markou, M. and Singh, S. (2003), \u201cNovelty detection: a review, part I: statistical approaches\u201d, Signal Processing, Vol. 83, pp. 2481\u201097.","DOI":"10.1016\/j.sigpro.2003.07.018"},{"key":"key2022012720223487700_b25","unstructured":"Marwala, T. and Chakraverty, S. (2006), \u201cFault classification in structures with incomplete measured data using autoassociative neural networks and genetic algorithm\u201d, Current Science, Vol. 90, pp. 542\u20108."},{"key":"key2022012720223487700_b6","doi-asserted-by":"crossref","unstructured":"Mukkamala, S. and Sung, A.H. (2003), \u201cA comparative study of techniques for intrusion detection\u201d, 15th IEEE International Conference on Tools with Artificial Intelligence (ICTAI'03), pp. 570\u20107.","DOI":"10.1109\/TAI.2003.1250243"},{"key":"key2022012720223487700_b35","doi-asserted-by":"crossref","unstructured":"Pfahringer, B. (2000), \u201cWinning the KDD99 classification cup: bagged boosting\u201d, SIGKDD Explorations, Vol. 1 No. 2, pp. 65\u20106.","DOI":"10.1145\/846183.846200"},{"key":"key2022012720223487700_b17","unstructured":"Ryan, J., Lin, M.J. and Miikkulainen, R. (1998), \u201cIntrusion detection with neural networks\u201d, in Jordan, M.I., Kearns, M.J. and Solla, S.A. (Eds), Advances in Neural Information Processing Systems, Vol. 10, MIT Press, Cambridge, MA, pp. 943\u20109."},{"key":"key2022012720223487700_b33","doi-asserted-by":"crossref","unstructured":"Tossi, A.N. and Kahani, M. (2007), \u201cA new approach to intrusion detection based on an evolutionary soft computing model using neuro\u2010fuzzy classifiers\u201d, Computer Communications, Vol. 30, pp. 2201\u201012.","DOI":"10.1016\/j.comcom.2007.05.002"},{"key":"key2022012720223487700_b31","unstructured":"Vesanto, J., Himberg, J., Alhoniemi, E. and Parhankangas, J. (2000), \u201cSOM toolbox for Matlab 5\u201d, Technical Report of SOM Toolbox Team, University of Technology, Helsinki."},{"key":"key2022012720223487700_b27","doi-asserted-by":"crossref","unstructured":"Wang, G., Hao, J., Ma, J. and Huang, L. (2010), \u201cA new approach to intrusion detection using artificial neural networks and fuzzy clustering\u201d, Expert Systems with Applications, Vol. 37, pp. 6225\u201032.","DOI":"10.1016\/j.eswa.2010.02.102"},{"key":"key2022012720223487700_b20","doi-asserted-by":"crossref","unstructured":"Yeung, D.Y. and Chow, C. (2002), \u201cParzen\u2010window network intrusion detectors\u201d, Proc. of the Sixteenth International Conference on Pattern Recognition, Vol. 4, pp. 385\u20108.","DOI":"10.1109\/ICPR.2002.1047476"},{"key":"key2022012720223487700_b22","unstructured":"Zhang, B. (2005), \u201cInternet intrusion detection by auto\u2010associative neural network\u201d, paper presented at International Symposium on Information and Communications Technologies 2005, TS07\u20101, Malaysia, December."},{"key":"key2022012720223487700_b23","unstructured":"Zhang, B. and Gupta, G. (2006), \u201cAnomaly detection in internet intrusion detection by hybrid of self\u2010organization and kernel auto\u2010associators\u201d, paper presented at International Conference on Intelligent Systems and Knowledge Engineering, Shanghai, China, April."},{"key":"key2022012720223487700_b14","doi-asserted-by":"crossref","unstructured":"Zhang, B., Zhang, H. and Ge, S. (2004a), \u201cFace recognition by applying wavelet subband representation and kernel associative memory\u201d, IEEE Transactions on Neural Networks, Vol. 15 No. 1, pp. 166\u201077.","DOI":"10.1109\/TNN.2003.820673"},{"key":"key2022012720223487700_b16","doi-asserted-by":"crossref","unstructured":"Zhang, H., Huang, W., Huang, Z. and Zhang, B. (2004b), \u201cKernel autoassociator with applications to visual classification\u201d, Proceedings of the 17th International Conference on Pattern Recognition (ICPR), Vol. 2, pp. 443\u20106.","DOI":"10.1109\/ICPR.2004.1334252"},{"key":"key2022012720223487700_b15","doi-asserted-by":"crossref","unstructured":"Zhang, H., Huang, W., Huang, Z. and Zhang, B. (2005), \u201cA kernel autoassociator approach to pattern classification\u201d, IEEE Transactions on Systems, Man and Cybernetics, Part B, Vol. 35, pp. 593\u2010606.","DOI":"10.1109\/TSMCB.2005.843980"},{"key":"key2022012720223487700_frd1","doi-asserted-by":"crossref","unstructured":"Elkan, C. (2000), \u201cResults of the KDD'99 classifier learning\u201d, SIGKDD Explorations, ACM SIGKDD, New York, NY, January.","DOI":"10.1145\/846183.846199"},{"key":"key2022012720223487700_frd2","unstructured":"Fausett, L. (1994), Fundamentals of Neural Networks, Prentice Hall, Englewood Cliffs, NJ."},{"key":"key2022012720223487700_frd3","doi-asserted-by":"crossref","unstructured":"Malthouse, E.C. (1998), \u201cLimitations of nonlinear PCA as performed with generic neural networks\u201d, IEEE Trans. on Neural Networks, Vol. 9, pp. 165\u201073.","DOI":"10.1109\/72.655038"},{"key":"key2022012720223487700_frd4","doi-asserted-by":"crossref","unstructured":"Nairac, A., Corbett\u2010Clark, T., Ripley, R., Townsend, N. and Tarassenko, L. (1997), \u201cChoosing an appropriate model for novelty detection\u201d, Proc. 5th IEE International Conference on Artificial Neural Networks, Cambridge, pp. 227\u201032.","DOI":"10.1049\/cp:19970712"},{"key":"key2022012720223487700_frd6","doi-asserted-by":"crossref","unstructured":"Zhang, C., Jiang, J. and Kamel, M. (2005), \u201cIntrusion detection using hierarchical neural networks\u201d, Pattern Recognition Letters, Vol. 26, pp. 779\u201091.","DOI":"10.1016\/j.patrec.2004.09.045"},{"key":"key2022012720223487700_frd5","doi-asserted-by":"crossref","unstructured":"Zhang, Z. and Shen, H. (2005), \u201cApplication of online training SVMs for real\u2010time intrusion detection with different considerations\u201d, Computer Communications, Vol. 28, pp. 1428\u201042.","DOI":"10.1016\/j.comcom.2005.01.014"}],"container-title":["International Journal of Intelligent Computing and Cybernetics"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/www.emeraldinsight.com\/doi\/full-xml\/10.1108\/17563781211282286","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/17563781211282286\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/17563781211282286\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,24]],"date-time":"2025-07-24T23:44:29Z","timestamp":1753400669000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/ijicc\/article\/5\/4\/566-581\/136806"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012,11,23]]},"references-count":35,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2012,11,23]]}},"alternative-id":["10.1108\/17563781211282286"],"URL":"https:\/\/doi.org\/10.1108\/17563781211282286","relation":{},"ISSN":["1756-378X"],"issn-type":[{"type":"print","value":"1756-378X"}],"subject":[],"published":{"date-parts":[[2012,11,23]]}}}