Abstract: An intrusion detection method based on SOM is proposed.At training phase of the intrusion detection，SOM neural network is trained with labeled dataset and then label neurons with ‘normal’ or ‘attack’ according to the training result.During the procedure of detection，unknown data is determined whether it is normal or not according its’ BMU’s label.For validate the performance of this method，result of detection using SVM is compared to method proposed in this paper with KDD cup99 dataset，and the experiment shows that SOM based intrusion detection method has a better detection rate while consuming limit time.

摘要： 提出了一种基于SOM神经网络的入侵检测方法。该方法采用有标签的数据训练SOM神经网络，然后根据训练的结果标记正常数据和异常数据聚类的神经元。检测时则根据被检测数据的最佳匹配神经元的标签判断攻击是否发生。为验证检测的有效性，采用KDD cup99的训练集与测试集，将基于SOM的检测方法与基于SVM的检测方法的检测效果做了对比。实验结果表明：基于SOM的入侵检测方法具有检测率高、训练时间短和通用性强等特点。