Intelligent Database Systems Lab Presenter : YAN-SHOU SIE Authors : E.J. Palomo, J. North, D. Elizondo, R.M. Luque, T. Watson 2012. NN Application of growing.

Intelligent Database Systems Lab

Presenter : YAN-SHOU SIE

Authors : E.J. Palomo , J. North , D. Elizondo , R.M. Luque

, T. Watson

2012. NN

Application of growing hierarchical SOM for visualisation of network forensics traffic data


Outlines

MotivationObjectivesMethodologyExperimentsConclusionsComments


Motivation

• In information burst age,network of packets are too large cause network attack pattern difficult to find and identifying the error's data in the pattern that data take.


Objectives

• We utilize GHSOM to find network attack pattern , have following advantage:– A visualisation technique can more intuitive and

understandable.– Network attack pattern be easy find or judge.


Methodology• Growing hierarchical self-organising map– consists of several growing SOMs

arranged in layers– quantitative features– qualitative features


Methodology• GHSOM flow charts


• Euclidean distance

• quantisation error

• hierarchical growth controlled

Methodology


Methodology• winning neuron of the map

• weight vector update

• map growth controlled


Experiments• Feature extraction

• Finally feature subset – qualitative : IP source address, IP destination address , protocol

type , source port

– quantitative :date, time, packet length and delta time

Captured packets

handled missing value

Feature selection


Experiments• Data visualization

3D GHSOM 2D GHSOM


Experiments• plot of the input data hits

Layer-1

Layer-2


Experiments• U-matrix

Layer-1

Layer-2


Experiments• Component planes – Layer 1

Layer-1


Experiments• Component planes– Layer 2

Layer-2


Experiments• distribution of countries of origin


Conclusions• The results show that the GHSOM can be used to

cluster network traffic data and to represent this in a manner that can be of aid in network forensics. Therefore,this information can allow an expert in the field to successfully conclude a digital investigation.


Comments• Advantages– Use visualisation technique help user can more

intuitive and understandable to watch data.

• Applications– Network forensics– network forensics

Intelligent Database Systems Lab Presenter : YAN-SHOU SIE Authors : E.J. Palomo, J. North, D. Elizondo, R.M. Luque, T. Watson 2012. NN Application of growing.

Documents

network traffic data

network of packets

input data hits layer

errors data

ip source address

ip destination address

delta time

source portquantitative