As an artificial neural network method, self-organizing mapping facilities efficient complete and visualize high-dimensional data topology representation, valid in a number of applications such as network intrusion detection. However, there remains a challenge to accurately depict the topology of network traffic data with unbalanced distribution, which deteriorates the performance of e.g. DoS attack detection. Hence, we propose a new model of the “statistic-enhanced directed batch growth self-organizing mapping”, renew the definition of the growth threshold used to evaluate/control neuron expansion, and firstly introduce the inner distribution factor for fine-grained data distinguishing. The numerical experiments based on two datasets, KDD99 and CICIDS2017, demonstrate that the key performance in DoS attack detection including the detection rate, the false positive rate, and the training time, are greatly enhanced thanks to the statistic concepts consulted in the proposed model.

A new evaluation mechanism was proposed to enhance the representation of data topology in the directed batch growth hierarchical self-organizing mapping. In the proposed mechanism, the growth threshold and the correlation worked in a case-sensitive manner through the statistic calculation of the input data. Since the proposed model enabled a more thorough representation of data topology from both the horizontal and the vertical directions, it naturally held great potential in detecting various traffic attacks. Numerical experiments of network intrusion detection were carried out on the datasets of KDD99 and Moore, where the good performance validated the superiority of the proposed method.

This paper proposes a network anomaly detection model of direct batch growing hierarchical self-organizing mapping based on entropy, which facilitates clear topology representation for the asymmetrically-distributed data. Since the entropy-defined parameters dynamically vary with the incident dataset, that is, follow a data-adaptive manner, the proposed model is naturally valid in all cases with various data types. For fine-grained data distinguishing, a resemble entropy parameter is proposed for the first time to our best knowledge. The experimental results validate that the proposed model achieves a more efficient network anomaly detection than the conventional models, especially for real-world applications with unexpected anomaly data updating.