POSEIDON: a 2-tier Anomaly-based Network Intrusion Detection System

We present POSEIDON, a new anomaly-based network intrusion detection system. POSEIDON is payload-based, and has a two-tier architecture: the first stage consists of a Self-Organizing Map, while the second one is a modified PAYL system. Our benchmarks on the 1999 DARPA data set show a higher detection rate and lower number of false positives than PAYL and PHAD.

• Type: Conference
• Year: 2006
• Where: IWIA
• Authors: Damiano Bolzoni, Sandro Etalle, Pieter H. Hartel, Emmanuele Zambon
• Keywords: Information Management, IWIA 2006, Modified Payl System, Network Intrusion Detection System, first Stage