Hierarchical Kohonenen net for anomaly detection in network security.

A novel multilevel hierarchical Kohonen Net (K-Map) for an intrusion detection system is presented. Each level of the hierarchical map is modeled as a simple winner-take-all K-Map. One significant advantage of this multilevel hierarchical K-Map is its computational efficiency. Unlike other statistical anomaly detection methods such as nearest neighbor approach, K-means clustering or probabilistic analysis that employ distance computation in the feature space to identify the outliers, our approach does not involve costly point-to-point computation in organizing the data into clusters. Another advantage is the reduced network size. We use the classification capability of the K-Map on selected dimensions of data set in detecting anomalies. Randomly selected subsets that contain both attacks and normal records from the KDD Cup 1999 benchmark data are used to train the hierarchical net. We use a confidence measure to label the clusters. Then we use the test set from the same KDD Cup 1999 benchmark to test the hierarchical net. We show that a hierarchical K-Map in which each layer operates on a small subset of the feature space is superior to a single-layer K-Map operating on the whole feature space in detecting a variety of attacks in terms of detection rate as well as false positive rate.

Practical strategies for identifying groundwater discharges into sediment and surface water with fiber optic temperature measurement.

Identifying or ruling out groundwater discharges into sediment and surface waters is often critical for evaluating impacts and for planning remedial actions. Information about subsurface structure and groundwater can be helpful, but imperfect information, heterogeneous materials, and the likelihood of preferential pathways make it difficult to locate seeps without direct seep monitoring. We present the practical application of a method that uses fiber optic temperature measurement to provide high-resolution, sensitive, and dynamic monitoring of seepage from sediments over large areas: distributed temperature sensing to identify groundwater discharge (DTSID). First, we introduce a stochastic Monte Carlo method for designing DTSID installation based on site characteristics and the required probability of detecting particular size seeps. We then present practical methods for analysing DTSID results to prioritize locations for further investigation used at three industrial locations. Summer conditions generally presented greater difficulty in the method due to stronger environmentally-driven temperature fluctuations and thermal stratification of surface water. Tidal fluctuations were shown to be helpful in seepage detection at some locations by creating a dynamic temperature pattern that likely reflects changing seepage with varying water levels. At locations with suitable conditions for the application of DTSID, it can provide unique information regarding likely seep locations, enhancing an integrated site investigation.