A HARDWARE IMPLEMENTATION OF THE SOM FOR A NETWORK INTRUSION DETECTION SYSTEM by

A HARDWARE IMPLEMENTATION OF THE SOM FOR A NETWORK INTRUSION DETECTION SYSTEM Brent W. Roeder, B.S. Virginia Tech, 2005 Thesis Director: Dr. Kris Gaj This thesis describes the research and development of a hardware implementation of the self organizing map (SOM) for a network intrusion detection system. As part of the thesis research, Kohonen’s SOM algorithm was examined and different hardware implementations for the SOM were surveyed. This survey resulted in the design and implementation of a conventional SOM, which was then modified for use as a detector of anomalous network traffic as part of a network intrusion detection system. The resulting implementation known as the port agent SOM is both smaller in area and supports higher data throughput than the conventional SOM, as was quantified through post place and route analysis. This thesis can serve as a tool for developing hardware implementations of the SOM, especially if their intended application is anomaly detection.