Self Organizing Feature Map is a type of neural network. Neural network is classified into two types of learning namely unsupervised and supervised learning. Unsupervised learning comprises two categories of Algorithms namely Self Organizing Feature Map (SOFM) and Adaptive Resonance Theory (ART), whereas Supervised learning comprises Radial Basis Function (RBF) and Multi Layer Perceptron Algorithms. The SOFM is an unsupervised learning algorithm because no human assistance needed during the learning process. The main role of the SOFM is to transform high dimensional of the input vector randomly chosen to low dimensional (1-D or 2-D). The SOFM algorithm is first developed by Teuvo Kohonen, Finnish Professor in 1982 known as Kohonen SOFM. It is designed for visualization and representation of huge amount of data, where human brain can easly undastand. And then, the structure of the SOFM is a single feed forward network [11] , where each input vector is directory connected to each neuron in the Map. But the neurons in the Kohonen Map are not linked to each other. The number of the input dimensions is usually higher than the output dimensions. It is used in various applications namely image processing, voice recognition, speech recognition, spatial data mapping, data compression, pattern recognition, text mining and so on [12] .

The Self Organizing Feature Map is a competitive learning algorithm, where each neuron in the Map competes so that the neuron which responds better is selected as the Best Matching Unit (BMU) or winning neuron. The neurons which are around the winner, is called neighborhood. The weights of the neurons close to the winning neuron are also adjusted but the magnitude of the change depends on the physical distance from the winning neuron and it is also decreased with the time [13] . Six stage of the learning process are listed and briefly described below:

• Stage 1: Each neuron’s weights in the network of x dimension is randomly initialized;

• Stage 2: The randomly selected input vectors from huge amount of training datasets are fred to SOFM network;

• Stage 3: The Euclidean Distance between the input vectors and neuron’s weights are computed to determine the winning neuron or Best Matching Unit (BMU).

To determine the Best Matching Unit (BMU), an iterative process is performed by each node in the network and the Euclidean Distance between the weight vector of each node and the current input vector is calculated. The node with the weight vector closest to the input vector is labeled as BMU [14] . To do that, we have two points such as I ( I 1 , I 2 , ⋯ , I n ) known as input vector and W ( W 1 , W 2 , ⋯ , W n ) known as weight vector of each neuron. The Euclidean Distance is computed as follows:

D = ‖ I n − W n ‖ = ( I 1 − W 1 ) 2 + ( I 2 − W 2 ) 2 + ⋯ + ( I n − W n ) 2 (1)

• Stage 4: The radius of the neighborhood closer to the winning neuron or BMU has the chance to be computed but the farthest one from the Best Matching Unit has no chance to be calculated.

The size of the neighborhood decreases progressively with n Epoch. All of the neurons around this radius are labeled neighbors of the winning neuron. To determine the neighborhood in the SOFM network which are closer the BMU, radius must be computed as follows:

r ( t ) = r 0 exp ( − t / λ ) (2)

where r(t) means the width of the lattice in time t, r 0 means the width of the lattice in time t 0 , t means a time or an iteration of the epoch and λ means a constant time t (current time).

• Stage 5: Both the Best Matching Unit neuron and its neighborhood weights are adjusted in order to respond better. The closest neurons within the neighborhood are more adjusted than the furthest neurons;

W ( t + 1 ) = W ( t ) + Θ ( t ) K ( t ) ( I ( t ) − W ( t ) ) (3)

where t means the time and K means the learning rate at time t, which decreases progressively in time. And then, the weight at time t + 1 is set to neighborhood nodes from the current instant weight W(t), plus a fraction K(t), the difference between the current weight of “W(t)” neuron and the input vector called I(t), adjusted (theta) based on distance from the BMU [15] .

In Equation (3) the learning rate at time t can be calculated using an exponential decay function.

K ( t ) = K 0 exp ( − t / λ ) (4)

In Equation (3), represents the amount of influence that the distance from one node to the BMU has on their learning, in the current time instant is calculated using Gaussian curve [15] .

Θ ( t ) = exp ( − D 2 / 2 r 2 ( t ) ) (5)

where D is a distance from one neuron to the winning neuron and r is the radius of the neighborhood. The function also decreases progressively in time.

• Stage 6: Go to Stage 2 if the number of epochs is not reached.

Genetic Algorithm is an optimization technique using an evolutionary process [16] . Network connection in dataset is represented as chromosome. Fitness Function of Genetic Algorithm is a powerful metric used to evaluate each individual population in the training dataset so as to determine the good solution and to discard the bad one. An evolutionary process of Genetic Algorithm starts where initial population is randomly generated. Each population is now evaluated to find out the best results based on the predefined criteria. For that reason, the fitness value of each population or chromosomes are determined using the Fitness Function. The best fitness values are kept and the worst are prunned from the top list. The best individual populations are selected and undergo crossover and mutation to reproduce new children. This new children knwon as new population is applied for the next generation. The process continues until the number of generations or epochs has been terminated. Figure 1 showed the Genetic Algorithm process.

As displayed in Figure 1, Genetic Algorithm (GA) consists of three operators namely selection, crossover or recombination and mutation.

In Genetic Algorithm data structure is represented as chromosome. The rules to match the attacks are randomly generated and are encoded as an integer array with seven attributes, as displayed in Table 1. The first six attributes of the chromosome match the condition A of an attack. The seventh attribute identifies the attack type that the first six attributes identify when they match. The same data representation is also used by Ms.Lata Jadhav [16] .

Before evaluating the individual population from training dataset, the rules to match the attack types must be constructed correctly in order to classify successfull abnormal behaviours and normal traffic. And thus, Too many wildcards in the constructed rules are forbidden because they sometime block the connections and lead to very poor accuracy. The gene representation follows the simple rule if A then B, where if the first six attributes are logically and-ed together are true (A), then the rule matches the attack (B) [16] . The rule used to classify network connection in training data as well as U2R attack rlogin is explained below:

if (Duration = “0:0:14” and Protocol = “rlogin” and Source_port = 1022 and Destination_ port = 513 and Source_ip = “192.168.1.30” and Destination_ip = “192.168.0.20”) then Attack_name = “rlogin”.

The above rule shows that if a network packet is originated from source IP address 192.168.1.30 and source port 1022, and sent to destination IP address 192.168.0.20 and destination port 513 using the protocol rlogin, and the connection duration is 0:0:14 second, then it is a network attack of type rlogin.

Traditional Fitness Function was defined by Man Leung Wong and Kwong Sak Leung (2000) [17] . It is based on the support-confidence framework and It is a performance measure used to determine the fitness value of individuals in the population. The best individuals in the population are selected according to the predefined fitness value threshhold. The fitness value is evaluated by determining how many attack connections the rule matches [18] . The traditional Fitness Function is built with two weights parameters such as w1 and w2 with default values 0.2, 0.8 respectively. Those weights are used to control the balance between the confidence and support during the training. This traditional Fitness Function generates in one hand the rules with low fitness value and the other hand with good fitness value.

To increase the fitness value of the generated rules, we have proposed two paramaters such as l1 and l2 known as lifts. The lifts l1 and l2, whose values are in the range of [−1.0.0.1.0], are used to increase the fitness value of the rules used in classifying the attack types, and used also to control the balance between the support and confidence. The generated rule with less fitness value has no chance to identify attack types. On the contrary, the rules with high fitness value have the chance in identifying attack types successful. Figure 2 shows the existing traditional Fitness Function, whereas Figure 3 shows the improved traditional Fitness Function. An experimental assessment of this improved traditional Fitness Function is presented in Section 6.1.

1) The existing traditional Fitness Function:

N: Total number of network connection rules in the training dataset;

|A|: Number of rules match the condition A;

|A and B|: Number of network connections match the rule if A then B;

w1, w2: weights employed to balance or control support and confidence.

2) The Improved traditional Fitness Function

T: Total number of connection rules in the training dataset;

|X|: Number of connections matching the condition X;

|X and Y|: Connection matching rule if X then Y;

w1, w2: weights used to balance or control two terms: support and confidence;

l1, l2: lifts used to increase the fitness value of rules and to balance the support-confidence. lift values is in the range of [−1.0.0.1.0].

Table 2 displays a sample of a population individual rule t matching against a training dataset. We need to compute the fitness value using the two formulas carried out on Figure 2 and Figure 3. And thus, the training data and population individual rule t are displayed on Table 2. The condition part of the first 14 network features of the rule 4 and 11 in the training data match a population individual t. Moreover, the rule of 4 and 11 match the outcome part of 15 network features, where It indicates the classification of attack type.

The obtained results trained with the existing traditional Fitness Function is displayed on Figure 4 and the obtained results trained with the improved traditional Fitness Function is shown on Figure 5.

However, after computation of fitness value using both formulas, the fitness value of 90.6% found using the improved traditional Fitness Function is greater than the fitness value of 83.2% obtained using the existing traditional Fitness Function. It was concluded that the best population individual’s fitness value obtained from the improved traditional Fitness Function has chance to identify attack types successfully. For that reason, this improved trational Fitness Function will be applied in our experiments to generate best rules used in identifying malicious attacks from the KDD Cup 99 and 1998 DARPA dataset.

1) Individual Crossover Operator

In the crossover operation, the best population individuals undergo crossover operator, where population individuals randomly selected involved in swapping genes of two parents with one an another to form two new children from each pair of parents. Crossover probability for a pair of parents were used in our experiments for performance evaluation of our implemented system. In Genetic Algorithm, there are three categories of crossover namely one point crossover, two point crossover and uniform crossover. Two point crossover technique will be used in our experiments. Figure 6 shows a sample of crossover operator.

2) Individual Mutation Operator

Mutation operator participates in modifying one or more genes value of single population individual due to the repeated use of crossover operator. For our experiment, mutation probability was employed. Figure 7 shows a sample of mutation operator carried out on single population individual.

For the first phase of our system, the datasets to be mined with our proposed NIDS are KDD CUP 99 and 1998 DARPA dataset. The KDD CUP 99 is one of the most datasets used to train and to test the intrusion detection rules. The KDD Cup 99 dataset is the subset of 1998 DARPA dataset that was collected by simulation of the operation of a typical USA Air Force Local Area Network (LAN) with multiple attacks classified into four categories: probe, denial of service, user to root and remote to local. KDD Cup 99 dataset records contain 41 features which fall into four categories: basic, traffic, content and host related ones [25] . And thus, 1998 DARPA Dataset (Defense Advanced Research Projects Agency) was invented in 1998 by MIT Lincoln Labs for the purpose of evaluating intrusion detection systems on offline environment. Moreover, many existing datasets such as KDD 99, DARPA, Kyoto 2006 and other public dataset, are uncontrollable, unmodifiable, and may contain old types of attack [26] .

Genetic Algorithm (GA) and Self Organizing Feature Maps Neural Network (SOFM) cannot handle symbolic features. For that reason, two subsets training and testing dataset from KDD Cup 99 dataset were picked, the transformation of string to numerical value were carried out, the normalization of the transformed data was done and suitable network features were selected for better accuracy. The preprocessing phase of our proposed system consists of three parts, as can be seen in Figure 8:

• Extraction of datasets: Training and testing datasets were picked from KDD Cup 99 dataset. These two subsets data were used to measure the performance of GA and SOFM Neural Network in intrusion detection rules.

• Converting string to numerical values: The network features containing the symbolic form named protocol type, Service and Flag were converted to numerical values by affecting unique number for each network feature.

• Normalization of the numerical values: After conversion to numerical values, we then convert the numerical vector into the binary or normalized (in interval [0,1]) [27] , this was done 1) to ensure that one feature did not overpower another (for those with large units) and 2) to speed up training and convergence time by using smaller numbers and the precise method is represented by this equation:

Data_Normalized = ( X − mean ( X ) ) / stddev ( X ) (6)

where X represents each column in the dataset.

• Network features selection: 41 network features in the KDD Cup 99 dataset were selected and trained, tested with Genetic Algorithm and Self Organizing Feature Map Artificial Neural Network. And 7 network features in 1998 DARPA dataset was selected and trained with Genetic Algorithm for producing rules used in identifying network attacks.

The proposed Network Intrusion Detection System based on soft computing algorithms SOFM Artificial Neural Network and GA comprises two modules namely Training and testing phase. In the training phase, a set of classification rules are generated from KDD Cup 99 and 1998 DARPA using the SOFM and GA in an offline environment, whereas, in the testing phase, the generated rules are used to classify incoming network connections in the real time environment and once the rules are generated, the intrusion detection is simple and efficient [6] .

The proposed architecture of Self Organizing Feature Map ANN is displayed in Figure 9.

Our proposed architecture of Self Organizing Feature Map artificial neural network consists of two layers namely: an input node and an output node. The input nodes indicates 41 network features from KDD CUP 99 dataset, which are symbolized in short form as F1, F2, F3, ..., F40 and F41 means Feature 1, Feature 2, Feature 3 until Feature 41. In other way, we have 41 dimensions of the input nodes. The output nodes consists of five outputs N1, N2, N3, N4 and N5 known as nodes were to classify five class of attack types including normal traffic namely DoS, Probe, R2L, U2L and Normal as classification problem. Each node’s map namely N1, N2, N3, N4 and N5 receives 41 coordinates (w11, w12, w13, ..., w140, w141) and each node’s Map is connected to each input node but node’s Map are not connected to each other in the Kohonen network. The Map dimension was initially set (25,25), epochs were initially set 100, learning rate was initially set 0.2 and neighborhood radius was initially set 16. Our proposed SOFM Neural Network was trained for each class of attack types as classification problem in order to evaluate the performance of the algorithm on individual attacks.

To evaluate our system, the two standard metrics of detection rate and false positive rate developed for network intrusions, have been used [6] : Detection rate (DR) is computed as the ratio between the number of correctly detected intrusions and the total number of intrusions, that is

DR = True Positive False Negative + True Positive (7)

False positive (FP) (also said false alarm) rate is computed as the ratio between the numbers of normal connections that are incorrectly classifies as intrusions and the total number of normal.

FP = False Positive True Negative + False Positive (8)

Table 3 displayed the used Genetic Algorithm training parameters during the traing and testing process of our system. And thus, Table 4 is shown the SOFM training parameters.

Our first experiment compares our own solutions generated by our implemented GAIDS which applies the improved traditional Fitness Function as

shown on Figure 3 with NetGA [28] which uses traditional fitness function [17] [29] [30] , and both are trained with 1998 DARPA training sample dataset bsm. list [31] using the Genetic Algorithm parameters as displayed in Table 3.

Table 5 shows the rules generated by NetGA and Table 6, Table 7 show the rules produced by our Implemented GAIDS. The simulation outcomes produced by NetGA shows that this system was able to print to the standard

output the top 30 rules. From the first rule to thirteenth rules, the fitness value is equal to 0%. These rules have no effectiveness in identifying network attacks (DoS, R2L, Probes and U2L). Thus, from fourteenth rules to thirtieth rules, fitness values vary between 26.98% and 80.63%. Such rules can identify network attacks (DoS, R2L, Probes and U2L) successful. On the contrary, the rules produced by our implemented GAIDS, was able to print to the standard output 46 top rules. From the index zero to the index 46, we have very high fitness values which vary between 87.71% and 88.24%. These rules generated by GAIDS have effectiveness in identifying network attacks than rules produced by NetGA. Hence, we can conclude that the rules produced by our GAIDS using the improved traditional Fitness Function have maintained high fitness value than NetGA. For that reason, it has a powerful in classifying network attacks (DoS, R2L, Probes and U2L).

For the last experiment simulates the test module to use the generated Network Intrusion Detection System rules against the KDD Cup 99 test to measure the quality of the rules generated from our implemented system’s training module. After our implemented system has been trained with the training KDD Cup 99 dataset [32] , the generated rules are then integrated to the test module. Table 8 showed the class distribution of experimental on KDD Cup 99 dataset and the class distribution of our experimental is summarized by the graph of Figure 10.

The overall simulation outcomes and their related statistical calculations are displayed in Table 9, Table 10 and Table 11. It is concluded that the Network Intrusion Detection System rules generated by SOFM Artificial Neural Network when trained with KDD Cup 99 can detect for different attack types successful with high attack detection rate and law false positive rate.

Tables 12-14 show that the rules generated by Genetic Algorithm when trained with KDD Cup 99 can successful detect for different attack types in the training dataset namely DoS, Probe, R2L, U2R including normal traffic with very high attack detection rate but with very high false positive rate which may lead to very poor accuracy of anomaly detection system.

Table 15 compares our implemented algorithms (Genetic Algorithm and Self Organizing Feature Map Artificial Neural Network). In particular, we demonstrated the Detection rate, False Positive rate and classification rate. In training, testing and generalization detection rate, the detection rate generated by GA is better than SOFM but the false positive rate generated by SOFM is very low, better than the false positive rate in GA which may lead to very poor accuracy of Anomaly detection System. It is very difficult to compare the classification time of each attack types because the training speed depends on various factors such as implementation of the algorithms, condition of the hardware and software

platform and size of the training dataset. In general the obtained results in SOFM have maintained both high detection rate and low false positive rate than GA. But GA has maintained very high detection rate but it suffer from very high false positive rate, for that reason, It leads to very poor accuracy of Anormaly detection system.