Our research created a network Intrusion Detection Math (ID Math) consisting of two components: (1) a way of specifying intrusion detection types in a manner which is more suitable for an analytical environment; and (2) a computational model which describes methodology for preparing intrusion detection data stepwise from network packets to data structures in a way which is appropriate for sophisticated analytical methods such as statistics, data mining, and computational intelligence. We used ID Math in a production Self-Organizing Map (SOM) intrusion detection system named ANNaBell as well as in the SOM+ Diagnostic System which we developed.
Patel, Purvag, Langin, Chet, Yu, Feng and Rahimi, Shahram. "Network Intrusion Detection Types and Computation." (Jan 2012).