Published in International Journal of Computer Science and Information Security , Vol. 10 No. 1 (January 2012) at


Our research created a network Intrusion Detection Math (ID Math) consisting of two components: (1) a way of specifying intrusion detection types in a manner which is more suitable for an analytical environment; and (2) a computational model which describes methodology for preparing intrusion detection data stepwise from network packets to data structures in a way which is appropriate for sophisticated analytical methods such as statistics, data mining, and computational intelligence. We used ID Math in a production Self-Organizing Map (SOM) intrusion detection system named ANNaBell as well as in the SOM+ Diagnostic System which we developed.