  Network intrusion detection is the problem of detecting unauthorised use of,
or access to, computer systems over a network. Two broad approaches exist to
tackle this problem: anomaly detection and misuse detection. An anomaly
detection system is trained only on examples of normal connections, and thus
has the potential to detect novel attacks. However, many anomaly detection
systems simply report the anomalous activity, rather than analysing it further
in order to report higher-level information that is of more use to a security
officer. On the other hand, misuse detection systems recognise known attack
patterns, thereby allowing them to provide more detailed information about an
intrusion. However, such systems cannot detect novel attacks.
  A hybrid system is presented in this paper with the aim of combining the
advantages of both approaches. Specifically, anomalous network connections are
initially detected using an artificial immune system. Connections that are
flagged as anomalous are then categorised using a Kohonen Self Organising Map,
allowing higher-level information, in the form of cluster membership, to be
extracted. Experimental results on the KDD 1999 Cup dataset show a low false
positive rate and a detection and classification rate for Denial-of-Service and
User-to-Root attacks that is higher than those in a sample of other works.
