With the rapid spread of the Internet, there has also been a rapid development of online systems for shopping, banking, making payments, stock trading, and so on. However, due to the openness of the network, forms of network intrusion are becoming increasingly diversified, so that networks and systems are experiencing ever more serious threats. Therefore, detecting network intrusion has become a critical issue in network security. In recent years, increasing attention has been paid by scholars all over the world to intrusion detection. The aim is to identify any behavior that could compromise the integrity, confidentiality, or availability of the system. It can be defined as identifying the people accessing a computer system (Shitharth and Winston, 2017). Current methods of network intrusion detection can be divided into two categories: misuse intrusion detection and abnormal intrusion detection. The capability of misuse intrusion detection mainly depends on the completeness of the detection knowledge base. Its shortcoming is that it cannot find unknown forms of intrusion. Abnormal intrusion detection is based on identifying a difference between the detected and acceptable behavior.

Due to their continuous development, various swarm intelligence algorithms have been applied to intrusion detection, such as the genetic algorithm (Mabu et al., 2011), immune algorithm (Zhang et al., 2014), ant colony optimization (Feng et al., 2014), and so on. However, as the “no free lunch” theorem (Wolpert and Macready, 1997) argues, none of these group intelligence algorithms is suitable for detecting all forms of intrusion. Thus, finding a better algorithm is still a hot topic for scholars in various countries.

In recent years, various meta-heuristic algorithms have been proposed, such as the crow search algorithm (Askarzadeh, 2016; Hussien et al., 2021), monarch butterfly optimization (Wang et al., 2019), lightning search algorithm (Shareef et al., 2015; Abualigah et al., 2021), water evaporation optimization (Kaveh and Bakhshpoori, 2016), Kohonen neural network (Wehrens and Buydens, 2007; De Almeida et al., 2013), symbiotic-organism search (SOS) algorithm (Cheng and Prayogo, 2014; Ezugwua and Prayogo, 2019; Chakraborty et al., 2022), bat algorithm (BA) (Xinshe, 2010; Shehab et al., 2022), cuckoo algorithm (CS) (Yang and Deb, 2009), flower pollination algorithm (FPA) (Yang, 2012; Fouad and Gao, 2019), grey wolf optimizer (GWO) (Mirjalili et al., 2014), particle swarm algorithm (PSO) (Kennedy and Eberhart, 1995; Jordehi and Jasni, 2015), Harris hawk optimization(Hussien et al., 2022), Quantum-inspired deep neural networks (Shi et al., 2021), Gaining–sharing knowledge based algorithm (Mohamed et al., 2020) and so on.

This paper proposes a clustering algorithm based on the SOS algorithm and a Kohonen neural network. The clustering accuracy of Kohonen neural network was improved by using the SOS algorithm to optimize the weights of the Kohonen neural network. SOS-Kohonen was tested with the KDDCUP99 network intrusion data. The experimental results show that it can effectively detect intrusion detection. Compared to other standard methods, the detection rate was higher and the false alarm rate was lower.

The remainder of the paper is organized as follows. Section 2 describes the structure of a Kohonen neural network. Section 3 introduces a basic SOS algorithm. Section 4 considers the use of the SOS-Kohonen algorithm for intrusion detection. Section 5 describes the data preprocessing method. The simulation experiments and results are presented in Sections 6, 7 concludes and discusses future work.

Finnish professor Teuvo Kohonen proposed an unsupervised self-organizing competitive neural network called a Kohonen neural network. It can achieve automatic clustering by using a self-organizing feature mapping to adjust network weights. A Kohonen neural network (De Almeida et al., 2013) consists of two feedforward layers, namely an input layer and an output layer. The input layer is mapped into a two-dimensional response mesh in the output layer based on weights. The topology of a Kohonen neural network is shown in Figure 1.

In a Kohonen neural network, the Euclidean distance of each neuron is obtained by calculating the input eigenvector for the corresponding output layer. The neuron with the smallest Euclidean distance is the superior neuron, and its connection weights are adjusted to make it closer to the original input vector. The area adjacent to the winning neuron is also adjusted by the connection weight to make it closer to the input vector.

In the training phase, each input vector X_s is input into the network, and only those winning neurons closest to the current weight vector of the input receive a corresponding stimulus. The pattern vector X_s is calculated as the minimum Euclidean distance from the selected winning neurons:

where c represents the winning neuron and x_si represents the ith coordinate of the input vector. In addition, the level of the ith weight of neuron j is denoted by w_ji. The number of neurons in a Kohonen level is denoted by N×N. Once the winning neuron is selected, the corresponding weight w_ji of each neuron j in the layer is updated according to the difference between the original weight and the input neuron, as follows:

where the learning rate is η, the weight of the previous generation of w_ji is wj⁢io⁢l⁢d, and the number of neurons between neuron j and the superior neuron is represented by the topological distance d_r. The size of the adjacent area d_max decreases from the coverage of the entire network to the winning neurons as training progresses. In addition, the learning rate η changes during training:

where n_tot represents the total number of iterations; n_epoch represents the current iteration times.

In nature, some organisms establish symbiotic relationship, which strengthens their ability to adapt to the environment, thereby enhancing their viability. The SOS algorithm (Cheng and Prayogo, 2014) simulates the symbiotic relationships found in nature. Each organism in the ecosystem passes through three phases in the SOS algorithm: mutualism, commensalism, and parasitism. In each phase, the organism is assumed to be in a symbiotic relationship with another random organism. The interactions between the pairs of organisms are used to adjust the fitness value. The result is an optimal solution to the problem. The process is described in the following sections.

The SOS algorithm is based on the natural phenomenon of symbiosis between various organisms. When a virus intrudes into a system, the relation between the system and the virus can be viewed as a symbiotic relationship between the virus data and the system data.

The initial weights of the Kohonen neural network are optimized with the SOS algorithm. The optimized Kohonen neural network can reduce the length of the error vector between the training sample and the weight vector. This process helps to avoid rigidity during training, which can improve the clustering ability of the Kohonen neural network. After SOS training, the Kohonen neural network identifies subclasses with similar input patterns. Each subclass is used to train a specific radial basis network, which results in a local adjustment of the weights of the radial basis network. This can reduce the training burden of the radial basis network and improve the classification of the sample. For a Kohonen neural network trained by a sample data set, only one neuron in the competing layer is activated. A radial basis network corresponding to the activated winning neurons is used as input. Currently, the only neuron in the output layer is the transient stability index.

The steps in SOS-Kohonen intrusion detection are as follows:

Step 1. Initialize the training data set, the number of symbiotic species, and the number of iterations.

Step 2. The initial weights w are adjusted according to the Euclidean distance between the sample vector and the initial weight in the mutualist phase, commensal phase, and parasitic phase of the SOS algorithm.

Step 3. The Kohonen neural network is trained according to the initial weight w optimized by the SOS algorithm.

Step 4. The distance between the competing layer neuron j and the input vector X is calculated:

Step 5. If the minimum distance has been reached, the competing layer neuron X, which matches the sample vector C, is the output neuron of the optimal matching.

Step 6. Adjust the node weight coefficients in node c and neighborhood vector x:

The positions of neurons c and t are denoted by pos_c and pos_t, respectively. The distance between the two neurons is calculated in terms of norm(). η and r represent the learning rate and the neighborhood radius, respectively. They decrease linearly as the number of iterations increases.

Step 7. If the stopping condition is met stop, otherwise return to step 3.

Step 8. Read another test data set.

Step 9. Cluster the input test data set according to the trained weight W.

Step 10. Output the classification result.

Pseudocode corresponding to the steps of SOS-Kohonen intrusion detection is given in Algorithm 1.

The detection processes of BA-Kohonen, CS-Kohonen, FPA-Kohonen, GWO-Kohonen, and PSO-Kohonen can be imitated by SOS-Kohonen.

In intrusion detection, the network data to be assessed have multiple attributes with inconsistent units of measurement. If such data are used directly for intrusion detection, the accuracy and speed will be reduced. Therefore, the input data are pretreated, that is, normalized. The specific preprocessing method is as follows:

(1) The data are standardized so that the mean of each attribute is 0 and the variance is 1. The attributes of the initial network data are denoted by x_ij, and xj¯ and S_j represent the mean and variance of the jth dimension, respectively. The attributes are standardized as follows:

The normalized formula for (10) is as follows:

(2) Normalize formula (10) to the range [0, 1] is as follows:

To verify the effectiveness of SOS-Kohonen in detecting network intrusion by a virus, we ran two sets of tests with the proposed algorithm. The first verified the accuracy of SOS-Kohonen in classifying five types of virus. The second verified the ability of SOS-Kohonen to detect viruses hidden in normal data. The results for SOS-Kohonen were compared with results for Kohonen neural networks combined with one of five commonly used swarm intelligence algorithms: BA, CS, FPA, GWO, and PSO. The relevant parameters for these algorithms were set as follows:

BA: As in Ref. (Xinshe, 2010), r⁰ = 0.5,A = 0.5,α = 0.95,γ = 0.05.

CS: As in Ref.(Yang and Deb, 2009), β = 1.5, ρ₀ = 1.5.

FPA: As in Ref. (Yang, 2012),ρ = 0.8.

GWO: As recommended in Ref. (Mirjalili et al., 2014), α→ = 0 to 2.

PSO: Weight factor ω = 0.6,c₁ = c₂ = 2(Kennedy and Eberhart, 1995), and population size is 15.

SOS: As in Ref. (Cheng and Prayogo, 2014), population size is 15.

With the continuous development and popularization of the Internet, there is much more convenient access to network resources. However, this has led to a continuous increase in security problems due to virus intrusion. In this paper, we combined a swarm intelligence algorithm with a neural network to detect network intrusion by a virus. Our approach is described in detail, and it was tested with the international KDDCUP99 intrusion data set, which verified its effectiveness. Moreover, this is also a new method for detecting network intrusion by a virus. With the rapid development of cloud computing and big data, our future work will consider the application of SOS- Kohonen to heterogeneous distributed systems.

The original contributions presented in this study are included in the article/supplementary material, further inquiries can be directed to the corresponding authors.

GZ: investigation, experiments, and writing the draft. FM: algorithm design. ZT: algorithm analysis. YZ: supervision, reviewing, and editing the manuscript. QL: reviewing and editing the manuscript. All authors contributed to the article and approved the submitted version.