Technical Summary: parHSOM – A Novel Parallel Hierarchical Self-Organizing Map Implementation

Problem Statement

The digital age has necessitated robust Intrusion Detection Systems (IDS) capable of handling large-scale data while maintaining explainability and trustworthiness. Hierarchical Self-Organizing Maps (HSOMs) have emerged as a promising solution for creating trustworthy, AI-based IDS due to their ability to provide topological preservation and dimensionality reduction without losing critical information. However, HSOMs inherit a significant limitation from their parent algorithm, the Self-Organizing Map (SOM): they are trained sequentially. This sequential nature makes training HSOMs on large cybersecurity datasets impractical due to excessive training times. While parallelization is a standard approach to accelerating machine learning, no existing implementation of a parallel HSOM was found in the literature at the time of this research.

Methodology

To address the training time bottleneck, the authors designed parHSOM, a parallel implementation of the HSOM algorithm based on the data-partitioned parallelization method. The research utilized the following design and experimental framework:

• Algorithm Design: The parHSOM architecture divides the training process into two phases:
  1. Phase 1 (Sequential): A SOM is trained on the initial dataset to generate independent clusters.
  2. Phase 2 (Parallel): The parent process spawns child processes for each cluster generated in Phase 1. Each child process independently trains a new SOM on its assigned cluster using a "Vertical Growth Function" (VGF). The VGF calculates error thresholds to determine if a neuron requires further clustering or if it should be labeled as benign or malicious (a leaf node).
  • Implementation: The system was implemented in Python using the Multiprocessing library to manage process synchronization, shared memory, and resource access.
• Experimental Setup:
  • Testbeds: Experiments were conducted on two distinct environments: Testbed 1 (an Alienware Aurora R16 with 24 CPU cores) and Testbed 2 (an H100 server with 64 logical processors).
  • Datasets: Five prominent cybersecurity datasets were used: CIC-IDS-2017, CIC-IDS-2018, NSL-KDD, TON IoT, and UNSW-NB15.
  • Variables: Models were tested across four output grid sizes (2x2, 3x3, 4x4, and 5x5).
  • Metrics: Performance was evaluated using Accuracy, Precision, Recall, F1 Score, False Positive Rate (FPR), False Negative Rate (FNR), Training Time (TT), and Prediction Time (PT).

Key Contributions

1. First Parallel HSOM Implementation: This work presents the first known implementation of a parallel HSOM, filling a gap identified in the literature regarding the acceleration of hierarchical clustering for IDS.
2. Data-Partitioned Architecture: The paper details a specific architecture where the hierarchical nature of the HSOM is leveraged to parallelize the training of child SOMs across independent data subsets.
3. Comprehensive Evaluation: The study provides a rigorous comparison between the proposed parHSOM and the standard Sequential HSOM across diverse datasets, hardware configurations, and grid sizes.

Results

The experimental results demonstrate that parHSOM successfully accelerates the training process without compromising the model's predictive performance:

• Training Time Speedup: parHSOM consistently trained faster than the Sequential HSOM. The maximum speedup observed was 6.056 times faster, achieved on the NSL-KDD dataset using a 3x3 grid on Testbed 2. Generally, the 3x3 grid size yielded the best speedup across most datasets.
• Performance Metrics: There was no significant loss in performance. Metrics such as Accuracy, Precision, F1 Score, FPR, FNR, and Prediction Time remained within a negligible margin (typically within 0.01 or less) between the parallel and sequential versions. In several instances, parHSOM performed slightly better than the sequential version.
• Hardware Observations: While Testbed 1 (single socket) consistently finished training faster in absolute time, Testbed 2 (multi-socket) demonstrated higher relative speedup ratios. The authors suggest that overhead communication costs between sockets in Testbed 2 may have slowed absolute times but highlighted the potential for further optimization in multi-socket environments.
• Dataset Scaling: As dataset size increased, the relative speedup generally decreased, suggesting that the CPU becomes overloaded with child processes as the number of spawned tasks grows.

Significance and Claims

The paper claims that parHSOM provides a viable platform for further investigation into parallel HSOM implementations. Its primary significance lies in proving that the HSOM training process can be parallelized effectively to handle larger datasets, thereby enabling the creation of more robust, explainable, and trustworthy AI-based IDSs.

The authors maintain a modest tone regarding their claims, noting that:

• The work serves as a foundational starting point rather than a final optimized solution.
• The implementation is currently in Python, which is not optimal for minimizing communication overhead compared to languages like C++ or MPI.
• The HSOM still retains some sensitivity to initial conditions, though the parallelization does not exacerbate this issue.

The research concludes that parallelizing the HSOM algorithm is a promising field for improving cybersecurity defenses, provided that future work addresses communication overhead, initialization parameter optimization, and potential GPU utilization.