A recombination generative adversarial network for intrusion detection

Luo, Haoqi ; Wan, Liang 

International Journal of Applied Mathematics and Computer Science, Tome 34 (2024) no. 2, pp. 323-334.

Résumé

The imbalance and complexity of network traffic data are hot issues in the field of intrusion detection. To improve the detection rate of minority class attacks in network traffic, this paper presents a method for intrusion detection based on the recombination generative adversarial network (RGAN). In this study, dual-stage game learning is used to optimize the discriminator for efficient identification of attack samples. In the first stage, the proposed model trains a deep convolutional generative adversarial network (DCGAN) integrated with the self-attention (SA) mechanism, and simultaneously trains an independent convolutional neural network (CNN) classifier integrated with the gated recurrent unit (GRU). This stage allows the generator to generate minority class attack samples that closely resemble real samples, while the independent classifier possesses the basic classification ability. In the second stage, the generator and the independent classifier of the DCGAN together constitute the second layer of the model - the generative adversarial network. Through dual-stage game learning, the classifier’s discrimination ability for the minority samples is optimized, and it serves as the final output of the discriminator. In addition, the introduction of reconstruction loss helps prevent the detection rate of false positive samples. Experimental results on the CSE-IDS-2018 dataset demonstrate that our model performs well compared with various other intrusion detection techniques in terms of detection accuracy, recall, and F1-score for minority class attacks.

Détail

Keywords: intrusion detection, generative adversarial network, class imbalance, RGAN
Mots-clés : wykrywanie włamań, klasy niezrównoważone, RGAN

Bibliographie

[1] Andresini, G., Appice, A., De Rose, L. and Malerba, D. (2021). GAN augmentation to deal with imbalance in imaging-based intrusion detection, Future Generation Computer Systems 123(2021): 108-127, DOI:10.1016/j.future.2021.04.017.

[2] Bedi, P., Gupta, N. and Jindal, V. (2021). I-SIAMIDS: An improved SIAM-IDS for handling class imbalance in network-based intrusion detection systems, Applied Intelligence 51(2): 1133-1151.

[3] Brunner, C., Ko, A. and Fodor, S. (2022). An autoencoder-enhanced stacking neural network model for increasing the performance of intrusion detection, Journal of Artificial Intelligence and Soft Computing Research 12(2): 149-163.

[4] Cui, J., Zong, L., Xie, J. and Tang, M. (2023). A novel multi-module integrated intrusion detection system for high-dimensional imbalanced data, Applied Intelligence 53(1): 272-288.

[5] Dainotti, A., Pescape, A. and Claffy, K.C. (2012). Issues and future directions in traffic classification, IEEE Network 26(1,SI): 35-40.

[6] Fu, W., Qian, L. and Zhu, X. (2021). GAN-based intrusion detection data enhancement, Proceedings of the 33rd Chinese Control and Decision Conference (CCDC 2021), Kunming, China, pp. 2739-2744.

[7] Gelenbe, E. and Nakip, M. (2023). IoT network cybersecurity assessment with the associated random neural network, IEEE Access 11: 85501-85512, DOI: 10.1109/ACCESS.2023.3297977.

[8] Goodfellow, I.J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A. and Bengio, Y. (2014). Generative adversarial nets, 28th Conference on Advances in Neural Information Processing Systems (NIPS 2014), Montreal, Canada, pp. 2672-2680.

[9] Gupta, N., Jindal, V. and Bedi, P. (2022). CSE-IDS: Using cost-sensitive deep learning and ensemble algorithms to handle class imbalance in network-based intrusion detection systems, Computers & Security 112(2022): 102499, DOI:10.1016/j.cose.2021.102499.

[10] Jabbar, A., Li, X. and Omar, B. (2021). A survey on generative adversarial networks: Variants, applications, and training, ACM Computing Surveys 54(8): 1-49.

[11] Kanna, P.R. and Santhi, P. (2021). Unified deep learning approach for efficient intrusion detection system using integrated spatial-temporal features, Knowledge-Based Systems 226: 107132.

[12] Kumar, Y., Chouhan, L. and Subba, B. (2021). Deep learning techniques for anomaly based intrusion detection system: A survey, in S. Paul and J. Verma (Eds), 2021 International Conference on Computational Performance Evaluation (COMPE-2021), Shillong, India, pp. 915-920.

[13] Laghrissi, F., Douzi, S., Douzi, K. and Hssina, B. (2021). Intrusion detection systems using long short-term memory (LSTM), Journal of Big Data 8(1): 65.

[14] Liao, D., Zhou, R., Li, H., Zhang, M. and Chen, X. (2022). GE-IDS: An intrusion detection system based on grayscale and entropy, Peer-to-Peer Networking and Applications 15(3): 1521-1534.

[15] Liu, C., Antypenko, R., Sushko, I. and Zakharchenko, O. (2022). Intrusion detection system after data augmentation schemes based on the VAE and CVAE, IEEE Transactions on Reliability 71(2): 1000-1010.

[16] Nosouhian, S., Nosouhian, F. and Khoshouei, A.K. (2021). A review of recurrent neural network architecture for sequence learning: Comparison between LSTM and GRU, Preprints.org: 202107.0252, DOI: 10.20944/preprints202107.0252.v1.

[17] Oksuz, K., Cam, B.C., Kalkan, S. and Akbas, E. (2021). Imbalance problems in object detection: A review, IEEE Transactions on Pattern Analysis and Machine Intelligence 43(10): 3388-3415.

[18] Qazi, E.U.H., Faheem, M.H. and Zia, T. (2023). HDLNIDS: Hybrid deep-learning-based network intrusion detection system, Applied Sciences 13(8): 4921.

[19] Radford, A., Metz, L. and Chintala, S. (2016). Unsupervised representation learning with deep convolutional generative adversarial networks, ArXiv: 1511.06434.

[20] Sabahi, F. and Movaghar, A. (2008). Intrusion detection: A survey, 2008 3rd International Conference on Systems and Networks Communications, Slema,Malta, pp. 23-26, DOI: 10.1109/ICSNC.2008.44.

[21] Sun, H., Wan, L., Liu, M. and Wang, B. (2023). Few-shot network intrusion detection based on prototypical capsule network with attention mechanism, Plos ONE 18(4): e0284632.

[22] Thakkar, A. and Lohiya, R. (2023). Fusion of statistical importance for feature selection in deep neural network-based intrusion detection system, Information Fusion 90(2023): 353-363, DOI: 10.1016/j.inffus.2022.09.026.

[23] Wang, W., Sheng, Y., wang, J., Zeng, X., Ye, X., Huang, Y. and Zhu, M. (2018). HAST-IDS: Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection, IEEE Access 6(2018): 1792-1806, DOI: 10.1109/ACCESS.2017.2780250.

[24] Wang, Z., Liu, Y., He, D. and Chan, S. (2021). Intrusion detection methods based on integrated deep learning model, Computers & Security 103(2021): 102177.

[25] Xiao, Y., Xing, C., Zhang, T. and Zhao, Z. (2019). An intrusion detection model based on feature reduction and convolutional neural networks, IEEE Access 7: 42210-42219, DOI: 10.1109/ACCESS.2019.2904620.

[26] Yuan, L., Yu, S., Yang, Z., Duan, M. and Li, K. (2023). A data balancing approach based on generative adversarial network, Future Generation Computer Systems 141(2023): 768-776.

[27] Zhang, H., Ge, L. and Wang, Z. (2022a). A high performance intrusion detection system using LightGBM based on oversampling and undersampling, in D. Huang et al. (Eds), Intelligent Computing Theories and Application (ICIC 2022), Lecture Notes in Computer Science, Vol. 13393, Springer, Cham, pp. 638-652, DOI: 10.1007/978-3-031-13870-6_53.

[28] Zhang, X., Wang, J. and Zhu, S. (2022b). Dual generative adversarial networks based unknown encryption ransomware attack detection, IEEE Access 10(2021): 900-913, DOI: 10.1109/ACCESS.2021.3128024.

[29] Zhou, Y., Cheng, G., Jiang, S. and Dai, M. (2020). Building an efficient intrusion detection system based on feature selection and ensemble classifier, Computer Networks 174(2020): 107247, DOI: 10.1016/j.comnet.2020.107247.

[30] Zou, L., Luo, X., Zhang, Y., Yang, X. and Wang, X. (2023). HC-DTTSVM: A network intrusion detection method based on decision tree twin support vector machine and hierarchical clustering, IEEE Access 11(2023): 21404-21416, DOI: 10.1109/ACCESS.2023.3251354.