Network intrusion detection systems (IDS) often have extreme class imbalance, in which rare attack instances are largely at a low level due to benign traffic. This imbalance weakens the overall ability of detectors based on abnormalities, especially in recognizing minority attacks. To address this challenge, we propose TD-GAN (Task-Driven Generative Adversarial Network), which performs data augmentation using conditional generative networks. Unlike the common logic focusing only on data realism, TD-GAN combines the categorical feedback on multi-target-weight loss functions, instructions for creating coherent, diverse and semantic attacks. We evaluate TD-GAN on two sets of reference data, CICIDS2017 and TON_IoT, using five classifier models through a number of augmentation strategies. The results showed that TD-GAN improved the recall and F1 score, especially for rare attacks, while maintaining high accuracy. Compared to CGAN and ACGAN, TD-GAN shows stronger strength and generalization between models. The analysis of formal-based interpretation also shows the improvement in the development of the classification of important characteristics, showing improved semantic linkage. These results emphasize the effectiveness of the overall augmentation in tasks in building reliable and understandable intrusion detection systems.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Task-Driven GAN for Class-Imbalanced Intrusion

  • Yangle Ma,
  • Rijie Hao,
  • Kai Jin,
  • Sheng Huo,
  • Ping Jiang

摘要

Network intrusion detection systems (IDS) often have extreme class imbalance, in which rare attack instances are largely at a low level due to benign traffic. This imbalance weakens the overall ability of detectors based on abnormalities, especially in recognizing minority attacks. To address this challenge, we propose TD-GAN (Task-Driven Generative Adversarial Network), which performs data augmentation using conditional generative networks. Unlike the common logic focusing only on data realism, TD-GAN combines the categorical feedback on multi-target-weight loss functions, instructions for creating coherent, diverse and semantic attacks. We evaluate TD-GAN on two sets of reference data, CICIDS2017 and TON_IoT, using five classifier models through a number of augmentation strategies. The results showed that TD-GAN improved the recall and F1 score, especially for rare attacks, while maintaining high accuracy. Compared to CGAN and ACGAN, TD-GAN shows stronger strength and generalization between models. The analysis of formal-based interpretation also shows the improvement in the development of the classification of important characteristics, showing improved semantic linkage. These results emphasize the effectiveness of the overall augmentation in tasks in building reliable and understandable intrusion detection systems.