Multi-agent Cooperative Intrusion Detection Based on Generative Data Augmentation

Existing supervised learning methods are difficult to adapt the rapidly evolving network attacks. They are effective for malicious flows with clear features, but struggle with flows that reveal unclear or sparse characteristics. This is a concern as malicious flows are rare and discrete in real-world situations. To overcome these challenges, this research paper introduces a novel few-shot sample malicious flow detection model that leverages data augmentation techniques. The model’s core objective is to train agents to distinguish between normal and malicious flows. On this basis, the model enhances the agents’ ability to recognize malicious flows through discrete information interactions. Experimental results confirm that the data augmentation method effectively improves the agents’ understanding of network traffic. Additionally, it successfully enhances intrusion detection capabilities in multiple agents, diverse datasets, and varied scenarios. Notably, in few-shot sample scenarios, the method greatly boosts the overall accuracy rate.