改进逆向习得推理的网络异常行为检测模型

Network abnormal behavior detection model based on improved adversarially learned inference

针对网络异常行为检测中数据不平衡导致召回率低的问题,提出一种改进逆向习得推理(ALI)的网络异常行为检测模型。首先,使用仅由正样本所构成的数据对改进的ALI模型进行训练,通过已训练的改进的ALI模型处理检测数据,生成处理后的检测数据集;然后,使用异常检测函数计算处理后的检测数据与检测数据的距离以判断是否异常。在KDD99数据集上与AnoGAN等常用模型进行对比实验,实验结果表明,所设计模型在数据不平衡时具有较高的召回率,相比AnoGAN,召回率提升16%。

In allusion to the poor recall rate caused by data imbalance in the network abnormal behavior detection,a network abnormal behavior detection model based on improved adversarially learned inference(ALI)is proposed.The data only composed of positive samples is used to train the improved ALI model,and the trained ALI model is utilized to process the detection data to generate the processed detection dataset.The distance between the processed detection data and the detected data is calculated by means of the anomaly detection function to determine whether it is abnormal.The detection model is compared with the commonly used models such as AnoGAN on the KDD99 dataset.The experimental results show the designed model has a higher recall rate when the data is unbalanced,and the recall rate is 16%higher than that of AnoGAN.