基于生成对抗网络的主机入侵风险识别

INTRUSION RISK RECOGNITION BASED ON GENERATIVE ADVERSARIAL NETWORK

随着互联网的发展,针对主机漏洞发起的入侵层出不穷,计算机安全问题日益突出,基于深度学习的入侵检测成为研究热点,但仍然存在攻击训练样本少以及无法有效检测未知攻击的问题。基于AC-GAN和LS-GAN,设计并实现主机入侵风险识别网络TR-GAN,该模型能有效解决梯度偏移或梯度消失的问题。TR-GAN相较于AC-GAN及LS-GAN,不但风险识别准确率更稳定,最大识别准确率达到80%,且其风险样本生成模块能在较少训练迭代轮数下就生成与真实攻击样本具有相同特征的攻击样本。生成的攻击样本不但可以作为训练样本的补充,而且可作为部署系统安全策略的参考。

With the development of the Internet, computer security is becoming more and more challenging. Although deep learning-based intrusion detection has become a research hotspot, there are still problems with less training attack samples and the inability to effectively detect unknown attacks. This paper designes a threaten-recognition network(TR-GAN) based on the AC-GAN and LS-GAN, which can effectively solve the problem of gradient shift or disappear. Compared with AC-GAN and LS-GAN, TR-GAN has more stable recognition accuracy and its maximum recognition accuracy reaches 80%. The risk samples generation module presents the same features as the real attack samples even under fewer training iterations. Those generated attack samples can not only be used as supplement to the training attack samples, but also as references for deploying system security policies.