CWGAN-DNN:一种条件Wasserstein生成对抗网络入侵检测方法

CWGAN-DNN:An Intrusion Detection Method Based on Conditional Wasserstein Generative Adversarial Network

针对现有的基于机器学习的入侵检测系统对类不平衡数据检测准确率低的问题,提出一种基于条件Wasserstein生成对抗网络(CWGAN)和深度神经网络(DNN)的入侵检测(CWGAN-DNN)。CWGAN-DNN通过生成样本来改善数据集的类不平衡问题,提升对少数类和未知类的检测效率。首先,通过变分高斯混合模型(VGM)对原始数据中的连续特征进行处理,将连续特征的高斯混合分布进行分解;然后利用CWGAN学习预处理后数据的分布并生成新的少数类数据样本、平衡训练数据集;最后,利用平衡训练集对DNN进行训练,将训练得到的DNN用于入侵检测。在NSL-KDD数据集上进行的实验结果表明:利用CWGAN生成的数据进行训练,DNN的分类准确率和F1分数提升了5%,AUC下降了2%;与其他类均衡方法相比,CWGAN-DNN的准确率至少提升了3%、F1分数和AUC提升了1%。

In order to solve the problem of low detection accuracy of class imbalance data by existing intrusion detection systems based on machine learning,an intrusion detection method based on conditional Wasserstein generative adversarial network(CWGAN)and deep neural network(DNN)is proposed.CWGAN-DNN improve the class imbalance problem of data sets by generating samples,and the detection efficiency of intrusion detection system(IDS)on minority and unknown classes is increased.Firstly,the data are preprocessed by the variation Gaussian mixture model(VGM)to decompose the mixed distribution of continuous features.And then the CWGAN is used to learn the distribution of original dataset and generate minority-class data to balance the training dataset,and train the DNN with balanced dataset.Finally,the trained DNN is used for intrusion detection.The experimental results on NSL-KDD dataset show that the data generated by CWGAN can improve DNN’s classification accuracy and F1 score by 5%,but AUC decreases by 2%.Compared with other equalization methods,the accuracy,F1 score and AUC of CWGAN-DNN are improved by at least 3%,1%and 1%.