面向网络流量数据增强的生成对抗网络改进研究

doi:10.3778/j.issn.1002-8331.2306-0022

摘要/Abstract

摘要： 网络流量数据的高维复杂特性，使得生成对抗网络生成的网络流量数据质量较差。为了解决该问题，提出一种基于双生成器的条件映射生成对抗网络（a cGAN with projection discriminator based on double generators，PD-DcGAN）并将其应用于少数类流量增强。提出基于Gumbel-sigmoid分布的离散生成器，获得近似于离散数据的光滑可导分布生成离散特征，并将其与连续数据生成器并联运行，二者结果串联组合，获得数据整体分布情况；以内积形式融合条件信息和特征信息，克服传统方法出现假设空间增大的问题，缓解模型训练过程中的不稳定现象；在损失函数中引入梯度惩罚因子，将判别器梯度限定在一定范围内，有效缓解梯度爆炸。利用UNSW-NB15数据集，从生成样本质量和模型有效性两个角度检验模型性能。实验结果证明，与其他数据增强方法相比，PD-DcGAN在准确率、精确率、召回率和F1得分上分别平均提高2.72%、1.72%、1.87%和1.16%；与原始数据集相比，对难以检测的Analysis、Backdoors、Exploits、Shellcode和Worms等少数类流量检测性能提升明显，分别从不足1%分别提升至7.93%、6.53%、15.72%、14.02%和10.91%。

关键词: 生成对抗网络, 双生成器结构, 数据增强, 不平衡数据集, 网络流量分类

Abstract: Due to the high-dimensional and complex characteristics of network traffic data, the quality of the network traffic data generated by the GAN is poor. In order to solve this problem, a cGAN with projection discriminator based on double generators（PD-DcGAN） is proposed and applied to minority class traffic enhancement. Firstly, a discrete generator based on Gumbel-sigmoid distribution is proposed, which obtains a smooth derivable distribution similar to discrete data for discrete feature learning, and runs in parallel with the continuous generator, the two results are combined in series to obtain the overall distribution of data.Then the conditional information and feature information are fused in the form of the inner product to overcome the problem of increasing hypothetical space in traditional methods and alleviate the instability in the process of model training. Finally, the gradient penalty factor is introduced into the loss function to limit the discriminator gradient to a certain range to effectively alleviate the gradient explosion. Using UNSW-NB15 dataset to verify the quality of the generated samples and the validity of the model. The experimental results show that compared with other data augmentation methods, the accuracy, precision, recall rate, and F1 score of the proposed method are improved by 2.72%, 1.72%, 1.87%, and 1.16% respectively. Compared with the original dataset, the performance of traffic detection for minority classes such as Analysis, Backdoors, Exploits, Shellcode, and Worms which are difficult to detect is significantly improved, from less than 1% to 7.93%, 6.53%, 15.72%, 14.02%, and 10.91% respectively.

Key words: generative adversarial network, double generator structure, data augmentation, imbalanced dataset, network traffic classification

张雅雯, 张玉臣, 吴越, 李程. 面向网络流量数据增强的生成对抗网络改进研究[J]. 计算机工程与应用, 2024, 60(18): 275-284.

ZHANG Yawen, ZHANG Yuchen, WU Yue, LI Cheng. Research on Improvement of Generation Adversarial Networks for Network Traffic Datasets Augmentation[J]. Computer Engineering and Applications, 2024, 60(18): 275-284.

参考文献

[1] 蹇诗婕, 卢志刚, 杜丹, 等. 网络入侵检测技术综述[J]. 信息安全学报, 2020, 5(4): 96-122.
JIAN S J, LU Z G, DU D. Overview of network intrusion detection technology[J]. Journal of Cyber Security, 2020, 5(4): 96-122.
[2] 和湘, 刘晟, 姜吉国. 基于机器学习的入侵检测方法对比研究[J]. 信息网络安全, 2018, 18(5): 1-11.
HE X, LIU S, JIANG J G. Comparative study of intrusion detection methods based on machine learning[J].Netinfo Security, 2018, 18(5): 1-11.
[3] MUKHERJEE B, HEBERLEIN L T, LEVITT K N. Network intrusion detection[J]. IEEE Network, 1994, 8(3): 26-41.
[4] FERRAG M A, MAGLARAS L, MOSCHOYIANNIS S, et al. Deep learning for cyber security intrusion detection: approaches, datasets, and comparative study[J]. Journal of Information Security and Applications, 2020, 50：102419.
[5] WHEELUS C, BOU-HARB E, ZHU X. Tackling class imbalance in cyber security datasets[C]//Proceedings of the 2018 IEEE International Conference on Information Reuse and Integration (IRI), 2018.
[6] LI W, SUN S, ZHANG S, et al. Cost-sensitive approach to improve the HTTP traffic detection performance on imbalanced data[J]. Security and Communication Networks, 2021, 2021: 1-11.
[7] ZONG W, HUANG G B, CHEN Y. Weighted extreme learning machine for imbalance learning[J]. Neurocomputing, 2013, 101: 229-242.
[8] BAHNSEN A C, AOUADA D, OTTERSTEN B. Example-dependent cost-sensitive decision trees[J]. Expert Systems with Applications, 2015, 42(19): 6609-6619.
[9] 曹雅茜, 黄海燕. 基于代价敏感大间隔分布机的不平衡数据分类算法[J]. 华东理工大学学报 (自然科学版), 2019, 45(4): 606-613.
CAO Y X, HUANG H Y.Imbalanced data classification based on cost-sensitive large margin distribution machine[J].Journal of East China University of Science and Technology, 2019, 45(4): 606-613.
[10] 周瑜, 顾宏. 面向不平衡数据的逻辑回归偏标记学习算法[J]. 大连理工大学学报, 2017, 57(2): 184-188.
ZHOU Y, GU H.Partial label learning algorithm for imbalanced data based on logistic regression[J].Journal of Dalian University of Technology, 2017, 57(2): 184-188.
[11] CHAWLA N V, BOWYER K W, HALL L O, et al. SMOTE: synthetic minority over-sampling technique[J]. Journal of Artificial Intelligence Research, 2002, 16: 321-357.
[12] HE H, BAI Y, GARCIA E A, et al. ADASYN: adaptive synthetic sampling approach for imbalanced learning[C]//Proceedings of the 2008 IEEE International Joint Conference on Neural Networks (IEEE World Congress on Computational Intelligence), 2008.
[13] YAN B, HAN G. LA-GRU: building combined intrusion detection model based on imbalanced learning and gated recurrent unit neural network[J]. Security and Communication Networks, 2018, 2018(1):6026878.
[14] ANAND A, PUGALENTHI G, FOGEL G B, et al. An approach for classification of highly imbalanced data using weighting and undersampling[J]. Amino Acids, 2010, 39: 1385-1391.
[15] KOZIARSKI M. Radial-based undersampling for imbalanced data classification[J]. Pattern Recognition, 2020, 102: 107262.
[16] GOODFELLOW I, POUGET-ABADIE J, MIRZA M, et al. Generative adversarial networks[J]. Communications of the ACM, 2020, 63(11): 139-144.
[17] MIRZA M, OSINDERO S. Conditional generative adversarial nets[J]. arXiv:1411.1784, 2014.
[18] BAEK S, KIM K I, KIM T K. Weakly-supervised domain adaptation via gan and mesh model for estimating 3D hand poses interacting objects[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
[19] ZHOU H, CAI R, QUAN T, et al. 3D high resolution generative deep?learning network for fluorescence microscopy imaging[J]. Optics Letters, 2020, 45(7): 1695-1698.
[20] MOKHAYERI F, KAMALI K, GRANGER E. Cross-domain face synthesis using a controllable GAN[C]//Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2020.
[21] KOWALSKI M, GARBIN S J, ESTELLERS V, et al. Config: controllable neural face image generation[C]//Proceedings of the 16th European Conference on Computer Vision (ECCV 2020) , Glasgow, UK, August 23-28, 2020.
[22] FATHI-KAZEROONI S, ROJAS-CESSA R. GAN tunnel: network traffic steganography by using GANs to counter internet traffic classifiers[J]. IEEE Access, 2020, 8: 125345-125359.
[23] 潘一鸣, 林家骏. 基于生成对抗网络的恶意网络流生成及验证[J]. 华东理工大学学报 (自然科学版), 2019, 45(2): 344-350.
PAN Y M, LIN J J.Generation and verification of malicious network flow based on generative adversarial networks[J]. Journal of East China University of Science and Technology, 2019, 45(2): 344-350.
[24] ANDRESINI G, APPICE A, DE ROSE L, et al. GAN augmentation to deal with imbalance in imaging-based intrusion detection[J]. Future Generation Computer Systems, 2021, 123: 108-127.
[25] LEE J, PARK K. GAN-based imbalanced data intrusion detection system[J]. Personal and Ubiquitous Computing, 2021, 25: 121-128.
[26] YILMAZ I, MASUM R, SIRAJ A. Addressing imbalanced data problem with generative adversarial network for intrusion detection[C]//Proceedings of the 2020 IEEE 21st International Conference on Information Reuse and Integration for Data Science (IRI), 2020.
[27] 孙佳佳, 李承礼, 常德显, 等. 基于生成对抗网络的入侵检测类别不平衡问题数据增强方法[J]. 科学技术与工程, 2022, 22(18): 7965-7971.
SUN J J, LI C L, CHANG D X.Data augmentation method for intrusion detection imbalance problem using generative adversarial networks[J]. Science Technology and Engineering, 2022, 22(18): 7965-7971.
[28] 王华忠, 田子蕾. 基于改进CGAN算法的工控系统入侵检测方法[J]. 信息网络安全, 2023, 23(1): 36-43.
WANG H Z, TIAN Z L. Intrusion detection method of ICS based on improved CGAN algorithm[J]. Netinfo Security, 2023, 23(1): 36-43.
[29] YU L, ZHANG W, WANG J, et al. SeqGAN: sequence generative adversarial nets with policy gradient[C]//Proceedings of the AAAI Conference on Artificial Intelligence, 2017.
[30] 张菲菲. 基于过采样的不平衡数据集成分类算法研究 [D].郑州：郑州大学, 2018.
ZHANG F F.Research of imbalanced data ensemble classification algorithm based on oversampling[D]. Zhengzhou: Zhengzhou University, 2018.
[31] BATISTA G E, PRATI R C, MONARD M C. A study of the behavior of several methods for balancing machine learning training data[J]. ACM SIGKDD Explorations Newsletter, 2004, 6(1): 20-29.
[32] YAN S, SMITH J S, LU W, et al. Hierarchical multi-scale attention networks for action recognition[J]. Signal Processing: Image Communication, 2018, 61: 73-84.
[33] MIYATO T, KOYAMA M. cGANs with projection discriminator[J]. arXiv:1802.05637, 2018.
[34] GULRAJANI I, AHMED F, ARJOVSKY M, et al. Improved training of wasserstein gans[C]//Advances in Neural Information Processing Systems, 2017.
[35] MOUSTAFA N, SLAY J. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)[C]//Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), 2015.
[36] CHANG L, BRANCO P. Graph-based solutions with residuals for intrusion detection: the modified E-GraphSAGE and E-ResGAT algorithms[J]. arXiv:2111.13597, 2021.
[37] AL OLAIMAT M, LEE D, KIM Y, et al. A learning-based data augmentation for network anomaly detectio[C]//Proceedings of the 2020 29th International Conference on Computer Communications and Networks (ICCCN), 2020.