A GAN and Feature Selection-Based Oversampling Technique for Intrusion Detection

Abstract

In recent years, there have been numerous cyber security issues that have caused considerable damage to the society. The development of efficient and reliable Intrusion Detection Systems (IDSs) is an effective countermeasure against the growing cyber threats. In modern high-bandwidth, large-scale network environments, traditional IDSs suffer from a high rate of missed and false alarms. Researchers have introduced machine learning techniques into intrusion detection with good results. However, due to the scarcity of attack data, such methods’ training sets are usually unbalanced, affecting the analysis performance. In this paper, we survey and analyze the design principles and shortcomings of existing oversampling methods. Based on the findings, we take the perspective of imbalance and high dimensionality of datasets in the field of intrusion detection and propose an oversampling technique based on Generative Adversarial Networks (GAN) and feature selection. Specifically, we model the complex high-dimensional distribution of attacks based on Gradient Penalty Wasserstein GAN (WGAN-GP) to generate additional attack samples. We then select a subset of features representing the entire dataset based on analysis of variance, ultimately generating a rebalanced low-dimensional dataset for machine learning training. To evaluate the effectiveness of our proposal, we conducted experiments based on the NSL-KDD, UNSW-NB15, and CICIDS-2017 datasets. The experimental results show that our method can effectively improve the detection performance of machine learning models and outperform the baselines.

On the Performance of Generative Adversarial Network by Limiting Mode Collapse for Malware Detection Systems

“…Table 1 shows the comparative results for the proposed ICF-GAN approach and two approaches from the literature RF-NIDS [ 53 ] and GAN-FS [ 54 ]. We can see that the proposed approach outperforms both RF-NIDS [ 53 ] and GAN-FS [ 54 ].…”

“…The Generative Adversarial Networks (GAN) and Feature Selection (GAN-FS) is an oversampling methodology with the perspective of data imbalance elimination [ 54 ]. GAN-FS is a hybrid of Gradient Penalty Wasserstein GAN (WGAN-GP), using Analysis of Variance (ANOVA) as a feature-selected rebalancer for low dimensional datasets and RF, scoped in countering training instability [ 54 ]. In Table 1 , a low Wasserstein distance in the model is indicative of data balancing in the training and test sets with an incremental increase [ 54 ].…”

“…GAN-FS is a hybrid of Gradient Penalty Wasserstein GAN (WGAN-GP), using Analysis of Variance (ANOVA) as a feature-selected rebalancer for low dimensional datasets and RF, scoped in countering training instability [ 54 ]. In Table 1 , a low Wasserstein distance in the model is indicative of data balancing in the training and test sets with an incremental increase [ 54 ].…”

“…The logistic regression detection model was trained on the same data set as ICF-GAN [ 51 , 52 ]. Unlike Wasserstein distance methodology nor the feature extraction, by duel conditional frequency and spatial parsing presented in Deep-IRTarget, the ICF-GAN proposed model addresses the gap in PCAP discriminator, limited LSTM layer optimization without overfitting by labeling and loss function modification, prior to ingestion in a Control Flow model with capacity limitations for detection sensitive alignment [ 53 , 54 , 55 , 56 , 57 ].…”

Network Intrusion Detection Method Based on FCWGAN and BiLSTM

“…However, only ordinary GAN is used for sample generation, without considering the instability of the GAN, there are hidden dangers in the process of sample generation, and other datasets and models were not used to further validate its feasibility, which is not convincing. Liu et al [ 6 ] proposed a GAN-FS method to address feature redundancy. The model can select dataset features based on feature variance, eliminate the impact of redundant data and useless data on the model detection effect to a great extent, improve the accuracy and speed of detection, and uses a GAN to generate samples, which increase the number of samples and enhance the training effect.…”