Application research of sample data generation based on improved Cycle-GAN in intrusion detection

ZENG Qingpeng; GUO Hangkai

doi:10.11959/j.issn.2096-109x.2025019

您当前的位置：

首页 >

文章列表页 >

Application research of sample data generation based on improved Cycle-GAN in intrusion detection

Papers | 更新时间：2025-05-14

- Application research of sample data generation based on improved Cycle-GAN in intrusion detection
- Chinese Journal of Network and Information Security Vol. 11, Issue 2, Pages: 87-101(2025)
- 作者机构：
  
  南昌大学数学与计算机学院，江西南昌 330031
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62466035)
- DOI：10.11959/j.issn.2096-109x.2025019
  CLC： TP391
- Received：16 July 2024，
  
  Revised：2024-12-11，
  
  Published：25 April 2025
- 稿件说明：
移动端阅览
曾庆鹏, 郭航恺. 基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究[J]. 网络与信息安全学报, 2025, 11(2): 87-101.

ZENG Q P, GUO H K. Application research of sample data generation based on improved Cycle-GAN in intrusion detection[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 87-101.
曾庆鹏, 郭航恺. 基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究[J]. 网络与信息安全学报, 2025, 11(2): 87-101. DOI： 10.11959/j.issn.2096-109x.2025019.

ZENG Q P, GUO H K. Application research of sample data generation based on improved Cycle-GAN in intrusion detection[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 87-101. DOI： 10.11959/j.issn.2096-109x.2025019.

摘要

针对入侵检测领域标准数据集存在数据更新缓慢、某些入侵类别数据样本少、正常数据集与异常数据集分布不平衡等问题，从样本数据增强和检测模型优化两方面入手，将入侵样本数据转为图数据作为Cycle-GAN的输入，再将空间注意力机制引入Cycle-GAN的生成器，保留数据流量特征的同时对关键特征信息进行抽取，采用无监督学习优化原始数据集的分布。提出了一种基于全局注意力和残差结构的分类网络，将预处理得到的图数据作为模型的输入，经过串联通道注意力和空间注意力得到的全局注意力对输入特征分配权重，最后模型输出为入侵分类。在CIC-IDS2017和NSL-KDD数据集上进行实验，与原始数据在同类模型训练结果相比较，在CIC-IDS2017数据集上，

1值从0.853 2提升到0.978 6，召回率从0.914 8提升到0.984 2，在NSL-KDD数据集上，

1值从0.646 2提升到0.844 3，召回率从0.726提升到0.876 8，表明该方法可有效解决入侵检测某些样本类别更新缓慢及某些入侵类别样本少问题。

Abstract

The issue of slow data updates

insufficient data samples for certain intrusion categories

and imbalanced distributions between normal and abnormal data sets in standard intrusion detection data sets have been addressed through both data sample augmentation and detection model optimization. The intrusion sample data was converted into graph data to serve as input for Cycle-GAN

and a spatial attention mechanism was introduced into the Cycle-GAN generator. This approach preserved data traffic characteristics while extracting key feature information and utilized unsupervised learning to optimize the original data set distribution. A classification network based on global attention and residual structure was proposed

taking the preprocessed graph data as input. After serializing channel attention and spatial attention to obtain global attention

input features were weighted. Finally

the model outputted the intrusion classification. Experiments on the CIC-IDS2017 and NSL-KDD data sets showed that

compared to similar models trained with the original data

the F1 score increased from 0.853 2 to 0.978 6 and the recall rate from 0.914 8 to 0.984 2 on the CIC-IDS2017 data set

and the F1 score increased from 0.646 2 to 0.844 3 and the recall rate from 0.726 to 0.876 8 on the NSL-KDD data set. This indicates that the proposed method effectively addressed the problems of slow data updates and insufficient samples for certain intrusion categories in intrusion detection.

关键词

Keywords

references

GU X W , HOWELLS G ， YUAN H Y . A soft prototype-based autonomous fuzzy inference system for network intrusion detection [J ] . Information Sciences , 2024 , 677 : 1 - 19 .

YUAN J R , QIN G H , et al . DGIDS: Dynamic graph-based intrusion detection system for CAN [J ] . Computers&Security , 2024 , 147 : 1 - 14 .

FLORA J , ANTUNES N . Evaluating intrusion detection for microservice applications: Benchmark,dataset, and case studies [J ] . The Journal of Systems and Software , 2024 , 216 : 1 - 16 .

LI H , CHEN W , et al . Enhancing IoT security: A comparative study of feature reduction techniques for intrusion detection system [J ] . Intelligent Systems with Applications , 2024 , 23 : 1 - 40 .

OUYANG Y , LI B , KONG Q , et al . FS-IDS: A novel few-shot learning based intrusion detection system for SCADA networks [J ] . IEEE Transactions on Computers , 2021 .

LUIGI F M , PAULO F A , DIVANILSON R C . Multi-stage deep learning-based intrusion detection system for automotive Ethernet networks [J ] . Ad Hoc Networks , 2024 , 162 : 1 - 15 .

吴越 , 曹国彦 . 面向工业传感网络的时间序列异常检测综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 4 ): 17 - 36 .

WU Y , CAO G Y . Survey of time series anomaly detection for industrial sensor networks [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 4 ): 17 - 36 .

MARTINS I , RESENDE J S , et al . Host-based IDS: A review and open issues of an anomaly detection system in IoT [J ] . Future Generations Computer systems:FGCS , 2022 , 133 : 95 - 133 .

HUANG Y , MA M . ILL-IDS:S An incremental lifetime learning IDS for VANET [J ] . Computers&Security , 2023 , 124 : 28 - 42 .

WANG Z W , SHE Q , et al . Generative adversarial networks in computer vision:A survey and taxonomy [J ] . arXiv Preprint arXiv: 1906.01529 , 2019 .

ZHAO X X , FOK K W , et al . Enhancing network intrusion detection performance using generative adversarial networks [J ] . Computers & Security , 2024 , 145 : 1 - 12 .

RADFORD A , METZ L , CHINTALA S . Unsupervised representation learning with deep convolutional generative adversarial networks [J ] . Computer Science , 2015 .

ARJOVSKY M , CHINTALA S L , et al . Wasserstein generative adversarial networks [C ] // Proceedings of Machine Learning Reseaech(PMLR) . 2017 .

XIE H , LI Q , LAU R Y K , et al . Least squares generative adversarial networks [J ] . IEEE Transactions on Computers , 2016 .

ZHU J Y , PARK T , et al . Unpaired image-to-image translation using cycle-consistent adversarial networks [J ] . IEEE Transactions on Computers , 2017 .

TERMOS M , GHALMANE Z , et al . GDLC: A new graph deep learning framework based on centrality measures for intrusion detection in IoT networks [J ] . Internet of Things , 2024 , 26 : 1 - 21 .

HELIO N . CUNHA NETO, et al. FedSBS: federated-learning participant-selection method for intrusion detection systems[J ] . Computer Networks , 2024 , 244 : 1 - 17 .

KAMIL Z , YUSOF R , et al . Benchmarking of machine learning for anomaly based intrusion detection systems in the CICIDS2017 dataset [J ] . IEEE Access , 2021 .

LEE J , KIM J , et al . Cyber threat detection based on artificial neural networks using event profiles [J ] . IEEE Access , 2019 .

GORYUNOV M N , MATSKEVICH A G , RYBOLOVEV D . Synthesis of a machine learning model for detecting computer attacks based on the CICIDS2017 dataset [J ] . Proceedings of the Institute for System Programming of RAS , 2017 , 32 ( 5 ): 81 - 94

GURUNG S , GHOSE M , SUBEDI A . Deep learning approachon network intrusion detection system using NSL-KDD dataset [J ] . International Journal of Computer Network and Information Security , 2019 .

HOUDA J , MOHAMED I K . Adversarial machine learning for network intrusion detection: A comparative study [J ] . Computer Networks , 2022 , 214 : 1 - 14 .

WANG L H , DAI Q , et al . Lightweight intrusion detection model based on CNN and knowledge distillation [J ] . Applied Soft Computing Journal , 2024 , 165 : 1 - 15 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Research on intrusion detection model based on synchronization of heterogenous executer

Personalized lightweight distributed network intrusion detection system in fog computing

Method on intrusion detection for industrial internet based on light gradient boosting machine

IoT intrusion detection method for unbalanced samples

Related Author

HUANG Kai

JIANG Libing

JIANG Yuchang

LAN Julong

GUO Wei

WEI Shuai

ZHU Zhengbin

Yu Hong

Related Institution

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

Songshan Laboratory

Information Engineering University

College of Modern Posts, Chongqing University of Posts and Telecommunications

College of Automation/ Institute of Industrial Internet, Chongqing University of Posts and Telecommunications

⁰