基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究

曾庆鹏; 郭航恺

doi:10.11959/j.issn.2096-109x.2025019

您当前的位置：

首页 >

文章列表页 >

基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究

学术论文 | 更新时间：2025-05-14

- 基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究
- Application research of sample data generation based on improved Cycle-GAN in intrusion detection
- 网络与信息安全学报 2025年11卷第2期页码：87-101
- 作者机构：
  
  南昌大学数学与计算机学院，江西南昌 330031
- 作者简介：
  
  [ "曾庆鹏（1974- ），男，江西吉水人，南昌大学副教授，主要研究方向为网络与信息安全、信息检索与数据挖掘。" ]
  [ "郭航恺（1998- ），男，辽宁沈阳人，南昌大学硕士生，主要研究方向为网络安全、数据分析与数据增强。" ]
- 基金信息：
  
  国家自然科学基金(62466035)
- DOI：10.11959/j.issn.2096-109x.2025019
  中图分类号： TP391
- 收稿：2024-07-16，
  
  修回：2024-12-11，
  
  纸质出版：2025-04-25
- 稿件说明：
移动端阅览
曾庆鹏, 郭航恺. 基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究[J]. 网络与信息安全学报, 2025, 11(2): 87-101.

ZENG Q P, GUO H K. Application research of sample data generation based on improved Cycle-GAN in intrusion detection[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 87-101.
曾庆鹏, 郭航恺. 基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究[J]. 网络与信息安全学报, 2025, 11(2): 87-101. DOI： 10.11959/j.issn.2096-109x.2025019.

ZENG Q P, GUO H K. Application research of sample data generation based on improved Cycle-GAN in intrusion detection[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 87-101. DOI： 10.11959/j.issn.2096-109x.2025019.

摘要

针对入侵检测领域标准数据集存在数据更新缓慢、某些入侵类别数据样本少、正常数据集与异常数据集分布不平衡等问题，从样本数据增强和检测模型优化两方面入手，将入侵样本数据转为图数据作为Cycle-GAN的输入，再将空间注意力机制引入Cycle-GAN的生成器，保留数据流量特征的同时对关键特征信息进行抽取，采用无监督学习优化原始数据集的分布。提出了一种基于全局注意力和残差结构的分类网络，将预处理得到的图数据作为模型的输入，经过串联通道注意力和空间注意力得到的全局注意力对输入特征分配权重，最后模型输出为入侵分类。在CIC-IDS2017和NSL-KDD数据集上进行实验，与原始数据在同类模型训练结果相比较，在CIC-IDS2017数据集上，

1值从0.853 2提升到0.978 6，召回率从0.914 8提升到0.984 2，在NSL-KDD数据集上，

1值从0.646 2提升到0.844 3，召回率从0.726提升到0.876 8，表明该方法可有效解决入侵检测某些样本类别更新缓慢及某些入侵类别样本少问题。

Abstract

The issue of slow data updates

insufficient data samples for certain intrusion categories

and imbalanced distributions between normal and abnormal data sets in standard intrusion detection data sets have been addressed through both data sample augmentation and detection model optimization. The intrusion sample data was converted into graph data to serve as input for Cycle-GAN

and a spatial attention mechanism was introduced into the Cycle-GAN generator. This approach preserved data traffic characteristics while extracting key feature information and utilized unsupervised learning to optimize the original data set distribution. A classification network based on global attention and residual structure was proposed

taking the preprocessed graph data as input. After serializing channel attention and spatial attention to obtain global attention

input features were weighted. Finally

the model outputted the intrusion classification. Experiments on the CIC-IDS2017 and NSL-KDD data sets showed that

compared to similar models trained with the original data

the F1 score increased from 0.853 2 to 0.978 6 and the recall rate from 0.914 8 to 0.984 2 on the CIC-IDS2017 data set

and the F1 score increased from 0.646 2 to 0.844 3 and the recall rate from 0.726 to 0.876 8 on the NSL-KDD data set. This indicates that the proposed method effectively addressed the problems of slow data updates and insufficient samples for certain intrusion categories in intrusion detection.

关键词

Keywords

references

GU X W , HOWELLS G ， YUAN H Y . A soft prototype-based autonomous fuzzy inference system for network intrusion detection [J ] . Information Sciences , 2024 , 677 : 1 - 19 .

YUAN J R , QIN G H , et al . DGIDS: Dynamic graph-based intrusion detection system for CAN [J ] . Computers&Security , 2024 , 147 : 1 - 14 .

FLORA J , ANTUNES N . Evaluating intrusion detection for microservice applications: Benchmark,dataset, and case studies [J ] . The Journal of Systems and Software , 2024 , 216 : 1 - 16 .

LI H , CHEN W , et al . Enhancing IoT security: A comparative study of feature reduction techniques for intrusion detection system [J ] . Intelligent Systems with Applications , 2024 , 23 : 1 - 40 .

OUYANG Y , LI B , KONG Q , et al . FS-IDS: A novel few-shot learning based intrusion detection system for SCADA networks [J ] . IEEE Transactions on Computers , 2021 .

LUIGI F M , PAULO F A , DIVANILSON R C . Multi-stage deep learning-based intrusion detection system for automotive Ethernet networks [J ] . Ad Hoc Networks , 2024 , 162 : 1 - 15 .

吴越 , 曹国彦 . 面向工业传感网络的时间序列异常检测综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 4 ): 17 - 36 .

WU Y , CAO G Y . Survey of time series anomaly detection for industrial sensor networks [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 4 ): 17 - 36 .

MARTINS I , RESENDE J S , et al . Host-based IDS: A review and open issues of an anomaly detection system in IoT [J ] . Future Generations Computer systems:FGCS , 2022 , 133 : 95 - 133 .

HUANG Y , MA M . ILL-IDS:S An incremental lifetime learning IDS for VANET [J ] . Computers&Security , 2023 , 124 : 28 - 42 .

WANG Z W , SHE Q , et al . Generative adversarial networks in computer vision:A survey and taxonomy [J ] . arXiv Preprint arXiv: 1906.01529 , 2019 .

ZHAO X X , FOK K W , et al . Enhancing network intrusion detection performance using generative adversarial networks [J ] . Computers & Security , 2024 , 145 : 1 - 12 .

RADFORD A , METZ L , CHINTALA S . Unsupervised representation learning with deep convolutional generative adversarial networks [J ] . Computer Science , 2015 .

ARJOVSKY M , CHINTALA S L , et al . Wasserstein generative adversarial networks [C ] // Proceedings of Machine Learning Reseaech(PMLR) . 2017 .

XIE H , LI Q , LAU R Y K , et al . Least squares generative adversarial networks [J ] . IEEE Transactions on Computers , 2016 .

ZHU J Y , PARK T , et al . Unpaired image-to-image translation using cycle-consistent adversarial networks [J ] . IEEE Transactions on Computers , 2017 .

TERMOS M , GHALMANE Z , et al . GDLC: A new graph deep learning framework based on centrality measures for intrusion detection in IoT networks [J ] . Internet of Things , 2024 , 26 : 1 - 21 .

HELIO N . CUNHA NETO, et al. FedSBS: federated-learning participant-selection method for intrusion detection systems[J ] . Computer Networks , 2024 , 244 : 1 - 17 .

KAMIL Z , YUSOF R , et al . Benchmarking of machine learning for anomaly based intrusion detection systems in the CICIDS2017 dataset [J ] . IEEE Access , 2021 .

LEE J , KIM J , et al . Cyber threat detection based on artificial neural networks using event profiles [J ] . IEEE Access , 2019 .

GORYUNOV M N , MATSKEVICH A G , RYBOLOVEV D . Synthesis of a machine learning model for detecting computer attacks based on the CICIDS2017 dataset [J ] . Proceedings of the Institute for System Programming of RAS , 2017 , 32 ( 5 ): 81 - 94

GURUNG S , GHOSE M , SUBEDI A . Deep learning approachon network intrusion detection system using NSL-KDD dataset [J ] . International Journal of Computer Network and Information Security , 2019 .

HOUDA J , MOHAMED I K . Adversarial machine learning for network intrusion detection: A comparative study [J ] . Computer Networks , 2022 , 214 : 1 - 14 .

WANG L H , DAI Q , et al . Lightweight intrusion detection model based on CNN and knowledge distillation [J ] . Applied Soft Computing Journal , 2024 , 165 : 1 - 15 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于异构执行体同步控制的入侵检测模型研究

面向雾计算的个性化轻量级分布式网络入侵检测系统

基于轻量级梯度提升机优化的工业互联网入侵检测方法

面向不平衡样本的物联网入侵检测方法