AE-CGAN Model based High Performance Network Intrusion Detection System

Joohwa Lee,Keehyun Park

doi:10.3390/app9204221

Abstract

In this paper, a high-performance network intrusion detection system based on deep learning is proposed for situations in which there are significant imbalances between normal and abnormal traffic. Based on the unsupervised learning models autoencoder (AE) and the generative adversarial networks (GAN) model during deep learning, the study aim is to solve the imbalance of data and intrusion detection of high performance. The AE-CGAN (autoencoder-conditional GAN) model is proposed to improve the performance of intrusion detection. This model oversamples rare classes based on the GAN model in order to solve the performance degradation caused by data imbalance after processing the characteristics of the data to a lower level using the autoencoder model. To measure the performance of the AE-CGAN model, data is classified using random forest (RF), a typical machine learning classification algorithm. In this experiment, we used the canadian institute for cybersecurity intrusion detection system (CICIDS)2017 dataset, the latest public dataset of network intrusion detection system (NIDS), and compared the three models to confirm efficacy of the proposed model. We compared the performance of three types of models. These included single-RF, a classification model using only a classification algorithm, AE-RF which is processed by classifying data features, and the AE-CGAN model which is classified after solving the data feature processing and data imbalance. Experimental results showed that the performance of the AE-CGAN model proposed in this paper was the highest. In particular, when the data were unbalanced, the performances of recall and F1 score, which are more accurate performance indicators, were 93.29% and 95.38%, respectively. The AE-CGAN model showed much better performance.

Highlights

Accurate and targeted attacks are being made due to the increase in data collected from various sources
The Network intrusion detection system (NIDS) based on the AE-conditional GAN (CGAN) model proposed in this paper is shown in Figure 3 and can be to extract low-dimensional features, and the CGAN model is used to oversample rare classes to solve divided into feature extraction, data imbalance resolution, and classification
We measure the performance of the autoencoder-conditional generative adversarial nets (AE-CGAN)-random forest (RF) model trained by using the most optimal feature found in AE and using it as input of generative adversarial networks (GAN) and adding class label as condition

Summary

Introduction

Accurate and targeted attacks are being made due to the increase in data collected from various sources. These attacks use malicious code to target a large network and destroy the authority of the administrator [1]. To defend against these attacks, a variety of security defense solutions are available, but the sophisticated methods used by cybercriminals in their attacks make the majority of solutions ineffective. Network intrusion detection system (NIDS) is an important security defense technology, and the detection methods it uses can be divided into misuse detection method and abnormal behavior detection method [2]. The study of abnormal behavior detection techniques is essential and is the ultimate goal of the NIDS [3]

Objectives

Methods

Results

Conclusion