Exploring Generative Adversarial Networks for Augmenting Network Intrusion Detection Tasks
Authors:
- Mihai Gabriel ConstantinMCMihai Gabriel Constantin
- Dan-Cristian StanciuDSDan-Cristian Stanciu
- Liviu-Daniel ŞtefanLŞLiviu-Daniel Ştefan
- Mihai DogariuMDMihai Dogariu
- Dan MihăilescuDMDan Mihăilescu
- George CiobanuGCGeorge Ciobanu
- Matt BergeronMBMatt Bergeron
- Winston LiuWLWinston Liu
- Konstantin BelovKBKonstantin Belov
- Octavian RaduOROctavian Radu
- Bogdan IonescuBIBogdan Ionescu
Open Access
- 23 December 2024
- journal article
- Published by Association for Computing Machinery (ACM) in ACM Transactions on Multimedia Computing, Communications, and Applications
- Vol. 21 (1) , 1-19
Abstract
The advent of generative networks and their adoption in numerous domains and communities have led to a wave of innovation and breakthroughs in AI and machine learning. Generative Adversarial Networks (GANs) have expanded the scope of what is possible with machine learning, allowing for new applications in areas such as computer vision, natural language processing, and creative AI. GANs, in particular, have been used for a wide range of tasks, including image and video generation, data augmentation, style transfer, and anomaly detection. They have also been used for medical imaging and drug discovery, where they can generate synthetic data to augment small datasets, reduce the need for expensive experiments, and lower the number of real patients that must be included in medical trials. Given these developments, we propose using the power of GANs to create and augment flow-based network traffic datasets. We evaluate a series of GAN architectures, including Wasserstein, conditional, energy-based, gradient penalty, and LSTM-GANs. We evaluate their performance on a set of flow-based network traffic data collected from 16 subjects who used their computers for home, work, and study purposes. The performance of these GAN architectures is described according to metrics that involve networking principles, data distribution among a collection of flows, and temporal data distribution. Given the tendency of network intrusion detection datasets to have a very imbalanced data distribution, i.e., a large number of samples in the “normal traffic” category and a comparatively low number of samples assigned to the “intrusion” categories, we test our GANs by augmenting the intrusion data and checking whether this helps intrusion detection neural networks in their task. We publish the resulting UPBFlow dataset and code on GitHub. 1Keywords
This publication has 18 references indexed in Scilit:
- NFStreamComputer Networks, 2022
- Cancer diagnosis using generative adversarial networks based on deep learning from imbalanced dataComputers in Biology and Medicine, 2021
- CEGAN: Classification Enhancement Generative Adversarial Networks for unraveling data imbalance problemsNeural Networks, 2021
- A Review of the Advancement in Intrusion Detection DatasetsProcedia Computer Science, 2020
- Generation of Network Traffic Using WGAN-GP and a DFT Filter for Resolving Data ImbalanceLecture Notes in Computer Science, 2019
- Flow-based network traffic generation using Generative Adversarial NetworksComputers & Security, 2019
- Using generative adversarial networks for improving classification effectiveness in credit card fraud detectionInformation Sciences, 2019
- Generating Image Sequence from Description with LSTM Conditional GAN2018
- IP2Vec: Learning Similarities Between IP Addresses2017
- Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification2015