小样本数据生成及其在异常检测中的应用  

The Generation of Minority Sample Data and Its Application in Abnormal Detection

作　　者：卢逸君 滕少华[1] LU Yijun;TENG Shaohua(College of Computer,Guangdong University of Technology,Guangzhou Guangdong 510006,China;Guangdong Information Technology Security Evaluation Center,Guangzhou Guangdong 510095,China)

机构地区：[1]广东工业大学计算机学院,广东广州510006 [2]广东省信息安全测评中心,广东广州510095

出　　处：《江西师范大学学报（自然科学版）》2020年第4期385-393,共9页Journal of Jiangxi Normal University(Natural Science Edition)

基　　金：国家自然科学基金(61702110,61772141,61972102);广东省重点领域研发计划(2020B010166006);广东省教育厅课题(粤教高函[2018]179号,粤教高函[2018]1号);广州市科技计划课题(201903010107)资助项目.

摘　　要：在不平衡数据的应用中,少量的负样本(异常数据)往往是检测准确率低的重要原因,如在主机异常检测领域中,异常样本过少使得检测效果不佳.为解决这一问题,该文改进了深度卷积生成对抗网络,使其更易于收敛和生成样本.再通过将改进的深度卷积生成对抗网络用于入侵检测评测数据集ADFA-LD异常样本的训练,构造出更多的异常样本.最后,为验证生成样本的效果,以多种异常检测方法检测对上述增加样本后的平衡数据进行实验,实验结果发现新增加的异常样本能被全部检测出,而且已测出的异常样本无漏检,实现了高检测率和低误报率.对比实验表明该文提出的小样本数据生成方法能有效解决某些数据不平衡的应用问题.In the application of unbalanced data,the small number of negative samples(abnormal data)can be an important reason for low detection rate,as in the field of host based intrusion detection,the gap of sample size for majority class and minority class can lead to poor detection result.To solve this problem,the deep convolutional generative adversarial networks(DCGAN)are improved in the paper,making it easier to converge and generate more ideal samples,which introduces improved DCGAN to the intrusion detection evaluation data set ADFA-LD and generates more abnormal samples to make the data set more balanced.Finally,a variety of abnormal detection methods are used in the paper to observe the effect of this data-balancing method.The result shows that newly generated abnormal samples can all be detected,without missing any detected abnormal sample,which leads to higher detection rate and lower false positive rate.Therefore,it is concluded that this data generation method can effectively alleviate some data imbalance problems in practice.

关 键 词：卷积神经网络 生成式对抗网络 样本生成 主机入侵检测 神经网络 

分 类 号：TP183[自动化与计算机技术—控制理论与控制工程]