基于对抗性双通道编码器的网络入侵检测算法  

A Network Intrusion Detection Algorithm Based on Adversarial Dual Channel Encoder

作　　者：金诗博 张立[2] JIN Shibo;ZHANG Li(Tianjin Sino-German University of Applied Technology,Tianjin 300350,China;Shandong University,Weihai 264200,China)

机构地区：[1]天津中德应用技术大学,天津300350 [2]山东大学,山东威海264200

出　　处：《火力与指挥控制》2024年第6期75-82,共8页Fire Control & Command Control

摘　　要：针对网络流量数据不平衡引起少数类攻击检测率低的问题,提出一种基于对抗性双通道编码器的入侵检测算法。分别采用正常流量和攻击流量来训练变分自编码器模型,构建基于自编码器派生流量数据的多通道表示形式的新特征向量,驱动生成对抗网络的生成过程朝向目标类,生成的少数类图像,有效地扩充数据集;通过引入CBAM模块来改进生成器的网络结构,融合通道和空间两个方向的特征,增强模型的特征提取能力;将判别器输出调整为单目标分类并加入softmax层,输出Fake、Normal和Attack结果,避免生成器生成无法与所需类型匹配的图像而获得奖励,提高生成图片的质量。实验结果表明,该方法能够有效降低误报率以及提高未知攻击的检测精度,尤其在不平衡数据集中具有更多的优势。Aiming at the low detection rate of minority attacks caused by the imbalance of network traffic data,an intrusion detection algorithm based on adversarial dual channel encoder is proposed.Normal and attack traffic are used respectively to train the variational autoencoder model to construct a new feature vector based on a multi-channel representation of the autoencoder-derived traffic data.The generative process of generating the adversarial network is driven to develop towards the target class,a small number of class images is generated,the dataset is effectively extended.The feature extraction capability of the model is enhanced by introducing a CBAM module to improve the network structure of the generator,fusing features in both channel and spatial directions.The discriminator output is adjusted to a single target classification and a softmax layer is added to output Fake,Normal and Attack results to avoid the generator generating images that cannot be rewarded for matching the desired type and to improve the quality of the generated images.The experimental results show that the proposed method can effectively reduce the false alarm rate and can improve the detection accuracy of unknown attacks,can have more superiorities especially in unbalanced data sets.

关 键 词：入侵检测算法 辅助生成对抗网络 自编码器 注意力机制 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]