基于空间特征和生成对抗网络的网络入侵检测  

Network Intrusion Detection Based on Spatial Features and GenerativeAdversarial Networks

作　　者：张震[1] 周一成 田鸿朋 ZHANG Zhen;ZHOU Yicheng;TIAN Hongpeng(School of Electrical and Information Engineering,Zhengzhou University,Zhengzhou 450001,China;Henan Institute of Advanced Technology,Zhengzhou University,Zhengzhou 450001,China)

机构地区：[1]郑州大学电气与信息工程学院,河南郑州450001 [2]郑州大学河南先进技术研究院,河南郑州450001

出　　处：《郑州大学学报（工学版）》2024年第6期40-47,共8页Journal of Zhengzhou University（Engineering Science）

基　　金：河南省重大公益专项(201300311200)。

摘　　要：针对现有的入侵检测方法未能有效考虑到数据特征之间的关联性以及在高维离散的数据集上检测精度不高等问题,提出了一种基于空间特征与生成对抗网络的网络入侵检测方法MBGAN。首先,设计了一种将数据转换成灰度图的转换方法,使得卷积核能够捕获到图像中更多的上下文空间信息流。其次,采用双向生成对抗网络模型进行异常检测,使用转换后的流量图像对模型进行训练,同时引入最小Wasserstein距离和梯度惩罚技术,解决模型训练中模式崩塌和不稳定问题。实验结果表明:所提方法在NSL-KDD、UNSW-NB15、CICIDIS2017数据集上的检测精度分别为97.4%,92.3%,94.8%,召回率分别为97.2%,93.1%,95.6%,F 1值分别为97.3%,93.0%,95.2%,效果均优于其他方法。Address issues such as the inadequate consideration of inter-feature correlations in existing intrusion detection methods and the need for improved detection accuracy on high-dimensional discrete datasets,a network intrusion detection method MBGAN based on spatial features and generative adversarial networks was proposed.Initially,a transformation approach was devised to convert one-dimensional data into two-dimensional grayscale images,enabling convolutional kernels to capture richer contextual information.Subsequently,a bidirectional generative adversarial network model was employed for anomaly detection.The model was trained using network traffic images,incorporating the minimum Wasserstein distance and gradient penalty techniques to mitigate mode collapse and instability during generative adversarial network training.Experimental verification showed that the detection accuracy of the proposed method on the NSL-KDD,UNSW-NB15 and CICIDIS2017 datasets was 97.4%,92.3%and 94.8%,the recall rates were 97.2%,93.1%and 95.6%,and the F 1 were 97.3%,93.0%and 95.2%,respectively,which were better than those of other methods.

关 键 词：入侵检测 异常检测 生成对抗网络 图像编码 卷积神经网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]