融合过-欠采样与GAN的网络入侵检测方法  

Network Intrusion Detection Method Combining Over-undersampling with GAN

作　　者：王秀玉 吴晓鸰 冯永晋[1] WANG Xiuyu;WU Xiaoling;FENG Yongjin(School of computing,Guangdong University of Technology,Guangzhou 510006,China)

机构地区：[1]广东工业大学计算机学院,广州510006

出　　处：《小型微型计算机系统》2025年第2期449-455,共7页Journal of Chinese Computer Systems

基　　金：广东省重点领域研发计划项目(2019B010139002)资助;广东省国际科技合作领域项目(2019A050513010)资助。

摘　　要：随着互联网技术的发展,网络数据流量每秒激增,伴随而来更多的安全问题.针对网络入侵数据集类不平衡和数据维度高导致的分类不准确问题,本文提出一种融合过-欠采样和GAN的网络入侵检测方法.采用随机欠采样减少多数类样本数量,以避免欠拟合问题.同时,通过合成少数类过采样技术合成少数类样本,以降低类不平衡所带来的影响.此外,结合GAN使合成样本更接近真实样本,以解决SMOTE中新合成样本缺乏合理性的问题.最后,集成自编码器,通过降低数据集的维度来减少内存占用,并加速分类模型的训练.在CICIDS2017数据集上进行对比实验,结果表明本文提出的融合过-欠采样和GAN的网络入侵检测方法性能优于其他方法.With the development of Internet technology,the increase of the network data flow per second has led to more security issues.To address the problems of imbalanced network intrusion dataset and high-dimensional data affecting classification accuracy,this paper proposes a network intrusion detection method combining over-undersampling with Generative Adversarial Network(GAN).It adopts random undersampling to reduce the number of samples in the majority class,in order to avoid underfitting issues.At the same time,Synthetic Minority Oversampling Technique(SMOTE)is used to generate additional samples in the minority class,in order to mitigate the impact of class imbalance.In addition,GAN is employed to make the synthetic samples more similar to real samples,addressing the issue of lack of authenticity in the new synthetic samples in SMOTE.Lastly,autoencoders are integrated to reduce memory usage and accelerate training of classification models by reducing the dimensionality of the dataset.The comparative experiments conducted on the CICIDS2017 dataset show that the proposed network intrusion detection method combining over-under sampling with GAN outperforms other methods in terms of performance.

关 键 词：网络入侵检测 生成对抗网络 SMOTE 自编码器 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]