Improving Attack Detection Performance in NIDS Using GAN

Dongyang Li, Daisuke Kotani, Yasuo Okabe

202026 citationsDOI

Abstract

Nowadays, various methods are proposed to build effective anomaly-based Network Intrusion Detection System (NIDS). However, malicious packets are extremely less than normal packets and this class imbalance problem will result in low performance of attack detection. In this study, we have proposed a new hybrid oversampling model using GAN to improve attack detection performance in anomaly-based NIDS. It contains three main steps: feature extraction by Information Gain and PCA, data clustering by DBSCAN and data generation by WGAN-DIV. For performance evaluation, three HTTP only datasets: NSL-KDD-HTTP, UNSW-NB15-HTTP and Kyoto2006-Plus-HTTP are used. Six machine learning methods are utilized as anomaly-based NIDS and SMOTE is also used for comparison. Our model with XGBoost has achieved best F1-score in these three datasets from the results.

Topics & Concepts

Computer scienceIntrusion detection systemNetwork packetDBSCANOversamplingAnomaly detectionCluster analysisData miningFeature extractionMisuse detectionFeature (linguistics)Anomaly (physics)Artificial intelligencePattern recognition (psychology)Anomaly-based intrusion detection systemComputer networkPhysicsCondensed matter physicsBandwidth (computing)LinguisticsPhilosophyCorrelation clusteringCanopy clustering algorithmNetwork Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingAdvanced Malware Detection Techniques