Intrusion Detection Method Based on Memory Module and Filtered Generative Adversarial Network
To solve the low accuracy of existing network intrusion detection methods as well as their susceptibility to overfitting when abnormal samples are limited,an intrusion detection method based on a memory module and filtered Generative Adversarial Network(GAN)MemFGAN is proposed.In a GAN,the generator adopts an encoder-decoder structure and introduces a memory module to learn the feature vectors of normal samples to enhance memory.The generator encodes the input and uses it as a query request in the memory module.The most relevant items in the query are reconstructed and the reconstruction error of the generator is used as the anomaly score for intrusion detection.A filter is added before the discriminator to filter out abnormal samples,whereas the discriminator loss is used to improve the generator's ability to generate normal samples and reduce its abnormal score.In addition,new training objectives are designed for the generator and discriminator to supervise the generator using known anomalies and to diminish the generator's ability in reconstructing abnormal samples such that its anomaly score is higher,thereby improving the intrusion detection accuracy of the model and alleviating overfitting.Experimental results on four intrusion detection datasets,i.e.,MAWILab,ISCX2012,IDS2017,and IDS2018,show that compared with the baseline method,the MemFGAN improves the Fl value by an average of 0.147,offers better accuracy and generalization in intrusion detection,and maintains good detection capabilities when abnormal samples are limited.
万方数据
维普
