| 陈万志,尹明悦,王天元.基于生成对抗网络的流量异常检测方法[J].电子测量与仪器学报,2025,39(10):165-175 |
| 基于生成对抗网络的流量异常检测方法 |
| Traffic anomaly detection method based on generative adversarial networks |
| |
| DOI： |
| 中文关键词: 流量异常检测 异常点检测 生成对抗网络 降噪自编码器 卷积神经网络 双向门控循环神经网络单元 |
| 英文关键词:traffic anomaly detection outlier detection generative adversarial network denoising autoencoder CNN BiGRU |
| 基金项目:国家重点研发计划（2018YFB1403303）、辽宁省教育厅高校科研基金（2021LJKZ0327）项目资助 |
|
|
|
|
| 摘要点击次数: 621 |
| 全文下载次数: 415 |
| 中文摘要: |
| 针对流量异常检测模型因噪声和离群点干扰导致鲁棒性下降、特征表达能力不足，以及在处理不平衡高维海量数据时少数类检测率偏低等问题，提出一种基于生成对抗网络的流量异常检测方法。首先，采用基于聚类的SCiForest算法检测异常点，减少其对后续网络的影响。其次，设计以降噪自编码器为核心组件的生成对抗网络(denoising autoencoder-based generative adversarial network, DGAN)，基于重建误差分布之间的Wasserstein距离定义其训练目标，生成可信的合成少数类样本，从而有效缓解数据不平衡问题。再次，通过与判别器一致的降噪自编码器(denoising autoencoder, DAE)，输入真实样本与合成样本进行重构训练，得到优化后的编码器部分作为特征提取与降维模块，以增强特征的表达能力。最后，将处理后的数据输入融合卷积神经网络和双向门控循环单元的特征模型(feature fusion model of CNN and BiGRU, CNN-BiGRU-FFusion)，在充分捕捉空间特征和时序特征的基础上实现分类与检测。在NSL-KDD数据集上的准确率和F1分数分别达到92.06%和92.25%，验证了所提方法在网络流量异常检测任务中的优越性能，并通过CICIDS2017数据集的实验进一步验证其可行性。 |
| 英文摘要: |
| In response to the problems of decreased robustness and insufficient feature expression ability caused by noise and outlier interference in traffic anomaly detection models, and low minority class detection rates when dealing with imbalanced high-dimensional massive data, a traffic anomaly detection method based on generative adversarial networks was proposed. Firstly, the clustering based on SCiForest algorithm is used to detect outliers and reduce their impact on the subsequent training of the generative adversarial network. Secondly, a denoising autoencoder-based generative adversarial network (DGAN) is designed to generate reliable synthetic minority class samples. The network defines its training target based on the Wasserstein distance between reconstructed error distributions, effectively alleviating the problem of data imbalance. Again, using a denoising autoencoder (DAE) with the same architecture as the generative adversarial network discriminator, real and synthetic samples are input for reconstruction training, and the optimized encoder part is extracted as the feature extraction and dimensionality reduction module to enhance feature expression ability. Finally, the processed data is input into the feature fusion model of CNN and BiGRU (CNN-BiGRU-FFusion) model, which completes classification and detection based on capturing spatial and temporal features. The accuracy and F1 score on the NSL-KDD dataset reached 92.06% and 92.25%, respectively, verifying the superior performance of the proposed method in network traffic anomaly detection tasks. The feasibility of the method was further validated through experiments on the CICIDS2017 dataset. |
| 查看全文 查看/发表评论 下载PDF阅读器 |
|
|
|
