Research On Network Traffic Anomaly Detection Method Based On Generative Adversarial Network

As the Internet is rapidly developing,Internet users have been brought more convenience to.At the meanwhile time,network attacks have followed by,among which the proliferation of network attacks poses a great threat to Internet security.With the aim to maintain the security of the Internet and detect network traffic anomalies in a timely manner,anomaly detection has become one of the main challenges.It is obvious that an imbalance exists in the ratio between the number of attack traffic samples and the number of normal network traffic samples in the current network traffic anomaly detection task,making the trained model less effective in detection,which leads to the problem of low detection accuracy for a few classes of traffic samples.Addressing aforementioned problem is an effective approach to improve the learning effect of the classification model,thus improving the detection accuracy of minority class traffic samples.As a result,the data-level research has gradually won the attention of scholars,and how to improve the efficiency of data utilisation and achieve a diverse representation of features has become a heating topic,which includes sample enhancement methods for constructing diverse data using initial data.With the widespread use of Generative Adversarial Networks(GAN)in data generation in various fields,GAN’s outstanding effect,powerful generation capability and the characteristic of generating based on the overall data distribution fit well with the generation of attack traffic in network traffic,which is important for solving the sample imbalance problem and improving the accuracy of minority class.This is of great significance in solving the sample imbalance problem and improving the accuracy of network attack detection.According to the above evidents,the research is conducting as follows:(1)A network traffic anomaly detection method based on Wasserstein Condition Generative Adversarial Networks(WCGAN)is investigated.Based on the initial network traffic dataset,the WCGAN is used to learn the data distribution of the initial dataset and generate the required network traffic data to achieve the expansion of a few classes,so as to solve the data imbalance problem.Firstly,to address the problem that the original probability distribution discrepancy algorithm in CGAN has difficulty in measuring data with non-overlapping distributions,leading to pattern collapse,it is proposed to redesign the loss function using Wasserstein distance to provide effective gradient information for model training.Then,to cope with the unstable model training issue,Lipschitz constraint using spectral normalization is proffered to improve the stability of model operation.Finally,the initial dataset and the balanced dataset are tested for classification on a Convolutional Neural network(CNN)using the publicly available dataset UNSW-NB15 and CIC-IDS2017.The experiments show that compared with existing methods,the presented method in this paper,which can be better applied to the unbalanced dataset,can effectively improve the detection accuracy of minority classes.(2)Aiming to deal with the phenomenon that WCGAN is not sufficient for initial data feature extraction and still has unstable operation,a Wasserstein Deep Convolution GAN(WEDCGAN)based on the ECA attention mechanism is introduced for network traffic anomaly detection.Similarly,WEDCGAN generates network traffic data by incorporating an ECA focus mechanism to improve improve the generator’s ability to extract data features and refine the quality of the generated data;Next,the Lipschitz constraint on the discriminator is combined with gradient normalization to further improve the stability of the model operation.Lastly,experiments are conducted on CNN using publicly available datasets.The experimental results show that the quality of the generated data is significantly enhanced compared to WCGAN,and the gradient normalization also makes the operation of the model more stable and the detection accuracy of a few classes is also effectively ameliorated.