Pre-trained language model-enhanced conditional generative adversarial networks for intrusion detection

Peer-to-Peer Networking and Applications - Tập 17 - Trang 227-245 - 2023
Fang Li1, Hang Shen1, Jieai Mai1, Tianjing Wang1, Yuanfei Dai1, Xiaodong Miao2
1College of Computer and Information Engineering (College of Artificial Intelligence), Nanjing Tech University, Nanjing, China
2School of Mechanical and Power Engineering, Nanjing Tech University, Nanjing, China

Tóm tắt

As cyber threats continue to evolve, ensuring network security has become increasingly critical. Deep learning-based intrusion detection systems (IDS) are crucial for addressing this issue. However, imbalanced training data and limited feature extraction weaken classification performance for intrusion detection. This paper presents a conditional generative adversarial network (CGAN) enhanced by Bidirectional Encoder Representations from Transformers (BERT), a pre-trained language model, for multi-class intrusion detection. This approach augments minority attack data through CGAN to mitigate class imbalance. BERT with robust feature extraction is embedded into the CGAN discriminator to enhance input–output dependency and improve detection through adversarial training. Experiments show the proposed model outperforms baselines on CSE-CIC-IDS2018, NF-ToN-IoT-V2, and NF-UNSW-NB15-v2 datasets, achieving F1-scores of 98.230%, 98.799%, and 89.007%, respectively, and improving F1-scores over baselines by 1.218% $$-$$ 13.844% 0.215% $$-$$ 13.779%, and 2.056% $$-$$ 22.587%.

Tài liệu tham khảo

Chou D, Jiang M (2021) A Survey on Data-driven Network Intrusion Detection. ACM Comput Surv (CSUR) 54(9):1–36 Kilincer IF, Ertam F, Sengur A (2021) Machine learning methods for cyber security intrusion detection: Datasets and comparative study. Comput Netw 188:107840 Gamage S, Samarabandu J (2020) Deep learning methods in network intrusion detection: A survey and an objective comparison. J Netw Comput Appl 169:102767 Mummadi A, Yadav BMK, Sadhwika R, Shitharth S (2021) An appraisal of cyber-attacks and countermeasures using machine learning algorithms. In International Conference on Artificial Intelligence and Data Science, pages 27–40 Wang H, Gu J, Wang S (2017) An effective intrusion detection framework based on SVM with feature augmentation. Knowl-Based Syst 136:130–139 Koc L, Mazzuchi TA, Sarkani S (2012) A network intrusion detection system based on a Hidden Naïve Bayes multiclass classifier. Expert Syst Appl 39(18):13492–13500 Chawla NV, Bowyer KW, Hall LO, Kegelmeyer WP (2002) SMOTE: Synthetic Minority Over-sampling Technique. J Artif Intell Res 16:321–357 Jia H, Liu J, Zhang M, He X, Sun W (2021) Network intrusion detection based on IE-DBN model. Comput Commun 178:131–140 Wu T, Fan H, Zhu H, You C, Zhou H (2022) Huang X (2022) Intrusion detection system combined enhanced random forest with smote algorithm. EURASIP J Adv Signal Process 1:1–20 Mikhail JW, Fossaceca JM, Iammartino R (2019) A semi-boosted nested model with sensitivity-based weighted binarization for multi-domain network intrusion detection. ACM Trans Intell Syst Technol (TIST) 10(3):1–27 Goodfellow I, Pouget-Abadie J, Mirza M, Xu B, Warde-Farley D, Ozair S, Courville A, Bengio Y (2014) Generative adversarial nets. Adv Neural Inf Proces Syst 27 Lee J, Park K (2021) GAN-based imbalanced data intrusion detection system. Pers Ubiquit Comput 25(1):121–128 Lin Z, Shi Y, Xue Z (2022) IDSGAN: Generative adversarial networks for attack generation against intrusion detection. In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 79–91 Ding H, Chen L, Dong L, Fu Z, Cui X (2022) Imbalanced data classification: A KNN and generative adversarial networks-based hybrid approach for intrusion detection. Futur Gener Comput Syst 131:240–254 He X, Chen Q, Tang L, Wang W, Liu T (2022) Cgan-based collaborative intrusion detection for uav networks: A blockchain-empowered distributed federated learning approach. IEEE Internet Things J 10(1):120–132 Hochreiter S, Schmidhuber J (1997) Long Short-Term Memory. Neural Comput 9(8):1735–1780 Lin SZ, Shi Y, Xue Z (2018) Character-level intrusion detection based on convolutional neural networks. In International Joint Conference on Neural Networks (IJCNN), pages 1–8 Aydın H, Orman Z, Aydın MA (2022) A long short-term memory (LSTM)-based distributed denial of service (DDoS) detection and defense system design in public cloud network environment. Comput Secur 118:102725 Huang Z, Xu W, Yu K (2015) Bidirectional LSTM-CRF Models for Sequence Tagging. arXiv preprint arXiv:1508.01991 Roy B, Cheung H (2018) A deep learning approach for intrusion detection in internet of things using bi-directional long short-term memory recurrent neural network. In International Telecommunication Networks and Applications Conference (ITNAC), pages 1–6 Kim J, Kim J, Thu HLT, Kim H (2016) Long short term memory recurrent neural network classifier for intrusion detection. In International Conference on Platform Technology and Service (PlatCon), pages 1–5 Althubiti SA, Jones EM, Roy K (2018) LSTM for Anomaly-Based Network Intrusion Detection. In International Telecommunication Networks and Applications Conference (ITNAC), pages 1–3 Imrana Y, Xiang Y, Ali L, Abdul-Rauf Z (2021) A bidirectional LSTM deep learning approach for intrusion detection. Expert Syst Appl 185:115524 Shitharth S, Satheesh N, Kumar BP, Sangeetha K (2021) IDS detection based on optimization based on WI-CS and GNN algorithm in SCADA network. Architectural Wireless Networks Solutions and Security Issues 247–265 Ling C, Zhao X, Lu J, Deng C, Zheng C, Wang J, Chowdhury T, Li Y, Cui H, Zhao T et al (2023) Beyond one-model-fits-all: A survey of domain specialization for large language models. arXiv preprint arXiv:2305.18703 Devlin J, Chang MW, Lee K, Toutanova K (2018) BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. arXiv preprint arXiv:1810.04805 Yin J, Tang MJ, Cao Jinli, Wang Hua (2020) Apply transfer learning to cybersecurity: Predicting exploitability of vulnerabilities by description. Knowl-Based Syst 210:106529 Lee Y, Kim J, Kang P (2021) LAnoBERT: System log anomaly detection based on bert masked language model. arXiv preprint arXiv:2111.09564 Alkhatib N, Mushtaq M, Ghauch H, Danger JL (2022) CAN-BERT do it? controller area network intrusion detection system based on bert language model. In IEEE/ACS 19th International Conference on Computer Systems and Applications (AICCSA), pages 1–8 Mirza M, Osindero S (2014) Conditional generative adversarial nets. arXiv preprint arXiv:1411.1784 Douzas G, Bacao F (2018) Effective data generation for imbalanced learning using conditional generative adversarial networks. Expert Syst Appl 91:464–471 Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser Ł, Polosukhin I (2017) Attention is all you need. Adv Neural Inf Process Syst 30 Kingma DP, Ba J (2014) Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 Salem M, Taheri S, Yuan JS (2018) Anomaly Generation Using Generative Adversarial Networks in Host-Based Intrusion Detection. In IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), pages 683–687