Pre-trained language model-enhanced conditional generative adversarial networks for intrusion detection
Tóm tắt
As cyber threats continue to evolve, ensuring network security has become increasingly critical. Deep learning-based intrusion detection systems (IDS) are crucial for addressing this issue. However, imbalanced training data and limited feature extraction weaken classification performance for intrusion detection. This paper presents a conditional generative adversarial network (CGAN) enhanced by Bidirectional Encoder Representations from Transformers (BERT), a pre-trained language model, for multi-class intrusion detection. This approach augments minority attack data through CGAN to mitigate class imbalance. BERT with robust feature extraction is embedded into the CGAN discriminator to enhance input–output dependency and improve detection through adversarial training. Experiments show the proposed model outperforms baselines on CSE-CIC-IDS2018, NF-ToN-IoT-V2, and NF-UNSW-NB15-v2 datasets, achieving F1-scores of 98.230%, 98.799%, and 89.007%, respectively, and improving F1-scores over baselines by 1.218%
$$-$$
13.844% 0.215%
$$-$$
13.779%, and 2.056%
$$-$$
22.587%.
Tài liệu tham khảo
Chou D, Jiang M (2021) A Survey on Data-driven Network Intrusion Detection. ACM Comput Surv (CSUR) 54(9):1–36
Kilincer IF, Ertam F, Sengur A (2021) Machine learning methods for cyber security intrusion detection: Datasets and comparative study. Comput Netw 188:107840
Gamage S, Samarabandu J (2020) Deep learning methods in network intrusion detection: A survey and an objective comparison. J Netw Comput Appl 169:102767
Mummadi A, Yadav BMK, Sadhwika R, Shitharth S (2021) An appraisal of cyber-attacks and countermeasures using machine learning algorithms. In International Conference on Artificial Intelligence and Data Science, pages 27–40
Wang H, Gu J, Wang S (2017) An effective intrusion detection framework based on SVM with feature augmentation. Knowl-Based Syst 136:130–139
Koc L, Mazzuchi TA, Sarkani S (2012) A network intrusion detection system based on a Hidden Naïve Bayes multiclass classifier. Expert Syst Appl 39(18):13492–13500
Chawla NV, Bowyer KW, Hall LO, Kegelmeyer WP (2002) SMOTE: Synthetic Minority Over-sampling Technique. J Artif Intell Res 16:321–357
Jia H, Liu J, Zhang M, He X, Sun W (2021) Network intrusion detection based on IE-DBN model. Comput Commun 178:131–140
Wu T, Fan H, Zhu H, You C, Zhou H (2022) Huang X (2022) Intrusion detection system combined enhanced random forest with smote algorithm. EURASIP J Adv Signal Process 1:1–20
Mikhail JW, Fossaceca JM, Iammartino R (2019) A semi-boosted nested model with sensitivity-based weighted binarization for multi-domain network intrusion detection. ACM Trans Intell Syst Technol (TIST) 10(3):1–27
Goodfellow I, Pouget-Abadie J, Mirza M, Xu B, Warde-Farley D, Ozair S, Courville A, Bengio Y (2014) Generative adversarial nets. Adv Neural Inf Proces Syst 27
Lee J, Park K (2021) GAN-based imbalanced data intrusion detection system. Pers Ubiquit Comput 25(1):121–128
Lin Z, Shi Y, Xue Z (2022) IDSGAN: Generative adversarial networks for attack generation against intrusion detection. In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 79–91
Ding H, Chen L, Dong L, Fu Z, Cui X (2022) Imbalanced data classification: A KNN and generative adversarial networks-based hybrid approach for intrusion detection. Futur Gener Comput Syst 131:240–254
He X, Chen Q, Tang L, Wang W, Liu T (2022) Cgan-based collaborative intrusion detection for uav networks: A blockchain-empowered distributed federated learning approach. IEEE Internet Things J 10(1):120–132
Hochreiter S, Schmidhuber J (1997) Long Short-Term Memory. Neural Comput 9(8):1735–1780
Lin SZ, Shi Y, Xue Z (2018) Character-level intrusion detection based on convolutional neural networks. In International Joint Conference on Neural Networks (IJCNN), pages 1–8
Aydın H, Orman Z, Aydın MA (2022) A long short-term memory (LSTM)-based distributed denial of service (DDoS) detection and defense system design in public cloud network environment. Comput Secur 118:102725
Huang Z, Xu W, Yu K (2015) Bidirectional LSTM-CRF Models for Sequence Tagging. arXiv preprint arXiv:1508.01991
Roy B, Cheung H (2018) A deep learning approach for intrusion detection in internet of things using bi-directional long short-term memory recurrent neural network. In International Telecommunication Networks and Applications Conference (ITNAC), pages 1–6
Kim J, Kim J, Thu HLT, Kim H (2016) Long short term memory recurrent neural network classifier for intrusion detection. In International Conference on Platform Technology and Service (PlatCon), pages 1–5
Althubiti SA, Jones EM, Roy K (2018) LSTM for Anomaly-Based Network Intrusion Detection. In International Telecommunication Networks and Applications Conference (ITNAC), pages 1–3
Imrana Y, Xiang Y, Ali L, Abdul-Rauf Z (2021) A bidirectional LSTM deep learning approach for intrusion detection. Expert Syst Appl 185:115524
Shitharth S, Satheesh N, Kumar BP, Sangeetha K (2021) IDS detection based on optimization based on WI-CS and GNN algorithm in SCADA network. Architectural Wireless Networks Solutions and Security Issues 247–265
Ling C, Zhao X, Lu J, Deng C, Zheng C, Wang J, Chowdhury T, Li Y, Cui H, Zhao T et al (2023) Beyond one-model-fits-all: A survey of domain specialization for large language models. arXiv preprint arXiv:2305.18703
Devlin J, Chang MW, Lee K, Toutanova K (2018) BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. arXiv preprint arXiv:1810.04805
Yin J, Tang MJ, Cao Jinli, Wang Hua (2020) Apply transfer learning to cybersecurity: Predicting exploitability of vulnerabilities by description. Knowl-Based Syst 210:106529
Lee Y, Kim J, Kang P (2021) LAnoBERT: System log anomaly detection based on bert masked language model. arXiv preprint arXiv:2111.09564
Alkhatib N, Mushtaq M, Ghauch H, Danger JL (2022) CAN-BERT do it? controller area network intrusion detection system based on bert language model. In IEEE/ACS 19th International Conference on Computer Systems and Applications (AICCSA), pages 1–8
Mirza M, Osindero S (2014) Conditional generative adversarial nets. arXiv preprint arXiv:1411.1784
Douzas G, Bacao F (2018) Effective data generation for imbalanced learning using conditional generative adversarial networks. Expert Syst Appl 91:464–471
Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser Ł, Polosukhin I (2017) Attention is all you need. Adv Neural Inf Process Syst 30
Kingma DP, Ba J (2014) Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980
Salem M, Taheri S, Yuan JS (2018) Anomaly Generation Using Generative Adversarial Networks in Host-Based Intrusion Detection. In IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), pages 683–687
