基于生成对抗网络的流量异常检测方法
DOI:
CSTR:
作者:
作者单位:

1.辽宁工程技术大学软件学院葫芦岛125105;2.国网辽宁省电力有限公司营口115005

作者简介:

通讯作者:

中图分类号:

TP393;TN911.7

基金项目:

国家重点研发计划(2018YFB1403303)、辽宁省教育厅高校科研基金(2021LJKZ0327)项目资助


Traffic anomaly detection method based on generative adversarial networks
Author:
Affiliation:

1.College of Software, Liaoning Technical University, Huludao 125105, China; 2.State Grid Yingkou Electric Power Company of Liaoning Electric Power Supply Co.Ltd., Yingkou 115005, China

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    针对流量异常检测模型因噪声和离群点干扰导致鲁棒性下降、特征表达能力不足,以及在处理不平衡高维海量数据时少数类检测率偏低等问题,提出一种基于生成对抗网络的流量异常检测方法。首先,采用基于聚类的SCiForest算法检测异常点,减少其对后续网络的影响。其次,设计以降噪自编码器为核心组件的生成对抗网络(denoising autoencoder-based generative adversarial network, DGAN),基于重建误差分布之间的Wasserstein距离定义其训练目标,生成可信的合成少数类样本,从而有效缓解数据不平衡问题。再次,通过与判别器一致的降噪自编码器(denoising autoencoder, DAE),输入真实样本与合成样本进行重构训练,得到优化后的编码器部分作为特征提取与降维模块,以增强特征的表达能力。最后,将处理后的数据输入融合卷积神经网络和双向门控循环单元的特征模型(feature fusion model of CNN and BiGRU, CNN-BiGRU-FFusion),在充分捕捉空间特征和时序特征的基础上实现分类与检测。在NSL-KDD数据集上的准确率和F1分数分别达到92.06%和92.25%,验证了所提方法在网络流量异常检测任务中的优越性能,并通过CICIDS2017数据集的实验进一步验证其可行性。

    Abstract:

    In response to the problems of decreased robustness and insufficient feature expression ability caused by noise and outlier interference in traffic anomaly detection models, and low minority class detection rates when dealing with imbalanced high-dimensional massive data, a traffic anomaly detection method based on generative adversarial networks was proposed. Firstly, the clustering based on SCiForest algorithm is used to detect outliers and reduce their impact on the subsequent training of the generative adversarial network. Secondly, a denoising autoencoder-based generative adversarial network (DGAN) is designed to generate reliable synthetic minority class samples. The network defines its training target based on the Wasserstein distance between reconstructed error distributions, effectively alleviating the problem of data imbalance. Again, using a denoising autoencoder (DAE) with the same architecture as the generative adversarial network discriminator, real and synthetic samples are input for reconstruction training, and the optimized encoder part is extracted as the feature extraction and dimensionality reduction module to enhance feature expression ability. Finally, the processed data is input into the feature fusion model of CNN and BiGRU (CNN-BiGRU-FFusion) model, which completes classification and detection based on capturing spatial and temporal features. The accuracy and F1 score on the NSL-KDD dataset reached 92.06% and 92.25%, respectively, verifying the superior performance of the proposed method in network traffic anomaly detection tasks. The feasibility of the method was further validated through experiments on the CICIDS2017 dataset.

    参考文献
    相似文献
    引证文献
引用本文

陈万志,尹明悦,王天元.基于生成对抗网络的流量异常检测方法[J].电子测量与仪器学报,2025,39(10):165-175

复制
分享
相关视频

文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:
  • 最后修改日期:
  • 录用日期:
  • 在线发布日期: 2026-01-05
  • 出版日期:
文章二维码
×
《电子测量与仪器学报》
关于防范虚假编辑部邮件的郑重公告