On the combination of data augmentation method and gated convolution model for building effective and robust intrusion detection

Cybersecurity

article

Wang, Yixiang¹  lv, Shaohua¹  Liu, Jiqiang¹  Chang, Xiaolin¹  Wang, Jinqiang² 

[1] Beijing Key Laboratory of Security and Privacy in Intelligent Transportation, Beijing Jiaotong University;Beijing Key Lab of Traffic Data Analysis and Mining, Beijing Jiaotong University

关键词: Data augmentation;    Intrusion detection system;    Machine learning algorithms;    System call;   

DOI  :  10.1186/s42400-020-00063-5

学科分类：社会科学、人文和艺术（综合）

来源: Springer

【 摘 要 】

Deep learning (DL) has exhibited its exceptional performance in fields like intrusion detection. Various augmentation methods have been proposed to improve data quality and eventually to enhance the performance of DL models. However, the classic augmentation methods cannot be applied to those DL models which exploit the system-call sequences to detect intrusion. Previously, the seq2seq model has been explored to augment system-call sequences. Following this work, we propose a gated convolutional neural network (GCNN) model to thoroughly extract the potential information of augmented sequences. Also, in order to enhance the model’s robustness, we adopt adversarial training to reduce the impact of adversarial examples on the model. Adversarial examples used in adversarial training are generated by the proposed adversarial sequence generation algorithm. The experimental results on different verified models show that GCNN model can better obtain the potential information of the augmented data and achieve the best performance. Furthermore, GCNN with adversarial training can enhance robustness significantly.

【 授权许可】

CC BY