Unbalanced network attack traffic detection based on feature extraction and GFDA-WGAN

• Published in: Computer networks (Amsterdam, Netherlands : 1999) Netherlands : 1999), 2022-10, Vol.216, p.109283, Article 109283
• Main Authors: Li, Kehong, Ma, Wengang, Duan, Huawei, Xie, Han, Zhu, Juanxiu, Liu, Ruiqi
• Format: Article
• Language: English
• Subjects: Computer networks; Domain adaptation; Dynamic chaotic cross-optimization; Feature extraction; Generative adversarial networks; GFDA-WGAN; Machine learning; Neural networks; Optimization; Security; Supervised learning; Unbalance; Unbalanced traffic
• ISSN: 1389-1286; 1872-7069
• DOI: 10.1016/j.comnet.2022.109283

Detecting various types of attack traffic is critical to computer network security. The current detection methods require massive amounts of data to detect attack traffic. However, in most cases, the attack traffic samples are unbalanced. A typical neural network model cannot detect such unbalanced attack traffic. Additionally, malicious network noise traffic has a detrimental effect on the detection stability. Very few effective methods exist to detect unbalanced attack traffic. In this paper, we develop a method to detect unbalanced attack traffic. A dynamic chaotic cross-optimized bidirectional residual-gated recurrent unit (DCCSO-Res-BIGRU) and an adaptive Wasserstein generative adversarial network with generated feature domains (GFDA-WGAN) are proposed. First, feature extraction is achieved using the DCCSO-Res-BIGRU. The GFDA-WGAN can then be used to detect the unbalanced attack traffic. We use a conditional WGAN network to generate the pseudo-sample features of the invisible classes. A GFDA strategy for conditional WGAN optimization is also proposed. Furthermore, we use an invisible sample and supervised learning to detect unbalanced attack traffic. Finally, the performance of the proposed method is validated using four network datasets. According to the experimental results, the proposed method significantly improves sample convergence and generation. It has a higher detection accuracy with respect to detecting unbalanced attack traffic. Furthermore, it provides the most powerful and effective visual classification. When noise is added, it outperforms all other conventionally used methods. Real-time traffic detection is also possible using this method.