«上一篇/Previous Article|本期目录/Table of Contents|下一篇/Next Article»

《计算机技术与发展》[ISSN:1006-6977/CN:61-1281/TN]

卷:

期数:

2025年05期

页码:

67-75

栏目:

网络空间安全

出版日期:

2025-05-10

文章信息/Info

Title:

Intrusion Detection Method Based on Improved GAN and DL Fusion

文章编号:

1673-629X(2025)05-0067-09

作者:

李柄军; 陈帅良; 段晓英; 康凯*

宁夏师范大学 数学与计算机科学学院,宁夏 固原 756099

Author(s):

LI Bing-jun; CHEN Shuai-liang; DUAN Xiao-ying; KANG Kai*

School of Mathematics and Computer Science,Ningxia Normal University,Guyuan 756099,China

关键词:

深度学习; 入侵检测; 生成对抗网络; 卷积神经网络; 双向长短期记忆网络; 全连接网络

Keywords:

deep learning; intrusion detection; generative adversarial networks; convolutional neural network; bidirectional long short - term memory network; fully connected network

分类号:

TP393

DOI:

10.20165/j.cnki.ISSN1673-629X.2024.0409

摘要:

在基于深度学习的入侵检测系统中,数据不平衡问题显著影响模型的准确性,导致其在识别少数类攻击样本时表现不佳。 为了解决这一问题,该文提出了一种改进的生成对抗网络(GAN)、卷积神经网络(CNN)和双向长短期记忆网络(Bi-LSTM)融合的 IGAN-CLSTM 方法。 具体而言,首先通过优化的 GAN 方法增强异常(攻击)样本的数量,从而平衡数据分布,提升模型的泛化能力;接着,结合 CNN 在空间特征提取和 Bi-LSTM 在序列数据处理方面的优势,进行复杂攻击模式的深度特征学习与时序建模,显著提高了模型的识别能力;最后,通过全连接网络(FCN)进行分类。 为验证该方法的有效性,在 UNSW-NB15 和 CSE-CIC-IDS2018 两个大规模数据集上进行了消融实验,结果表明,在保持相同深度学习模型参数和规模的前提下,该方法在准确率、精确度等多个评估指标上均优于其它模型,尤其在多分类任务中的少数类上有了显著提升,展示了其在实时入侵检测中的潜力和应用价值,也为未来网络安全领域的进一步探索提供了有力的支持和参考。

Abstract:

In deep learning-based intrusion detection systems,the issue of data imbalance significantly affects the accuracy of models, leading to poor performance in recognizing minority class attack samples. To address this issue,an improved method called IGAN - CLSTM, which integrates an optimized Generative Adversarial Network ( GAN ), Convolutional Neural Network ( CNN ), and Bidirectional Long Short-Term Memory Network (Bi-LSTM),is proposed. Specifically,an optimized GAN approach is first utilized to enhance the quantity of anomalous ( attack) samples,thereby balancing the data distribution and improving the model’s generalization ability. Subsequently,the advantages of CNN in spatial feature extraction and Bi-LSTM in sequential data processing are combined to fa-cilitate deep feature learning and temporal modeling of complex attack patterns, significantly enhancing the model ’ s recognition capability. Finally,classification is performed using a Fully Connected Network ( FCN). To validate the effectiveness of the proposed method,ablation experiments are conducted on two large-scale datasets,UNSW-NB15 and CSE-CIC-IDS2018. The results indicate that while maintaining the same parameters and scale of the deep learning model,the proposed method outperforms other models across multiple evaluation metrics, particularly demonstrating a significant improvement in precision for minority classes in multi - class classification tasks. This showcases its potential and practical value for real-time intrusion detection and provides strong support and reference for further exploration in the field of cybersecurity.

常用功能

更新日期/Last Update: 2025-05-10