January 2024 | Zeyi LI1, Pan WANG2, and Zixuan WANG3
FlowGANAnomaly is a novel anomaly detection model designed for network intrusion detection systems (NIDS) that leverages generative adversarial networks (GANs). Unlike traditional GAN-based approaches, FlowGANAnomaly uses a generator (G) and a discriminator (D) to map different types of traffic feature data from separate datasets to a uniform feature space, enhancing the accuracy of capturing normal network traffic data. The model integrates multiple loss functions to improve the performance of the GAN, and it calculates anomaly scores by combining the deviation between the outputs of two convolutional encoders in G with the output of D. This method addresses the issue of high dependence on data labeling and low recall rates in anomaly detection. Experiments on four public datasets (NSL-KDD, CIC-IDS2017, CIC-DDoS2019, and UNSW-NB15) demonstrate that FlowGANAnomaly significantly improves the performance of anomaly-based NIDS compared to existing machine learning algorithms and deep learning methods (AutoEncoder and VAE). The paper also introduces an improved threshold selection algorithm and applies the ATON algorithm to enhance the interpretability of the model.FlowGANAnomaly is a novel anomaly detection model designed for network intrusion detection systems (NIDS) that leverages generative adversarial networks (GANs). Unlike traditional GAN-based approaches, FlowGANAnomaly uses a generator (G) and a discriminator (D) to map different types of traffic feature data from separate datasets to a uniform feature space, enhancing the accuracy of capturing normal network traffic data. The model integrates multiple loss functions to improve the performance of the GAN, and it calculates anomaly scores by combining the deviation between the outputs of two convolutional encoders in G with the output of D. This method addresses the issue of high dependence on data labeling and low recall rates in anomaly detection. Experiments on four public datasets (NSL-KDD, CIC-IDS2017, CIC-DDoS2019, and UNSW-NB15) demonstrate that FlowGANAnomaly significantly improves the performance of anomaly-based NIDS compared to existing machine learning algorithms and deep learning methods (AutoEncoder and VAE). The paper also introduces an improved threshold selection algorithm and applies the ATON algorithm to enhance the interpretability of the model.