Skip to main page content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Access keys NCBI Homepage MyNCBI Homepage Main Content Main Navigation
. 2024 Sep 18;24(18):6035.
doi: 10.3390/s24186035.

VAE-WACGAN: An Improved Data Augmentation Method Based on VAEGAN for Intrusion Detection

Wuxin Tian  1 , Yanping Shen  1 , Na Guo  1 , Jing Yuan  1 , Yanqing Yang  2
Affiliations

VAE-WACGAN: An Improved Data Augmentation Method Based on VAEGAN for Intrusion Detection

Wuxin Tian et al. Sensors (Basel). .

Abstract

To address the class imbalance issue in network intrusion detection, which degrades performance of intrusion detection models, this paper proposes a novel generative model called VAE-WACGAN to generate minority class samples and balance the dataset. This model extends the Variational Autoencoder Generative Adversarial Network (VAEGAN) by integrating key features from the Auxiliary Classifier Generative Adversarial Network (ACGAN) and the Wasserstein Generative Adversarial Network with Gradient Penalty (WGAN-GP). These enhancements significantly improve both the quality of generated samples and the stability of the training process. By utilizing the VAE-WACGAN model to oversample anomalous data, more realistic synthetic anomalies that closely mirror the actual network traffic distribution can be generated. This approach effectively balances the network traffic dataset and enhances the overall performance of the intrusion detection model. Experimental validation was conducted using two widely utilized intrusion detection datasets, UNSW-NB15 and CIC-IDS2017. The results demonstrate that the VAE-WACGAN method effectively enhances the performance metrics of the intrusion detection model. Furthermore, the VAE-WACGAN-based intrusion detection approach surpasses several other advanced methods, underscoring its effectiveness in tackling network security challenges.

Keywords: dataset balancing; deep learning; generative adversarial network; network intrusion detection system (IDS); network security; variational autoencoder.

PubMed Disclaimer

Conflict of interest statement

The authors declare no conflicts of interest.

Figures

Figure 1
Figure 1
Model structure of VAE.
Figure 2
Figure 2
Model structure of GAN.
Figure 3
Figure 3
Model structure of VAE-WACGAN.
Figure 4
Figure 4
Model structure of VAE-WACGAN-IDS.
Figure 5
Figure 5
Features with importance scores exceeding 0.003.
Figure 6
Figure 6
Classification accuracy of MLP for different numbers of features.
Figure 7
Figure 7
VAE-WACGAN loss curves: (a) discriminator loss curve; (b) decoder loss curve; (c) encoder loss curve.
Figure 8
Figure 8
VAE-WACGAN discriminator score variation.
Figure 9
Figure 9
VAEGAN loss curves: (a) discriminator loss curve; (b) decoder loss curve; (c) encoder loss curve.
Figure 10
Figure 10
VAEGAN discriminator score variation.
Figure 11
Figure 11
Performance of different class balancing methods on UNSWNB15: (a) Precision, Recall, F1-Score, G-means, and Accuracy of different class balancing methods on UNSW-NB15; (b) FPR of different class balancing methods on UNSW-NB15.
Figure 12
Figure 12
Performance of different class-balancing methods on CIC-IDS2017: (a) Precision, Recall, F1-Score, G-means, and Accuracy of different class-balancing methods on UNSW-NB15; (b) FPR of different class-balancing methods on CIC-IDS2017.
Figure 13
Figure 13
Visualization of the original and balanced datasets: (a) visualization of the UNSW-NB15 original dataset; (b) visualization of the UNSW-NB15 balanced dataset; (c) visualization of the CIC-IDS2017 original dataset; (d) visualization of the CIC-IDS2017 balanced dataset.
Figure 14
Figure 14
Performance of the VAE-WACGAN method on different classifiers for the UNSW-NB15 dataset. (a) Performance of the VAE-WACGAN method on the RF classifier; (b) Performance of the VAE-WACGAN method on the SVM classifier; (c) Performance of the VAE-WACGAN method on the MLP classifier; (d) Performance of the VAE-WACGAN method on the 1DCNN classifier.
Figure 15
Figure 15
Performance of the VAE-WACGAN method on different classifiers for the CIC-IDS2017 dataset. (a) Performance of the VAE-WACGAN method on the RF classifier; (b) Performance of the VAE-WACGAN method on the SVM classifier; (c) Performance of the VAE-WACGAN method on the MLP classifier; (d) Performance of the VAE-WACGAN method on the 1DCNN classifier.
See this image and copyright information in PMC

References

    1. Thakkar A., Lohiya R. A Review on Machine Learning and Deep Learning Perspectives of IDS for IoT: Recent Updates, Security Issues, and Challenges. Arch. Comput. Methods Eng. 2021;28:3211–3243. doi: 10.1007/s11831-020-09496-0. - DOI
    1. Papamartzivanos D., Gómez Mármol F., Kambourakis G. Dendron: Genetic trees driven rule induction for network intrusion detection systems. Future Gener. Comput. Syst. 2018;79:558–574. doi: 10.1016/j.future.2017.09.056. - DOI
    1. Hasan M.A.M., Nasser M., Pal B., Ahmad S. Support Vector Machine and Random Forest Modeling for Intrusion Detection System (IDS) J. Intell. Learn. Syst. Appl. 2014;06:45–52. doi: 10.4236/jilsa.2014.61005. - DOI
    1. Bedi P., Gupta N., Jindal V. I-SiamIDS: An improved Siam-IDS for handling class imbalance in network-based intrusion detection systems. Appl. Intell. 2021;51:1133–1151. doi: 10.1007/s10489-020-01886-y. - DOI
    1. Larsen A.B.L., Sønderby S.K., Larochelle H., Winther O. Autoencoding beyond pixels using a learned similarity metric; Proceedings of the 33rd International Conference on Machine Learning, Proceedings of Machine Learning Research; New York, NY, USA. 19–24 June 2016; pp. 1558–1566.

LinkOut - more resources