Payload-based Anomaly Detection for Industrial Internet Using Encoder Assisted GAN
Peng Zhou · 2020
Payload-based anomaly detection has been proved effective in discovering Internet misbehavior and potential intrusions, but highly relies on the unstructured feature engineering to generalize the distribution of normal payloads. This kind of generalization may not adapt well to the emerging industrial Internet, where the normal behaviors are more diverse and usually embedded in the raw payloads' local structures. In this paper, we tackle this generalization problem and propose a very different solution to payload-based anomaly detection without the need of feature engineering. Our basic idea is to learn the raw structures of normal payloads directly by a generative adversarial network (GAN), in which we have a generator (i.e., a reversed convolutional decoder) to sample raw payloads from a latent space as well as a discriminator (i.e., a convolutional classifier) to guide the generator produce raw payloads approximating the normal structures. We also deploy an assisted convolutional encoder to map the true payloads back to the latent space and combine with the GAN's decoder (i.e., generator) to reconstruct the payload structures. We consider anomalies appear in condition the re-constructed payloads are largely deviated from the true ones, since our encoder-decoder architecture is trained able to rebuild only the normal payload structures. We have evaluated our solution using extensive experiments on real-world industrial Internet datasets, and confirmed its effectiveness in detecting industrial Internet anomalies in the raw payloads.