CGSA-RNN: Abnormal Network Traffic Detection Model Based on CycleGAN and Self-Attention Mechanism
Saihua Cai, Wen-Jun Zhao, Hanmei Tang, Jinfu Chen, Wuhao Guo · 2023
Malicious attack is a major factor to endanger the cyberspace security. The accurate detection of abnormal network traffic generated by malicious attacks can effectively detect potential malicious attacks and thus protecting the network security. However, the scale of abnormal network traffic is relatively small (i.e., there is a data imbalance phenomenon), which causes a significant decrease of detection accuracy. The introduction of CycleGAN model can effectively deal with the data imbalance phenomenon, but it suffers from semantic inconsistency, image distortion and lack of diversity. This paper proposes an abnormal network traffic detection model called CGSA-RNN that incorporates CycleGAN, self-attention mechanism and RNN to overcome the disadvantages of CycleGAN model, thereby accurately detecting abnormal network traffic. CGSA-RNN model first takes the advantage of style migration of CycleGAN to perform data augmentation for the small-scale abnormal network traffic, and then replaces the ReLU activation function with LeakyReLU in the CycleGAN generator to reduce the effects of artifacts and distortion in the generated images. In addition, a self-attention mechanism is introduced into the CycleGAN to help it to better capture important features, thereby further improving the data augmentation capability. Finally, CGSA-RNN uses the RNN model to detect abnormal network traffic. Extensive experimental results on two publicly available network traffic datasets show that compared with four advanced detection models based on data augmentation, the average precision, recall and F1-measure of CGSA-RNN model are improved by more than 2%.