BiGAN Abnormal Flow Detection Using Dimensionality Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing defense and detection systems for network communication security struggle to effectively detect abnormal flows due to limited and insufficiently diverse samples of abnormal flow data, making it difficult to recognize and respond to attacks like SPAM, click fraud, and zombie virus infections.
Innovation Solution
An abnormal flow detection mechanism that uses a bidirectional generative adversarial network (BiGAN) trained with key features selected through a dimensionality reduction algorithm to analyze outgoing and incoming packets, enhancing the ability to identify abnormal flows by increasing sample diversity and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based or machine learning technologies are used to detect abnormal flows, then the detection system can identify known attack patterns, but the detection effectiveness is limited due to insufficient and limited abnormal flow samples
Solution Approach 1:
The patent uses Generative Adversarial Networks (GANs) to generate synthetic abnormal flow samples that copy the characteristics of real abnormal flows. The generator creates artificial attack samples based on learned patterns from limited real samples, while the discriminator evaluates their authenticity. This copying approach multiplies the available training data without requiring additional real attack samples.
Solution Approach 2:
The patent transforms the limited real abnormal flow samples into diverse training data by applying parameter changes through GAN training. The generator modifies sample parameters (traffic patterns, packet sizes, timing intervals) to create variations of original samples, effectively expanding the sample space while maintaining the essential characteristics of abnormal flows.
2Measurement precision
If more abnormal flow samples are collected to improve detection accuracy, then the diversity of detection scenarios increases, but the collection difficulty and time consumption increase significantly
Solution Approach 1:
The patent performs preliminary action by pre-generating diverse abnormal flow samples using GANs before actual detection deployment. The system预先 trains the GAN model with available samples to create a comprehensive library of synthetic abnormal flows covering various attack scenarios, so that when deployment occurs, no additional sample collection is needed.
Solution Approach 2:
Instead of collecting diverse samples in real-time, the system copies and transforms existing samples through GAN generation to create a comprehensive training dataset that covers multiple attack scenarios, eliminating the time-consuming sample collection process.
3Productivity
If traditional machine learning models are used with limited samples, then the model training is faster and simpler, but the model cannot generalize well to unseen attack patterns
Solution Approach 1:
The patent applies parameter changes by using GANs to generate samples with varied parameters (different attack types, traffic volumes, timing patterns) from limited real samples. This creates a diverse training dataset that teaches the model to recognize various attack patterns, improving generalization while maintaining training efficiency through synthetic data generation.
Solution Approach 2:
The patent adds another dimension to the training data by generating synthetic samples that expand the feature space. The GANs create samples with varied characteristics beyond the original limited set, effectively adding dimensional diversity to the training dataset without requiring additional real-world data collection.
Data Source
AI summary
An abnormal flow detection device and an abnormal flow detection method thereof are provided. The abnormal flow detection device analyses a plurality of packets captured during a time interval to obtain a plurality of flow features of each packet and selects at least one key flow feature from the flow features based on a dimensionality reduction algorithm. The abnormal flow detection device trains a bidirectional generative adversarial network (BiGAN) by taking the at least one key flow feature of each packet as an input of the BiGAN to build a flow recognition model for detecting abnormal flows.