NADS-RA: Network Anomaly Detection Scheme Based on Feature Representation and Data Augmentation

Abstract

Network anomaly detection aims to identify network anomalies, and it has obtained many achievements using the supervised classification technique. Since the supervised classifier depends on the prior data, it is difficult to accurately classify the rare anomalies when they account less in the training set. Data augmentation can tackle the imbalanced training set problem through creating artificial rare anomaly samples. However, the existing data augmentation methods either ignore the data distribution or ignore the spatial knowledge between features. Therefore, this article addresses this issue by proposing a Network Anomaly Detection Scheme based on feature Representation and data Augmentation (NADS-RA). Re-circulation Pixel Permutation strategy is first designed as feature representation strategy to construct images, and it rotates each feature left by the times of feature number to maintain the spatial knowledge between original network traffic features. An image-based augmentation strategy is thus designed to produce augmented images according to the distribution characteristics of rare network anomaly images with the help of Least Squares Generative Adversarial Network, which alleviates the effect of imbalanced training set and avoids over-fitting. After that, NADS-RA is implemented on the Convolutional Neural Network classification model. We conduct experiments on five public benchmark datasets, including NSL-KDD and UNSW-NB15, and so on, and compare against 12 detection methods and 17 data generation methods. The experimental results demonstrate the superior effectiveness of our work to state-of-the-art methods and the general applicability in different scenarios.