A Hybrid Intrusion Detection Framework for Imbalanced AMI Traffic Using GAN-Based Data Augmentation and Lightweight CNN

Abstract

With the widespread deployment of the Advanced Metering Infrastructure (AMI) in Power Industrial Control Systems (PICS), a significant and inherent property of network traffic data is its pronounced class imbalance. The continuous emergence of new types of cyberattacks significantly limits the detection accuracy of Intrusion Detection Systems (IDS). To overcome the limitations of traditional methods—particularly their poor adaptability in complex conditions and vulnerability to emerging threats—this paper introduces a novel hybrid intrusion detection framework. This framework synergistically combines data augmentation and a discriminative classification model for improved performance. Within this framework, a Multi-feature Constrained Conditional Generative Adversarial Network (MC-CGAN) is proposed. Its multi-feature constraint module (MC) preserves protocol-related invariant features, while the CGAN is responsible for conditionally generating the remaining continuous features based on class labels. By preserving the core semantic information of samples, this method reduces the risk of generating unrealistic data and decreases computational overhead. Furthermore, we develop ADS-Net, a lightweight Convolutional Neural Network that not only replaces traditional convolutions with depth-wise separable ones for efficiency, but also incorporates an attention mechanism to adaptively weight feature channels, thus improving discriminative focus. Extensive experiments demonstrate that, under conditions of extreme data imbalance, the proposed hybrid framework can generate industrially valid synthetic data while achieving accurate intrusion detection with an accuracy of 98.35%.