End-to-End Adversarial Learning for Intrusion Detection in Computer Networks

TL;DR

This paper introduces an end-to-end adversarial learning approach using GANs for anomaly-based intrusion detection, effectively modeling normal traffic to detect intrusions without bias from known attack types.

Contribution

Proposes a semi-supervised, GAN-based deep architecture for intrusion detection that improves generalization and detection accuracy by synthesizing anomalous data from normal traffic.

Findings

Outperforms state-of-the-art IDS methods on NSL-KDD dataset

Effectively models normal traffic to detect unseen intrusions

Reduces bias towards known attack types

Abstract

This paper presents a simple yet efficient method for an anomaly-based Intrusion Detection System (IDS). In reality, IDSs can be defined as a one-class classification system, where the normal traffic is the target class. The high diversity of network attacks in addition to the need for generalization, motivate us to propose a semi-supervised method. Inspired by the successes of Generative Adversarial Networks (GANs) for training deep models in semi-unsupervised setting, we have proposed an end-to-end deep architecture for IDS. The proposed architecture is composed of two deep networks, each of which trained by competing with each other to understand the underlying concept of the normal traffic class. The key idea of this paper is to compensate the lack of anomalous traffic by approximately obtain them from normal flows. In this case, our method is not biased towards the available intrusions in the training set leading to more accurate detection. The proposed method has been evaluated on NSL-KDD dataset. The results confirm that our method outperforms the other state-of-the-art approaches.

Tables

Table 1. TABLE I: Data distribution of training and test sets.

	Number of PFs
Class	KDDTrain+	KDDTest+
Normal	67343	9711
Anomaly	—	12833

Table 2. TABLE II: Binary classification performance Comparison.

	$ACC(\%)$	$PR(\%)$	$RE(\%)$	$FS(\%)$
AE [9]	88.28	91.23	87.86	89.51
De-noising AE [9]	88.65	96.48	83.08	89.28
Ours $𝒜\left(X\right)$	91.39	89.94	95.56	92.67

Table 3. TABLE III: Binary Classification Accuracy Comparison. There are two kinds of Supervision for Methods in This table, Supervised (S) and Semi-Supervied (SS).

Method	Supervision		ACC (%)
	S	SS
RNN-IDS [10]			83.28
DCNN [11]			85.00
AE [9]			88.28
Sparse AE and MLP [12]			88.39
Random Tree [13]			88.46
De-noising AE [9]			88.65
LSTM [11]			89.00
Random Tree and NBTree [13]			89.24
Ours $𝒜\left(X\right)$			91.39

Equations

$$\begin{array}{r}\{\begin{array}{ll}\text{Encoder:}& \text{Z = σ(WX+b)}\\ \text{Decoder:}& \text{X′ = σ(W′Z+b′)}\end{array}\end{array}$$

$$\begin{split}\underset{G}{\min}~{}\underset{D}{\max}~{}~{}\Big{(}&\mathbb{E}_{X\sim p_{t}}[\log(D(X))]\\ &+\mathbb{E}_{Z\sim p_{z}}[\log(1-D(G(Z)))]\Big{)}\end{split}$$

$$X\sim p_t⟶X^{\prime }\nsim p_t$$

$$\begin{split}\underset{\mathcal{R}}{\min}~{}\underset{\mathcal{A}}{\max}~{}~{}\Big{(}&\mathbb{E}_{X\sim p_{t}}[\log(\mathcal{A}(X))]\\ &+\mathbb{E}_{X\sim p_{t}}[\log(1-\mathcal{A}(\underbrace{\mathcal{R}(X)}_{X^{\prime}}))]\Big{)}\end{split}$$

$$\begin{array}{r}\text{AD(X) =}\{\begin{array}{ll}\text{Normal (Target Class)}& \text{if A(X) > α,}\\ \text{Anomaly (Outlier)}& \text{Otherwise.}\end{array}\end{array}$$

Full text

I Introduction

The significant Internet expansion and also its rising popularity cause a massive increase in data exchange between different parties. These data most probably include valuable information of people, government, and organizations. Therefore, a reliable defense system is required to prevent misuse of sensitive information and to detect network vulnerabilities and potential threats. Intrusion Detection System (IDS) is a promising solution for providing network security services. Also, it is considered an effective alternative for conventional defense systems such as firewall. Previous researches in this topic, can be divided into two major categories: (1) signature-based, and (2) anomaly-based [1]. Signature-based approach is very effective to detect already known attacks which their patterns are available. However, they are inefficient against unfamiliar and new intrusions. Conversely, the latter approach seems more effective owing to its superior performance against unknown and zero-day network attacks [2].

Generally, supervised methods need to know the specific characteristics of attacks, while their high diversity makes this process expensive and probably impossible [3]. This difficulty makes supervised manner lacks generalization. To overcome such problem, we have proposed a semi-supervised method. In contrary to supervised methods which detection is performed based on the available labeled training data, our method is able to decide about the unseen incoming network Packet Flows (PFs).

In recent years, Deep Neural Networks (DNNs) have achieved state-of-the-art performance in various research fields, especially in computer vision and natural language processing. These outstanding successes motivate us to take advantages of deep learning in IDS. Note that, DNNs such as Convolutional Neural Networks (CNNs), can achieve the remarkable results only if they access to a lot of annotated training samples from all classes. Under the realistic conditions, there are numerous samples from normal class, but the abnormal class is often absent during the training, poorly sampled, or not well defined. In summary, the anomaly detection task refers to a binary classification task, while there are not any samples from abnormal/outlier class. Training an end-to-end DNN in the absence of one class data, is not straightforward [4].

To address the above-mentioned challenge, We have aimed to generate simulated anomalous flows, inspired by the Generative Adversarial Networks (GANs) [5]. Using GAN, we have proposed an end-to-end deep network for IDS which is able to effectively detect the network intrusions, even against unforeseen and new ones. The proposed method is composed of two main modules, $\mathcal{R}$econstructor network ($\mathcal{R}$), and $\mathcal{A}$nomaly detector network ($\mathcal{A}$). Since $\mathcal{R}$ and $\mathcal{A}$ are trained adversarially and competitively, they properly learn the distribution of the feature space of normal PFs. $\mathcal{R}$ strives to fool $\mathcal{A}$, in efforts to manipulate it into detecting $\mathcal{R}(X)$ as a normal PF not a reconstructed version, however, the training duration of $\mathcal{R}$ network is limited in order to have more realistic anomalies. On the other hand, The duty of $\mathcal{A}$ is to distinguish between original normal PFs and the reconstructed ones (abnormal traffic). In other words, $\mathcal{A}$ determines whether the incoming PF, follows the distribution of the feature space of the normal traffic.

The main contributions of the proposed method are: (1) Proposing an end-to-end DNN for IDS which is trained adversarially in a GAN-style setting. To the best of our knowledge, our method is the first end-to-end DNN for semi-supervised intrusion detection, (2) In our method, training is done merely using the feature space of the normal PFs. Nevertheless, the experimental results show the superiority of the proposed method, even compared to the supervised approaches, due to its generality. (3) Performance of the proposed method is better than the other state-of-the-arts in terms of accuracy while the time complexity is also reduced noticeably. (4) In the proposed method, the unseen traffic, i.e.,  anomaly, is simulationly generated using adversarial training. Hence, the need for availability of all classes data has been satisfied.

II End-to-end IDS

In this paper, we have proposed a semi-supervised and end-to-end deep model for IDS. Accordingly, the abnormal class data is not available. The key idea of the proposed method is to solve this problem by simulating anomalous PFs using original normal traffic. This method comprises two modules (i.e.,  networks): (1) $\mathcal{R}$, and (2) $\mathcal{A}$. The former generates simulated anomalous PFs by reconstructing normal traffic to obviate the need for the presence of anomaly class in training phase. The latter detects whether the incoming traffic is normal or not. $\mathcal{R}$ and $\mathcal{A}$ are trained adversarially and unsupervisedly in an end-to-end setting. $\mathcal{R}$ reconstructs the incoming PFs to mislead $\mathcal{A}$ over the input type, i.e.,  normal flow or simulated abnormal one. Since the original data is available for $\mathcal{A}$, it is familiar with their concept. Therefore, $\mathcal{A}$ does not act blindly and attempts to reject the simulated anomalous traffic. These two modules are trained in a GAN-style setting, forming an end-to-end framework for anomaly detection in IDS. The difference of our work with the original GAN is the time which the generator training process stops. $\mathcal{R}$ should not perfectly reconstruct the normal traffic. In our case, simulated anomalies should have some deviation from the normal traffic, otherwise, anomalous PFs are not properly generated. $\mathcal{A}$ can also effectively distinguish between real and fake input. After training process, $\mathcal{A}$ knows the distribution of the target class, i.e.,  normal traffic, and can simply investigate that each of new incoming flow follows the distribution or not. Fig. 1 shows an overview of our proposed method. A detailed explanation of $\mathcal{R}$ network, $\mathcal{A}$ network, joint training of $\mathcal{R}+\mathcal{A}$, and the process of anomaly detection are also provided in this section.

$\mathcal{R}$econstructor Network:

$\mathcal{R}$ has simulationly and adverserially generated anomalous traffic in the stage of training by reconstructing normal incoming PFs. This network gradually and in competition with $\mathcal{A}$, learns to generate flows similar to normal ones. To this end, $\mathcal{R}$ includes an encoder-decoder network. Equation 1 shows the function of these components.

[TABLE]

Here, $X\in\mathbb{R}^{n}$ is the feature space of the incoming PF, $X^{\prime}\in\mathbb{R}^{n}$ is the feature space of the simulated abnormal PF, $Z\in\mathbb{R}^{m}$ is the latent representation, $W$ and $W^{\prime}$ are weight matrices, $\sigma$ and $\sigma^{\prime}$ are element-wise activation functions. The encoder maps an incoming PF to a latent space and the decoder attempts to retrieve the simulated anomaly from the latent space. Note that, if $\mathcal{R}$ reconstructs the normal flows with high precision, they can not play the role of anomalies. Consequently, the training of $\mathcal{R}$ should be stopped before it be able to perfectly reconstruct the normal flows. In [6, 4], it has been shown that, by over-training an encoder-decoder network, we could inpatient the irregular samples and convert them into a normal concept. In contrary to these works, in our case, it is not desirable that $\mathcal{R}$ encoder-decoder maps the flows including irregularity to equivalent normal flows by their reconstruction. Fig. 2 shows the architecture of the $\mathcal{R}$ network.

$\mathcal{A}$nomaly detector Network:

The $\mathcal{A}$ network acts as a classifier to distinguish between the representation of simulated traffic i.e.,  abnormal/fake flows, generated by $\mathcal{R}$ and normal traffic i.e., real flows. Previously, in computer vision community [4, 7], it is investigated that a network like $\mathcal{A}$, which somehow differs from ours in terms of learning process, is capable of efficiently detecting the irregular/outlier images. $\mathcal{A}$ includes a sequence of fully-connected layers ending with a softmax layer (classifier). As mentioned previously, the main purpose of $\mathcal{A}$ is to detect the abnormal incoming PFs. It is worth mentioning that, the $\mathcal{A}$ output indicates the likelihood of the input following the distribution spanned by the target class. Hence, outputs can be considered as a target likelihood score for any given input. The detailed architecture of the $\mathcal{A}$ network is indicated in the Fig. 3.

$\mathcal{R+A}$** Adversarial Training:** Goodfellow et al. [5] has introduced an efficient way for adversarial learning of two networks, Generator (G) and Discriminator (D), called GAN. GANs aim to generate samples that follow the real data distribution, through adversarial training of two networks. G learns to map a latent space like Z sampled from a specific distribution i.e.,  $p_{z}$, to a real data distribution (referred to as $p_{t}$). D is trained by maximizing the probability of assigning the correct label to both the actual data and the fake data from G, while G is simultaneously trained to minimize the $\log(1-D(G(Z)))$. In other words, G and D play the following two-players mini-max game:

[TABLE]

Similarly, we have jointly and adversarially trained $\mathcal{R}+\mathcal{A}$ network, and on the contrary to the purpose of conventional GANs which learns to generate sample from $p_{t}$ distribution, $\mathcal{R}$ and $\mathcal{A}$ are trained to generate sample for abnormal class and distinguish abnormal flows from normal ones, respectively. Consequently, the optimum point for stopping the joint training of $\mathcal{R}+\mathcal{A}$ differs from conventional GANs. In beside of this, in our method instead of mapping the latent representation, Z, to a data sample with the distribution $p_{t}$, $\mathcal{R}$ maps:

[TABLE]

As stated earlier, $p_{t}$ is the distribution of the target class, i.e.,  normal traffic. Since the PFs from the target class are available for $\mathcal{A}$, thus it knows $p_{t}$. In this case, $\mathcal{A}$ can explicitly decide whether $\mathcal{R}(X)$ follows $p_{t}$ or not. Accordingly, $\mathcal{R}+\mathcal{A}$ can be trained by optimizing the following objective:

[TABLE]

$\mathcal{A}$nomaly Detection: In this part, we have explained the classification manner of the proposed method. As previously discussed, $\mathcal{A}$ acts as an anomaly detector, and also derive a benefit from $\mathcal{R}$. Eventually, the proposed Anomaly Detector (AD) is formulated merely using $\mathcal{A}$ network as follows:

[TABLE]

Where $\alpha\in(0,1)$ is a threshold value.

III Experimental Results

In this section, We have evaluated our proposed method on a widely-used dataset known as NSL-KDD111NSL-KDD is available at https://github.com/defcom17/NSL$\_$KDD [8]. The experimental results along with a thorough comparison are provided in the following subsections.

III-A Implementation Details

The proposed method is implemented using Keras framework and Python ran on the GOOGLE COLAB222https://colab.research.google.com. Learning rate is set equal to 0.001 for both networks and $\alpha$ (Equation 5) is set equal to 0.5. The detailed structure of $\mathcal{R}$ and $\mathcal{A}$ 333The trained models of both networks, i.e.,  $\mathcal{R}$ and $\mathcal{A}$, are available at https://github.com/Bahram-Mohammadi/End-to-End-Adversarial-Learning-for-Intrusion-Detection-in-Computer-Networks has been provided in Section II.

III-B Evaluation

As mentioned previously, the assessment is carried out using the NSL-KDD dataset including two subsets, KDDTrain+ and KDDTest+. Since we have proposed a semi-supervised method, only the normal records of KDDTrain+ are involved in the training phase and thus its anomalous records are unused. Furthermore, for the stage of the test, KDDTest+ is used completely. Table I indicates the data distribution of training and test sets for the evaluation process.

Our method ($\mathcal{A}(X)$) is evaluated using four measures: accuracy (ACC), precision (PR), recall (RE) and f-score (FS). We are able to compare $\mathcal{A}(X)$ with methods using the same test set, i.e.,  KDDTest+, and also report the performance results of their work with same metrics. Table II confirms that $\mathcal{A}(X)$ achieves better results compared to another work included two different methods [9]. Although these methods are semi-supervised, they used anomalous records of KDDTrain*+* in the validation set. In fact, in this work, the threshold for distinguishing normal traffic from anomalies are determined based on the validation set. But abnormal samples have not been involved in the training phase of $\mathcal{A}(X)$ at all. Nonetheless, we have gained better results in terms of ACC, RE, and FS.

The selected performance indicator for providing a thorough comparison with the other state-of-the-art methods is $ACC$ showing the correct classification rate of all classes. Regarding Table III, $\mathcal{A}(X)$ represents a significant improvement in terms of accuracy. In our work, simulated abnormal flows are generated with some deviation from the target class irrespective of real anomalies. In fact, our decision making process is not biased towards intrusions which are available in the training set. Hence, $\mathcal{A}(X)$ includes generalization property helping us to obtain better result even compared to supervised methods. It is worth mentioning that, the process of detecting each incoming network PF is done just in 45$\mu s$ on average. Therefore, $\mathcal{A}(X)$ is capable of properly working in real time.

IV Discussion

Mode collapse: GANs face an issue arising when the generator learns only a portion of real-data distribution and then outputs samples from a single mode, (i.e.,  the other modes are ignored). This problem is known as mode collapse [14]. Mode collapse is no longer exists in our case as $\mathcal{R}(X)$ directly sees all possible flows of the target class data and implicitly learns the manifold spanned by the target data distribution.

Unseen class generating: Our proposed method is semi-supervised, thus we need to somehow obtain the anomalous PFs from the normal traffic. The simulated anomalous traffic are generated by $\mathcal{R}$ network to play the role of real anomalies. In fact, we have approximately generated the unseen class data using the normal traffic to solve the problem of DNNs with the absence of one class data.

Generalization: If the training process is done irrespective of the anomalies in the training set, the proposed method is able to decide about the type of incoming PFs while it is not biased towards the already known intrusions. In this case, the proposed method can provide generalization leading to better detection rate.

V conclusion

In this paper, we have proposed a novel semi-supervised and end-to-end deep learning method for anomaly detection in IDS. Specifically, our model is composed of two modules, $\mathcal{R}$ and $\mathcal{A}$. These networks are trained competitively in an adversarial manner. After training phase, $\mathcal{R}$ can simulate anomalies in a way that do not perfectly match with the normal traffic, while $\mathcal{A}$ can distinguish normal PFs from abnormal traffic. The proposed method has been evaluated on NSL-KDD dataset and the results demonstrates our method has better performance compared to the other state-of-the-arts.