# End-to-End Adversarial Learning for Intrusion Detection in Computer Networks

## TL;DR

This paper introduces an end-to-end adversarial learning approach using GANs for anomaly-based intrusion detection, effectively modeling normal traffic to detect intrusions without bias from known attack types.

## Contribution

Proposes a semi-supervised, GAN-based deep architecture for intrusion detection that improves generalization and detection accuracy by synthesizing anomalous data from normal traffic.

## Key findings

- Outperforms state-of-the-art IDS methods on NSL-KDD dataset
- Effectively models normal traffic to detect unseen intrusions
- Reduces bias towards known attack types

## Abstract

This paper presents a simple yet efficient method for an anomaly-based Intrusion Detection System (IDS). In reality, IDSs can be defined as a one-class classification system, where the normal traffic is the target class. The high diversity of network attacks in addition to the need for generalization, motivate us to propose a semi-supervised method. Inspired by the successes of Generative Adversarial Networks (GANs) for training deep models in semi-unsupervised setting, we have proposed an end-to-end deep architecture for IDS. The proposed architecture is composed of two deep networks, each of which trained by competing with each other to understand the underlying concept of the normal traffic class. The key idea of this paper is to compensate the lack of anomalous traffic by approximately obtain them from normal flows. In this case, our method is not biased towards the available intrusions in the training set leading to more accurate detection. The proposed method has been evaluated on NSL-KDD dataset. The results confirm that our method outperforms the other state-of-the-art approaches.