Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks
arXiv:2107.14776 · doi:10.1038/s41598-022-06057-2
Abstract
Due to the growing rise of cyber attacks in the Internet, flow-based data sets are crucial to increase the performance of the Machine Learning (ML) components that run in network-based intrusion detection systems (IDS). To overcome the existing network traffic data shortage in attack analysis, recent works propose Generative Adversarial Networks (GANs) for synthetic flow-based network traffic generation. Data privacy is appearing more and more as a strong requirement when processing such network data, which suggests to find solutions where synthetic data can fully replace real data. Because of the ill-convergence of the GAN training, none of the existing solutions can generate high-quality fully synthetic data that can totally substitute real data in the training of IDS ML components. Therefore, they mix real with synthetic data, which acts only as data augmentation components, leading to privacy breaches as real data is used. In sharp contrast, in this work we propose a novel deterministic way to measure the quality of the synthetic data produced by a GAN both with respect to the real data and to its performance when used for ML tasks. As a byproduct, we present a heuristic that uses these metrics for selecting the best performing generator during GAN training, leading to a stopping criterion. An additional heuristic is proposed to select the best performing GANs when different types of synthetic data are to be used in the same ML task. We demonstrate the adequacy of our proposal by generating synthetic cryptomining attack traffic and normal traffic flow-based data using an enhanced version of a Wasserstein GAN. We show that the generated synthetic network traffic can completely replace real data when training a ML-based cryptomining detector, obtaining similar performance and avoiding privacy violations, since real data is not used in the training of the ML-based detector.
arXiv comment35 pages, 13 figures, 8 tables
References in corpus (12)
- Conditional Image Synthesis With Auxiliary Classifier GANs
- Which Training Methods for GANs do actually Converge?
- Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
- IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection
- Generative Adversarial Networks in Computer Vision: A Survey and Taxonomy
- Flow-based Network Traffic Generation using Generative Adversarial Networks
- Stabilizing Training of Generative Adversarial Networks through Regularization
- Generative Adversarial Networks (GANs) in Networking: A Comprehensive Survey & Evaluation
- Generative Adversarial Networks for Spatio-temporal Data: A Survey
- Anomaly Generation using Generative Adversarial Networks in Host Based Intrusion Detection
- From GAN to WGAN
- Dynamics of Fourier Modes in Torus Generative Adversarial Networks