DDP-DAR: Network intrusion detection based on denoising diffusion probabilistic model and dual-attention residual...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Network intrusion detection (NID) systems face challenges due to significant data imbalance between normal and malicious traffic.
• This imbalance negatively impacts the training of NID models, leading to biased detection towards majority classes.
• Existing methods for addressing data imbalance, such as reducing normal traffic or increasing intrusion traffic, have limitations.

Purpose of the Study:

• To propose a novel network intrusion detection method, DDP-DAR, that effectively handles data imbalance.
• To enhance feature representation, data augmentation, and intrusion detection phases for improved NID performance.
• To leverage advanced deep learning techniques for more accurate and stable detection of network intrusions.

Main Methods:

• Developed a novel feature representation method converting network traffic into RGB images, capturing both global and local features.
• Utilized a denoising diffusion probabilistic model (DDPM) for data augmentation, incorporating cosine noise addition and learnable variance for high-quality synthetic data generation.
• Employed a dual-attention residual network (DAR) for intrusion detection, focusing on multi-layer feature extraction and attention mechanisms to identify critical network traffic patterns.

Main Results:

• The proposed DDP-DAR method demonstrated superior performance across Accuracy, F1-measure, FPR, and ROC-AUC metrics compared to state-of-the-art data augmentation techniques.
• Experiments confirmed that DDP-DAR achieves more stable detection results in network intrusion detection tasks.
• The novel feature representation and DDPM-based augmentation significantly improved the model's ability to handle imbalanced datasets.

Conclusions:

• DDP-DAR effectively addresses the data imbalance problem in network intrusion detection through advanced feature representation and generative data augmentation.
• The dual-attention residual network component enhances the model's capability to extract salient features for accurate intrusion identification.
• The proposed method offers a promising and robust solution for improving the security of cyberspace against network intrusions.