Sample Generation Technology Of Provenance Graph Based On Generative Adversarial Networks

Provenance is a kind of special metadata which contains the historical information of data objects and the dependency between objects.At present,provenance has been used in intrusion detection to improve the detection accuracy.However,the lack of training samples restricts the further improvement of detection accuracy.On the other hand,the generative adversarial networks can be used to generate data,and has been used in the field of image,and has great potential for the generation of intrusion detection data sets.A sample generation technology of provenance graph based on generative adversarial networks is proposed.First,select the center node of the traceability graph and its neighboring nodes,and vectorize the nodes according to the time series,convert the provenance samples into the provenance vector,so as to select the neural network model.Secondly,based on the existing generative adversarial networks.Above,according to the data characteristics of the provenance graph vector and the characteristics of the selected neural network model,the generator and discriminator neural network model for generative adversarial networks are combined to design five sets of alternative generation models.Finally,the five groups of generation models are evaluated on the three indicators of discriminator loss,cosine similarity and false detection rate,and the generation model with the best generation effect is selected.According to the evaluation results,the model with long short-term memory as generator and full connection neural network as discriminator has the best generation effect.In the training,the discriminator loss can converge around 0.5,the vector similarity between the generated sample and the original sample is more than 95%,and the false detection rate of each application is between 4% and 10%,which proves that the selected generation model has good generation effect for each application,and the generated results can be used in the actual intrusion detection.