Research On Deep Transfer Learning Technology For Intrusion Detection

With the rapid development of the Internet,network intrusions are becoming rampant increasingly.In the field of intrusion detection,network traffic captured in different situations often has some differences.A model trained on one network flow dataset can’t detect other datasets.The birth of transfer learning has brought the dawn of this problem to the solution.At present,researchers often use domain adaptation or model fine-tuning to solve the problem of transfer learning in intrusion detection.Domain adaptation needs to ensure the consistency of the source domain and target domain in category space,which is usually difficult to guarantee.Model fine-tuning does not fully consider the internal relations of data features in different domains,and it relies on sufficient labeled samples in the target domain.However,the labeled samples of the target domain are usually deficient.And it is hard for model fine-tuning to have a good classification effect.This dissertation divides the intrusion detection scenarios into heterogeneous migration intrusion detection scenarios and homogeneous migration intrusion detection scenarios based on the migration learning problems that need to be solved in intrusion detection.Aiming at the problem of difficulty in domain adaptation due to the inconsistency of the source domain and target domain category space in heterogeneous transfer intrusion detection scenario,this dissertation improve the traditional adversarial domain adaptation and propose a strategy of weight learning on the basis of learning domain invariant features via adversarial learning between different domains.It combines the feature information of the source and target domains with the label information of the source domain to learn prior probability knowledge and translate it into a weight function.The source domain samples are weighted to measure the contribution of different samples in source domain.It measures the contribution of different categories of source domain samples to the domain adaptation process by weighting the source domain samples.It filters out the source domain samples that contribute to domain adaptation to focus on learning and filter the samples that have a negative impact on the domain adaptation.Aiming at the problem that model fine-tuning is difficult to adapt to transfer learning with insufficient labeled samples of the target domain in Isomorphic transfer intrusion detection scenarios,this dissertation combines model transfer and feature transfer to improve the transfer effect.Aiming at the problem of unstable training and single extracted features in the process of adversarial training for feature transfer,the Wasserstein distance is introduced in the adversarial domain adaptation to replace the JS divergence to stabilize the adversarial training process and make the extracted features more diverse.In order to verify the effect of the model in applications,this dissertation designs different experimental schemes for different intrusion detection scenarios and test the detection effect between different data sets.In heterogeneous transfer intrusion detection scenarios the results of experiments show that the source and target domains have different category spaces,compared with the adversarial domain adaptive baseline,the heterogeneous detection model that this dissertation proposed has a significant improvement in the recognition rate of intrusion categories,and its performance is more stable;In the homogeneous transfer intrusion detection scenario where the source domain and the target domain have different feature spaces,the isomorphic detection model that this dissertation proposed has a significant improvement in the detection rate of intrusion compared with the traditional model in transfer learning.