摘要：

近年来，深度学习技术在恶意流量检测方面的应用越来越广泛。然而，对抗样本攻击给基于深度学习的恶意流量检测带来了巨大挑战。针对这一问题，提出一种基于集成学习与异常检测的对抗流量检测方法，用于发现针对恶意流量检测系统的对抗样本攻击。首先，为每一类恶意流量类别训练一个二分类集成学习器。对于集成学习器的每一个基模型，采用不同数据子集和特征子集训练，扩大基模型之间的差异性，以增加对抗样本跨越所有模型决策边界的难度。其次，将不同二分类集成学习器中基模型预测输入样本为正常样本的比例作为集成学习模型的信心得分，并将不同二分类集成学习器的信心得分输入孤立森林模型，通过孤立森林模型进行异常检测获得异常得分。最后，将获得的异常得分与在正常样本上获得的异常得分的阈值进行比较，判断样本是否为对抗样本。实验结果表明，该方法在NSL-KDD和CICIDS2017数据集的特征空间和受限空间上分别取得了最高0.986 9、0.989 6、0.999 1、0.999 8的受试者工作特征曲线下面积(AUC)值，优于对比方法。

关键词: 对抗样本, 网络入侵检测, 对抗检测, 集成学习, 异常检测

Abstract:

In recent years, deep learning technology has been increasingly used for malicious traffic detection. However, adversarial example attacks pose challenges to deep learning-based malicious traffic detection. To address this problem, this study proposes an adversarial traffic detection method based on ensemble learning and anomaly detection to detect adversarial example attacks against malicious traffic detection. First, a binary ensemble learner is trained for each malicious traffic category. For each base model, different data and feature subsets are used during training to increase the differences between the base models and increase the difficulty for adversarial examples crossing the decision boundaries of all models. Second, the proportion of base models that predict the input sample as normal traffic is used as the confidence score of the learning model; the confidence scores from different binary ensemble learners are then input into the isolated forest model, and anomaly detection is conducted using the isolated forest model to obtain the anomaly score. Finally, a comparison of the obtained anomaly score with the threshold of the anomaly score obtained for a normal example determines whether the example is adversarial. The experimental results show that the proposed method achieves the highest Area Under the Receiver Operating Characteristic Curve (AUC) values of 0.986 9 and 0.989 6 in the feature and restricted spaces, respectively, of the NSL-KDD dataset, and those of 0.999 1 and 0.999 8 in those spaces, respectively, of the CICIDS2017 dataset, which are better than those obtained using the comparative method.

Key words: adversarial example, network intrusion detection, adversarial detection, ensemble learning, anomaly detection