Malicious Traffic Identification Based on Composite Sampling

In response to the problem of insufficient attack traffic samples in network intrusion detection datasets, a hybrid sampling data augmentation method (S-VAE) that combines SMOTE and VAE is proposed. Firstly, train corresponding VAE models for different types of attack traffic samples; Secondly, the SMOTE algorithm is used to extract the original samples and their neighboring samples from the dataset and store them in pairs; Then, the paired samples are fed into the trained VAE model to learn their latent representations separately, and the latent representations of the original and neighboring samples are linearly interpolated; Finally, the results of linear interpolation are fed into the trained VAE decoder to expand the new samples. In this way, a balanced dataset can be established to enable deep learning models to fully learn the features of a small number of samples. The experimental results showed that using convolutional neural network models for multi classification experiments on the NSL-KDD and UNSW-NB15 datasets, S-VAE increased the classification recall by 3.75 and 3.06 percentage points, respectively, and the F1 score by 6.49 and 4.29 percentage points, respectively, compared to the baseline model.