A Distillation GAN Model for Network Intrusion Detection

Abstract

This study presents a distillation-based Generative Adversarial Network (GAN) model designed for intrusion detection in network systems. A Teacher-Student architecture is proposed, in which a single teacher generator is utilized to train both the teacher discriminator and the student discriminator. The model was trained to identify anomalies present in network traffic intrusions by tuning the min-max loss function in GANs. The imbalance caused by the underrepresented attack classes in the training dataset is corrected using the generator. Extensive experiments on the CIC-IDS-2017 and CSE-CIC-IDS2018 datasets within the framework of the proposed method showed the effectiveness of the approach. The student network on the CICIDS-2017 dataset showed an overall accuracy of 86.8% and an F1-score of 88.2%, comparable to that of the teacher, with an accuracy of 89.1% and an F1-score of 88.7%, with a 40% decrease in the number of parameters. For the CSE-CIC-IDS2018 dataset, the student model showed a competitive performance, with accuracy ranging from 73.10-88.20% and 70.24-86.68% for F1-score, respectively, and aligning with and even outperforming the metrics of a teacher (accuracies of 76.55-89.26% and F1-scores of 72.91-87.17%).