A METHOD FOR DETECTING COMPUTER ATTACKS BASED ON H-DDPM NETWORK TRAFFIC DATA AUGMENTATION MODEL

Abstract

This paper examines the problem of improving the detection of computer attacks (CA) by an intrusion detection system (IDS) under conditions of significant network traffic data imbalance. Based on an analysis of methods for reducing data imbalance, it is concluded that classical methods of balancing and generative augmentation do not preserve the statistical structure of multidimensional tabular data, including their fractal properties and self-similarity, which reduces the quality of classifier training. This paper proposes a method for detecting computer attacks (CA) based on the H-DDPM data augmentation model, a modification of the DDPM diffusion probabilistic model, in which the variance of the added Gaussian noise in the forward process depends on the Hurst exponent H for each CA class. The method includes data preprocessing, the formation of time series using sliding windows, H estimation using DFA and R/S methods, and the generation of synthetic data for training the LSTM classifier. The method is evaluated using the general performance metrics Accuracy, Recall, F1, ROC-AUC, and G-means, as well as Precision, Recall, and F1-score for each class. Experiments were conducted on the CSE-CSE-CIC-IDS2018 and UNSW-NB15 datasets. A comparison was made with other methods, such as SMOTE, GAN, and DDPM. The experimental results show that H-DDPM improves the efficiency of CA detection, outperforming similar methods in terms of imbalance-sensitive metrics. Furthermore, experimental validations demonstrate that directly using the Hurst H exponent for CA classes in the H-DDPM model improves the recall and balanced quality of CA detection. It is noted that H-DDPM has an impact on CA classification, manifested by an increase in false positives and a decrease in the ROC-AUC metric, which requires additional tuning of the classifier model hyperparameters and filtering of synthetic data