数据污染下用于网络异常检测的深度学习：鲁棒性评估与性能下降缓解
Deep Learning for Network Anomaly Detection under Data Contamination: Evaluating Robustness and Mitigating Performance Degradation
AI总结：
本研究针对深度学习网络异常检测模型易受训练集数据污染影响的问题，提出评估协议测试六种无监督算法的鲁棒性，并设计带约束潜表示的增强自动编码器，提升了模型抗数据污染能力。
摘要：
深度学习（DL）已成为网络安全领域网络异常检测（NAD）的关键工具。尽管用于异常检测的DL模型擅长从数据中提取特征和学习模式，但它们易受数据污染的影响——即被假定为良性的训练集中意外混入了与攻击相关的数据。本研究采用我们提出的评估协议，评估了六种无监督DL算法对数据污染的鲁棒性。结果表明，当前最先进的异常检测算法在接触受污染数据时性能会显著下降，凸显了基于DL的NAD模型亟需自我保护机制。为缓解这一漏洞，我们提出了一种带有约束潜变量表示的增强型自动编码器，可使正常数据在潜空间中围绕一个可学习中心更密集地聚类。我们的评估显示，与现有方法相比，该方法对数据污染的抵抗能力有所提升，为构建更鲁棒的NAD系统提供了有前景的方向。
英文摘要：
Deep learning (DL) has emerged as a crucial tool in network anomaly detection (NAD) for cybersecurity. While DL models for anomaly detection excel at extracting features and learning patterns from data, they are vulnerable to data contamination -- the inadvertent inclusion of attack-related data in training sets presumed benign. This study evaluates the robustness of six unsupervised DL algorithms against data contamination using our proposed evaluation protocol. Results demonstrate significant performance degradation in state-of-the-art anomaly detection algorithms when exposed to contaminated data, highlighting the critical need for self-protection mechanisms in DL-based NAD models. To mitigate this vulnerability, we propose an enhanced auto-encoder with a constrained latent representation, allowing normal data to cluster more densely around a learnable center in the latent space. Our evaluation reveals that this approach exhibits improved resistance to data contamination compared to existing methods, offering a promising direction for more robust NAD systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
