A Domain Adaptation Network Intrusion Detection Algorithm based on Class-Balanced Knowledge Transferand Multi-Structure Domain Alignment

Network intrusion detection data has the problem of class imbalance, and the distribution of training data is inconsistent with the distribution of the real detection data, which leads to the serious performance degradation of network intrusion detection system. To solve the above problems, this paper proposes a domain adaptation network intrusion detection algorithm based on class-balanced knowledge transfer and multi-structure domain alignment. Firstly, the source domain is extended by the generative adversarial network to alleviate the data class imbalance, the class separation loss is proposed to reduce the impact of class overlap caused by data imbalance processing on cross-domain knowledge transfer, the rich knowledge of the source domain is transferred to the target domain to generate the target domain pseudo labels, and the dynamic threshold is used to lter the high condence target domain data for the subsequent domain alignment. Furthermore, multi-structure domain alignment is proposed to reduce data distribution di erences between source domain and target domain. The domain-invariant features of source domain and target domain are extracted by reducing the domain di erence caused by the dependence structure between di erent domains. The difference of local relative structure of class prototypes in di erent domains is reduced through supervised Class Prototype Discovery and class prototype relative structure alignment. Combining the domain adversarial network to align the overall distribution of data in di erent domains and the overall structure of class prototypes, the classi er can obtain more robust decision boundary. Experiments on four NIDS reference datasets, UNSWNB15, NSL-KDD,ToN-IoT, BoT-IoT, verify the e ectiveness of the proposed algorithm in the cross-domain scenarios.