Analysis and Detection against Network Attacks in the Overlapping
  Phenomenon of Behavior Attribute
Jiang Xie Shuhao Li Yongzheng Zhanga Peishuai Sun Hongbo Xu
The proliferation of network attacks poses a significant threat. Researchers
propose datasets for network attacks to support research in related fields.
Then, many attack detection methods based on these datasets are proposed. These
detection methods, whether two-classification or multi-classification, belong
to single-label learning, i.e., only one label is given to each sample.
However, we discover that there is a noteworthy phenomenon of behavior
attribute overlap between attacks, The presentation of this phenomenon in a
dataset is that there are multiple samples with the same features but different
labels. In this paper, we verify the phenomenon in well-known
datasets(UNSW-NB15, CCCS-CIC-AndMal-2020) and re-label these data. In addition,
detecting network attacks in a multi-label manner can obtain more information,
providing support for tracing the attack source and building IDS. Therefore, we
propose a multi-label detection model based on deep learning, MLD-Model, in
which Wasserstein-Generative-Adversarial- Network-with-Gradient-Penalty
(WGAN-GP) with improved loss performs data enhancement to alleviate the class
imbalance problem, and Auto-Encoder (AE) performs classifier parameter
pre-training. Experimental results demonstrate that MLD-Model can achieve
excellent classification performance. It can achieve F1=80.06% in UNSW-NB15 and
F1=83.63% in CCCS-CIC-AndMal-2020. Especially, MLD-Model is 5.99%-7.97% higher
in F1 compared with the related single-label methods.