arXiv:2603.19350cs.CRcs.AI2026-03被引 1

用自注意力与JS散度改进生成模型,提升零日攻击检测能力

A Novel Solution for Zero-Day Attack Detection in IDS using Self-Attention and Jensen-Shannon Divergence in WGAN-GP

  • 引入自注意力机制捕捉特征长程依赖,增强生成网络表达力
  • 结合JS散度辅助判别器,使生成样本更真实、梯度更平滑
  • 在NSL-KDD数据集上验证,显著提升零日攻击检测准确率

针对日益复杂的零日攻击,现有方法难以有效防御。本文提出SA-WGAN-GP,通过自注意力机制重构特征向量以捕获跨特征的长程依赖;进一步提出JS-WGAN-GP,引入基于JS散度的辅助判别器,采用二元交叉熵训练并冻结,用于正则化生成器以获得更平滑梯度和更高质量样本;最终构建SA-JS-WGAN-GP,融合二者优势。为评估效果,采用留一攻击类型法在NSL-KDD数据集上模拟零日攻击,训练所有生成模型与入侵检测系统。实验表明,结合自注意力与JS散度的WGAN-GP能显著提升入侵检测性能,实现更有效的零日风险识别。

原文摘要 · Abstract (English)

The increasing sophistication of cyber threats, especially zero-day attacks, poses a significant challenge to cybersecurity. Zero-day attacks exploit unknown vulnerabilities, making them difficult to detect and defend against. Existing approaches patch flaws and deploy an Intrusion Detection System (IDS). Using advanced Wasserstein GANs with Gradient Penalty (WGAN-GP), this paper makes a novel proposition to synthesize network traffic that mimics zero-day patterns, enriching data diversity and improving IDS generalization. SA-WGAN-GP is first introduced, which adds a Self-Attention (SA) mechanism to capture long-range cross-feature dependencies by reshaping the feature vector into tokens after dense projections. A JS-WGAN-GP is then proposed, which adds a Jensen-Shannon (JS) divergence-based auxiliary discriminator that is trained with Binary Cross-Entropy (BCE), frozen during updates, and used to regularize the generator for smoother gradients and higher sample quality. Third, SA-JS-WGAN-GP is created by combining the SA mechanism with JS divergence, thereby enhancing the data generation ability of WGAN-GP. As data augmentation does not equate with true zero-day attack discovery, we emulate zero-day attacks via the leave-one-attack-type-out method on the NSL-KDD dataset for training all GANs and IDS models in the assessment of the effectiveness of the proposed solution. The evaluation results show that integrating SA and JS divergence into WGAN-GP yields superior IDS performance and more effective zero-day risk detection.

零日攻击生成对抗网络入侵检测自注意力

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。