AnchorMixGAN improves DDoS detection in cloud IoT networks with scarce labels
AnchorMixGAN: Anchor-Aligned Generative Semi-Supervision for DDoS Detection in Cloud-Integrated IoT Networks
Machine LearningCryptography and Security
Summary
Detecting cyberattacks like DDoS in internet-connected devices linked to the cloud is hard when few examples are labeled for training. The authors propose AnchorMixGAN, a new way to use computer-generated traffic data to help train detection models better. It creates special data views that keep the attack patterns aligned with real data, improving accuracy. Their method outperforms previous approaches on several standard datasets, even when only a small portion of traffic is labeled.
What this means in practice
- •For network security teams: Enhance DDoS attack detection in cloud-integrated IoT environments when labeled traffic data is limited.
- •For cybersecurity product developers: Build more accurate semi-supervised detectors for IoT networks using generative data augmentation techniques.$Commercial implications: Enables selling improved IoT security solutions that work with minimal labeled data for DDoS protection.
Authors
Jin Yang, Xufeng Liu, Yong Hu, Xueyang Wang, Honglu Yang, Gang Li
Abstract
Detecting distributed denial-of-service (DDoS) attacks in cloud-integrated IoT networks is difficult when labeled traffic is scarce. Generative semi-supervised learning can supplement the available training data, but prediction shifts induced by synthetic views may affect the targets assigned to real unlabeled flows. We propose AnchorMixGAN, a generative semi-supervised framework that addresses this problem through anchor-aligned target construction. Its Anchor-MAS module treats each real unlabeled flow as an anchor and creates alternative views by replacing one field group at a time with values from generated traffic. A frozen reference classifier predicts the anchor and its views; averaging and sharpening these predictions produces a soft target for the original flow. The flow and its target are then mixed with a labeled example using MixUp, allowing the detector to learn from both the original labeled records and the mixed examples. We analyze how reference-classifier error, view construction, and sharpening affect the target, and derive a bound on the resulting change in cross-entropy at a fixed detector prediction. At the reported 90% training setting with 20% of the training records labeled, AnchorMixGAN attains accuracies of 97.3%, 97.4%, and 96.5% on NSLKDD, BoT-IoT, and CICIoT2023, respectively, exceeding the corresponding MixGAN results by 1.6, 1.0, and 4.4 percentage points.