Abstract

The massive amounts of network traffic data needs significant costs to be labeled, and due to the different data distribution,
there is always a performance degradation of the model trained by public datasets for real applications. In order to solve
the scarcity of labeled data and domain shift problem, this paper proposes a semi-supervised domain adaptive intrusion
detection algorithm based on generative adversarial network with maximum mutual information and pseudo-label selec-
tion. Firstly, the improved LR-SMOTE (Limit Radius Synthetic Minority Oversampling Technique) data enhancement
method based on multi-samples and random smoothing means is proposed to enhance the minority class data in the source
domain to avoid overfitting of majority classes when the distribution is aligned. Secondly, a domain-invariant feature
extraction method based on generative adversarial network with maximum mutual information is proposed. By maximiz-
ing the mutual information between the original features and domain-invariant features of the source and target domains,
the integrated semantic information is fully retained, thereby the domain-invariant features equivalent to the original
features are extracted. Finally, in order to make full use of the unlabeled data in the target domain, Uncertainty-aware
Pseudo-label Selection (UPS) method is used to train the domain-invariant feature classifier OSVM (One-class Support
Vector Machine) in a semi-supervised manner. Experiments on network datasets and IoT (Internet of Things) datasets
demonstrate the effectiveness of proposed algorithm in cross-domain intrusion detection scenarios.