Abstract:
To address the dual challenges of imbalanced distribution of minority-class samples and feature dimension redundancy in intrusion detection, this paper proposes a traffic anomaly detection model named CSE-CTGAN, which integrates a class-selective encoder with a conditional tabular generative adversarial network. The model constructs an inter-class and intra-class dual-channel feature extraction architecture and incorporates an expert-channel discrimination mechanism. Adaptive class selection is achieved based on class prototype similarity, while collaborative optimization and expert voting strategies are employed during the training and inference phases, respectively, to enhance feature discriminability and model generalization. Furthermore, a conditional tabular generative adversarial network built upon the AdaBoost algorithm is developed to synthetically generate minority-class samples that are difficult to model, thereby alleviating the constraints imposed by data imbalance on classification performance. Experimental results demonstrate that on the NSL-KDD dataset, the proposed model achieves improvements of 11.47% in accuracy, 10.23% in F1-score, and 7.46% in recall. On the UNSW-NB15 dataset, the average recall and F1-score improvements across multiple classifiers are 5.73% and 6.49%, respectively. The model also exhibits favorable adaptability and stability in streaming detection simulations on the TON_IoT dataset.