Enhanced Abnormal Traffic Detection Using Lightweight DAE-GAN and Knowledge Distillation Techniques

Abstract

This thesis addresses the need for efficient and accurate abnormal traffic detection in network security by developing a lightweight Denoise Autoencoder-Generative Adversarial Network (DAE-GAN) model. The original DAE-GAN, known for its high performance, presents significant computational and memory challenges, making it unsuitable for resource-constrained environments. To address this, we employed knowledge distillation, transferring knowledge from a large, complex teacher model to a smaller, efficient student model. We began by implementing the original DAE-GAN, combining a Generative Adversarial Network (GAN) and an autoencoder to identify abnormal traffic. The GAN generated pseudo-anomalies to enhance training, while the autoencoder detected deviations indicative of anomalies. After establishing baseline performance, we applied knowledge distillation to create a lightweight version, training the teacher model on the NSL-KDD dataset and using its soft outputs to guide the student model. The lightweight DAE-GAN was rigorously evaluated against the original model using the same dataset. Despite reduced complexity and size, it achieved strong performance with 90% accuracy, 85% precision, 97% recall, and a 91% F1 score. These results are competitive with the original DAE-GAN, demonstrating the effectiveness of knowledge distillation in preserving anomaly detection capabilities. This research contributes to the field by providing a practical solution for real-time network intrusion detection on low-resource devices. The lightweight model maintains high detection accuracy while reducing resource consumption, making it suitable for real-world deployment. Future work will focus on deploying the model in live network environments to validate its effectiveness across diverse datasets, advancing resource-efficient machine learning models for cybersecurity applications.