Home Journals Articles Updates About
CN
image
收藏切换
Adaptive Multiobjective Evolutionary Generative Adversarial Network for Metaverse Network Intrusion Detection
收藏切换
PDF
Dikai Xu1, 2, Bin Cao1, 2, *
Research. Vol 8 Article ID 0665
Less
收藏切换
Research. Vol 8 Article ID 0665
• Research Article •
Adaptive Multiobjective Evolutionary Generative Adversarial Network for Metaverse Network Intrusion Detection
Full
Dikai Xu1, 2, Bin Cao1, 2, *
Affiliations
  • 1 State Key Laboratory of Reliability and Intelligence of Electrical Equipment, Hebei University of Technology, Tianjin 300401, China.
  • 2 School of Artificial Intelligence, Hebei University of Technology, Tianjin 300401, China.
Published: 2025-04-15 doi: 10.34133/research.0665
Outline
收藏切换

The convergence of the Metaverse and the Internet of Things (IoT) paves the way for extensive data interaction between connected devices and digital twins; however, this simultaneously introduces considerable cybersecurity threats, including data breaches, ransomware, and device tampering. Existing intrusion detection algorithms struggle to effectively defend against emerging cyberattacks in the rapidly evolving Metaverse environment. Designing effective neural networks for intrusion detection algorithms relies heavily on expert experience, making the manual process time-consuming and often yielding suboptimal results. This paper addresses a critical gap in cybersecurity for Metaverse devices, which are often overlooked in traditional detection methods, and proposes an adaptive multiobjective evolutionary generative adversarial network (AME-GAN) as a novel, scalable solution for optimizing network intrusion detection. An inversely proportional hybrid attention-based long short-term memory GAN is proposed, combining GANs to generate minority class samples and alleviate the imbalance problem in training datasets, which has long hindered accurate intrusion detection. Additionally, an adaptive evolutionary neural architecture search algorithm for the supernet of the GAN is designed to guide the mutation direction of the supernet, enhancing the training stability. This paper further introduces a double mutation multiobjective evolutionary neural architecture search algorithm, integrating both the multiobjective evolutionary algorithm and the neural architecture search to optimize accuracy, real-time performance, and model diversity—a crucial aspect for Metaverse devices with diverse hardware constraints. Experiments conducted on 3 well-known datasets—NSL-KDD, UNSW-NB15, and CIC-IDS2017—demonstrate that AME-GAN outperforms state-of-the-art approaches, with improvements of 0.32% in accuracy, 0.31% in F1 score, 0.47% in precision, and 0.37% in recall. This paper offers a promising, adaptive framework to enhance cybersecurity in the Metaverse, improving detection performance and real-time applicability, and contributing to the future of network intrusion detection in next-generation digital environments.

Dikai Xu, Bin Cao. Adaptive Multiobjective Evolutionary Generative Adversarial Network for Metaverse Network Intrusion Detection[J]. Research, 2025 , 8 (4) : 0665 . DOI: 10.34133/research.0665
Full Text
Less
Introduction
Less
In the Metaverse era, users leverage multi-device and multi-sensor collaboration to achieve multimodal data interactions involving text, audio, video, and motion from the real world, enabling entertainment and work in a virtual world that transcends reality [1]. The Metaverse incorporates cutting-edge technologies to offer personalized recommendations to consumers and deliver immersive and interactive experiences [2]. The advent of the Metaverse has introduced a new era of virtual reality, allowing individuals to immerse themselves in vast digital landscapes, interact in real time, and engage in activities ranging from gaming to socializing [3]. Integrating Internet of Things (IoT) such as sensor devices, wearables, and smart gadgets into the Metaverse environment is crucial for deepening interactions and enhancing immersion in the Metaverse. However, IoT devices typically employ minimal hardware designs, making them highly vulnerable to various types of network attacks and posing considerable security risks. Moreover, the Metaverse's decentralized and distributed blockchain technology allows users to buy, sell, and trade virtual assets, making it an appealing target for attackers seeking to exploit vulnerabilities in smart contracts as well as steal non-fungible tokens (NFTs) and other valuable digital assets [4]. The openness and complex interactions within the Metaverse create potential cybersecurity risks, particularly threats related to network intrusions.
Network intrusion detection (NID) algorithms are designed to monitor and analyze network traffic, aiming to detect anomalous, intrusive, or noncompliant behaviors with precision and efficiency. NID algorithms are typically categorized into signature- and anomaly-based categories according to different working principles [5]. Signature-based NID algorithms rely on matching existing attack patterns, which are highly effective for known attacks but require extensive computational resources as the database grows and are ineffective for novel attacks [6]. Anomaly-based NID algorithms, on the other hand, detect abnormal activities by identifying deviations between user traffic and normal traffic, and perform better against novel attacks [7]. This kind of method can lead to a considerable number of false alarms. The pattern recognition scheme lays the foundation for enhancing NID algorithms through the efficient pattern learning capabilities of deep learning (DL) [8]. Various methods, including supervised learning, unsupervised learning, and reinforcement learning (RL), have been integrated into DL-based NID algorithms [9]. These NID algorithms rely heavily on feature extraction networks to distinguish between benign and malicious traffic. The widely recognized feature extraction networks are convolutional neural networks (CNNs) and Transformers. Transformer-based NID algorithms, as more recent developments, introduce the multi-head self-attention (MSA) mechanism to capture dependencies within input sequences and learn global–local relationships in a more comprehensive manner, which provides superior discriminative performance compared to CNN-based NID algorithms.
Although DL demonstrates its advantages in constructing hierarchical feature representations from labeled training data for analyzing and recognizing complex and high-dimensional Metaverse traffic [10], several challenges persist. Existing NID training datasets exhibit substantial disparities in sample distributions across categories, leading to a severe data imbalance issue. This imbalance results in substantial variations in detection accuracy across different types of threats in the Metaverse, ultimately reducing overall detection performance. Moreover, the development of NID models is largely dependent on expert prior knowledge, and the configuration of network layer parameters involves time-consuming manual adjustments through iterative training, which rarely results in the optimal architecture.
With the rapid expansion of the Metaverse driving a surge in data volume, there is a pressing need for an automated approach to develop efficient Metaverse NID algorithms that ensure precise detection and classification of diverse network traffic within the Metaverse while meeting real-time requirements. To address this challenge, we propose a Metaverse NID algorithm based on the adaptive multiobjective evolutionary generative adversarial network (AME-GAN). We utilize the powerful temporal feature extraction capability of long short-term memory (LSTM) networks and the attention mechanism's proficiency in modeling global spatial features to extract spatiotemporal features from Metaverse traffic, thereby enhancing the performance of the original GAN. Moreover, the generator of the GAN is utilized to produce new rare-class samples, alleviating the data imbalance issue in the training datasets of Metaverse NIDs and contributing to improving the overall accuracy of the discriminator. By setting the discriminator's accuracy and computational latency, as well as the generator's fidelity and diversity, as optimization objectives in the GAN, an adaptive evolutionary search strategy is deployed within the supernet of the neural architecture search (NAS). This enables the automated search for discriminators with high accuracy and low latency, as well as generators with high fidelity and diversity.
NID in the Metaverse
The ultimate goal of the Metaverse is to ensure that any event in the real world is instantly mirrored in the virtual world, while any changes within the Metaverse are accurately reflected in the physical world, achieving a true digital twin of both the real and virtual worlds [11]. To ensure that all users experience a secure and immersive environment within the Metaverse, there is an urgent need to establish flexible and cutting-edge security solutions capable of addressing the rapid transformations and dynamic developments inherent to the Metaverse. Artificial intelligence (AI)-driven machine learning-based NID network security solutions can effectively address a wide range of threats in network environments, providing more flexible and data-driven defense options for the Metaverse.
Machine learning-based NID algorithms automatically learn and adapt to new threats by analyzing data, making them ideal for dynamic and complex network environments. Deep learning, a subset of machine learning, models complex patterns through deep neural networks (DNNs), providing more powerful tools for NID [12]. DL-based NID algorithms have become a research hotspot, with CNN [13,14], LSTM [15], and Transformer [16,17] techniques substantially improving detection accuracy and reducing false positives [18]. CNN is particularly effective in capturing spatial patterns within network traffic [19]. The LSTM network demonstrates excellent performance in modeling temporal dependencies [20]. The work of [21,22] exploited CNN's ability to capture spatial patterns in network traffic to construct a CNN-based NID algorithm that outperform traditional machine learning algorithms. However, CNN-based algorithms are not well-suited for capturing the long-term dependency of network traffic. In [20], bidirectional LSTM (BiLSTM) is proposed to solve intrusion detection problems, offering notable advantages over traditional LSTM in accuracy, precision, and F1 score on the NSL-KDD dataset. In [23], CNN and BiLSTM are combined to learn spatial and temporal features, exploring the effects of various hyperparameters and achieving better classification performance on the NSL-KDD and UNSW-NB15 datasets. Although LSTM alleviates the gradient vanishing problem to a certain extent, the problem still exists when dealing with very long sequences.
The self-attention mechanism in the Transformer can focus directly on the relationships between any 2 positions in a sequence, efficiently capturing complex global dependencies, making it highly effective for modeling long-distance dependencies [24]. CANET [25] integrates CNN and attention mechanisms, proposing a convolutional attention module to extract local spatiotemporal features. Additionally, it introduces an improved Equalization Loss v2, effectively enhancing the detection rate of minority classes and excelling other methods in detecting minority class attacks on the NSL-KDD and UNSW-NB15 datasets. ABD [26] enhances BiLSTM with an attention mechanism, improving its ability to capture contextual information and long-term dependencies in time-series data. This approach demonstrates stronger adaptability when handling complex network intrusion attacks, achieving 1.0% and 2.0% accuracy improvements in binary and multi-class tasks on the NSL-KDD dataset, respectively. The work of [27] abandons LSTM and proposes a temporal convolutional network (TCN) module, combining GAN and attention mechanisms to detect attacks. It outperforms existing GAN-based NIDs in both accuracy and speed, making it suitable for low-latency deployment on edge computing servers of IoTs. FlowTransformer [28] takes NetFlow-based data as input instead of packet-based data for monitoring, avoiding the privacy issues that packet capture may cause, and proposes a Transformer-based NID pipeline, which maintains the high accuracy and reduces the size of the encoder/decoder. The attention-based NID algorithms outperform the methods above in terms of detection accuracy. However, this improvement comes with a notable increase in model complexity, which is almost unbearable for Metaverse devices with minimal hardware design. Table 1 provides a comparison of the strengths and limitations of these methods.
GAN for NID
In addition to constructing neural network backbones with strong feature extraction capabilities for NID, numerous publicly available datasets for NID exhibit notable class imbalance, with benign instances vastly outnumbering malicious ones [29]. To this end, researchers have proposed methods to optimize training datasets based on Siamese neural networks (Siamese-NN) [30,31], extreme gradient boosting (XGBoost) [32], and generative models [33,34]. Generative models, especially GANs [35], have emerged as a prominent area of research because of their excellent diversity and authenticity in sample generation [36]. Each GAN consists of an adversarial structure consisting of a generator G and a discriminator D. The training process can be formulated as a minmax game min G max D V ( D , G ). The objective of the discriminator is to maximize the probability of correctly classifying samples, identifying those that conform to the real data distribution p data as genuine, while rejecting as many fake samples generated by the generator as possible. The generator uses noise sampled from the p n distribution to generate samples, fitting the generated sample distribution to the real data distribution. This weakens the discriminator's ability to identify real data and generated data, making it unable to effectively identify the generated data, thus producing incorrect classification results. During training, the generator and discriminator iteratively optimize against each other, ultimately reaching a Nash equilibrium where the generated data closely resemble real data.
min G max D V ( D , G ) = 𝔼 x ∼ p data ( x ) [ log D x ] + 𝔼 n ∼ p n ( n ) [ log 1 − D G n ]
GANs have been effectively applied to generate synthetic attack data, especially for challenging-to-obtain intrusion data. The diverse attack data generated by GANs can enhance the ability of NID to detect a wide range of threats [37]. Aydin [38] and Yang and Zhou [39] used the generator of GANs to create samples for dataset balancing by introducing a variational autoencoder to stabilize class distributions and learn the distribution of each class in the latent space. Higher-quality minority class samples can be generated. This effectively addresses the issues of insufficient sample diversity and mode collapse in traditional GANs, proving the feasibility of using GANs to solve the data imbalance issue. TMG-GAN [40] proposes a GAN-based data augmentation method with a multi-generator and classifier structure and introduces a classifier structure and incorporates cosine similarity computation to boost the quality of generated samples and strengthen class differentiation, addressing class imbalance in NID algorithms, achieving considerable detection performance improvement on CICIDS2017 and UNSW-NB15 datasets.
In practical NID applications, the generator of the GAN can generate data samples that simulate the characteristics of real network traffic [41]. In this context, algorithms that combine original GANs [42,43], DCGANs [44], WGANs [45,46], and other GAN variants to generate training data samples have been developed, addressing the problem of minority classes in training datasets. The work of [34,47–50] further proposed algorithms that use generators to generate malicious traffic, contributing to the development of more powerful and more adaptable NID algorithms. The internal discriminator demonstrates stronger adaptability in monitoring various new types of malicious traffic.
Hoang and Kim [51] proposed the convolutional adversarial autoencoder (CAAE) combined with an autoencoder and a GAN to learn the feature differences between normal and malicious traffic in a semisupervised manner, which substantially reduces both complexity and inference latency while ensuring robust detection performance, making it well-suited for real-time applications. Balaji and Narayanan [52] explored an alternative approach to reduce computational costs by using principal components analysis (PCA) for feature extraction and dimensionality reduction, followed by the application of BiGAN to detect anomalous network traffic. It greatly reduces the computational cost of the NID model, providing a faster and more efficient solution for network security. The comparative summary of the strengths and limitations of these methods is presented in Table 2.
NAS for GAN
To achieve better performance, the NID model design tends to be complex and deeper [53]. The neural network architecture design procedure relies more on the expertise [54]. Manually tuning the network parameters is a lengthy and repetitive process, making it challenging to identify the optimal settings [55]. Researchers have proposed realizing automated searches of the structural parameters of GANs via NAS. Three key elements make up NAS: the search space, search strategy, and performance estimation. The search process requires constructing a search space and then iteratively generating network architectures as candidates using a search strategy. Candidate architectures are evaluated with performance assessment methods, ultimately leading to the automatic selection of the optimal neural network design.
The early NAS methods were primarily developed based on RL. Methods such as AutoGAN [56] and AGAN [57] focused on employing the recurrent neural network (RNN) controller to steer the search process, accelerating the process via parameter sharing and dynamic resetting, and then rewarding the controller with the inception score (IS) of the neural network architecture, iteratively searching for the optimal structure. Unfortunately, these schemes are highly time consuming. To solve this issue and boost search efficiency, the work of [58–60] introduced the continuous relaxation (CR) search space to explore the convolutional cell structures of the generator and the discriminator in a differentiable way. The network architecture parameters are transformed into continuous variables, eliminating the need for brute-force searching of all discrete architectures. This allows the optimal GAN architecture to be efficiently found using gradient descent, considerably reducing time. CycleGANAS [61] conducted a more in-depth study by replacing the convolutional cell in AdversarialNAS [60] with a ResNet cell and employing single-level joint optimization to search for the neural network architecture and weights. This approach successfully stabilizes the search for a high-performance CycleGAN architecture, even in the presence of data imbalance.
Methods above have successfully automated the construction of generator and discriminator architectures; however, they do not address improvements to the adversarial mechanism of GANs. As a result, these methods are susceptible to local optima, exhibit poor training stability, and lack support for multiobjective optimization [62]. The work of [63] introduces evolutionary algorithms into NAS and employs many-to-one and one-to-one training strategies to optimize both the generator and discriminator, effectively improving the stability of GAN training and mitigating the issue of mode collapse. EAS-GAN [64] proposed an NAS strategy based on the evolutionary algorithm, integrating the generator evolution mechanism of evolutionary GAN [65] with NAS and sampling the population on the generator supernet to construct the population. The discriminator evaluates and retains the best offspring, thereby evolving a better architecture and weights. EGANS [9] further improves the above method by utilizing a collaborative dual evolution strategy under a unified evolutionary adversarial framework. It searches for the optimal generator and discriminator architectures, enhancing the adaptability and stability of GAN in zero-shot learning.
Generators and discriminators frequently encounter multiple objective functions that conflict with each other, making it impossible to merge them into a single objective problem. The method of selecting offspring from multiple variants based on evolutionary NAS improves the training stability of GANs yet leaves the multiobjective problem unresolved. MO-EGAN [66] formulates the training of GAN's generator as a multiobjective optimization problem, optimizing 2 conflicting objectives: quality and diversity. It employs the Pareto dominance method for selection, improving the traditional EGAN and demonstrating outstanding performance in terms of generated sample quality and diversity. In [54], evolutionary weight-sharing GANs (EWSGAN) were introduced, advancing the field with a 2-stage NAS process where the first stage trains the supernet and the second stage applies multiobjective evolutionary NAS to find the optimal subnet. This method effectively reduces the search space and improves the search speed. The strengths and limitations of the respective methods are comparatively outlined in Table 3.
Motivations and contributions
We focus on generative artificial neural networks in the Metaverse, aiming to automate the construction of GAN-based Metaverse NID through NAS. This method utilizes the GAN's generator to produce samples for minority classes, tackling the data imbalance issue in existing Metaverse NID datasets while aiming to strike an optimal balance between detection accuracy and real-time performance on Metaverse devices. The primary contributions of this study include:
a

To address the data imbalance issue in the Metaverse, we propose inversely proportional hybrid attention LSTM-GAN (IPHA LSTM-GAN) for feature extraction and minority class sample generation. LSTM is introduced to capture long-term dependencies in network traffic time series, whereas MSA is utilized to enhance the ability to extract global–local relationships. Furthermore, an inversely proportional generation (IPG) strategy based on cross-attention is adopted for noise-label fusion and minority class sample generation, improving the problem of data imbalance.

b

Unlike existing NAS algorithms, which focus on evolving architectures for sampled subnets, we introduce a novel adaptive evolutionary strategy to enhance the training stability in the Metaverse NID with GANs. Multiple mutation operators are applied simultaneously to the supernet, and through evaluation and selection, it retains the mutated supernet offspring architectures of the generator and discriminator with high accuracy. Automating the selection of evolutionary directions for the generator and discriminator supernets enhances the training stability of the Metaverse NID GAN.

c

To optimize multiple objectives in the Metaverse NID, a double mutation multiobjective evolutionary NAS algorithm is proposed. After applying multiple mutation operators to the supernet, the double mutation sampling (DMS) method combined with max, random, crossover, and mutation sampling strategies is used to obtain the subnet population, which helps to increase the diversity of the population. A multiobjective evaluation is then performed on the populations of generator and discriminator subnets, with nondominated solutions selected for cross-validation, thereby facilitating the search for the optimal architectures of the generator and discriminator within the GAN.

Materials and Methods
Less
The overall framework of the proposed Metaverse intrusion detection algorithm is illustrated in Fig. 1. The algorithm deploys the candidate blocks of AME-GAN on the Metaverse device to measure the actual computational latency, which is fed back to AME-GAN for the multiobjective evolution of the generator supernet and the discriminator supernet. The automated search process then produces a GAN-based intrusion detection model comprising a generator and a discriminator. The model will be deployed on Metaverse devices to distinguish between normal and malicious traffic during data exchange with other devices, thereby blocking malicious access. As shown at the bottom of Fig. 1, the AME-GAN specifically consists of IPHA LSTM-GAN, a GAN-based supernet adaptive evolutionary strategy, and a double mutation multiobjective NAS (DMM NAS). IPHA LSTM-GAN is the intrusion detection model we aim to search for, which will be constructed as a generator supernet and a discriminator supernet. These 2 supernets will then mutate into multiple mutated supernets. The supernet adaptive evolutionary strategy (SAES) selects the best generator supernet and the best discriminator supernet based on their accuracy, stabilizing the GAN training process. DMM NAS employs DMS to sample both generators and discriminators and uses NSGA-II for multiobjective optimization to obtain nondominated models. Fuzzy decision-making is then used to construct the final intrusion detection model. The NSL-KDD dataset, UNSW-NB15 dataset, and CIC-IDS2017 dataset are then used to verify the performance of the algorithm.
Inversely proportional hybrid attention LSTM-GAN
The IPHA LSTM-GAN consists of 2 key components. As shown in Fig. 2, the first component is a hybrid attention LSTM-GAN (HA LSTM-GAN), which is used for feature extraction from network traffic sequences and specific class sample generation; the other component is an IPG strategy that increases the proportion of minority classes to balance the dataset. The combination of these 2 components helps to improve the low detection accuracy caused by the data imbalance issue.
Hybrid attention LSTM-GAN architecture
The overall structure of the HA LSTM-GAN is depicted in Fig. 2. Since the Metaverse NID takes network traffic time series as input for feature learning, and LSTM proves its effectiveness in modeling long-term dependencies of network traffic time series, we introduced BiLSTM into the generator and the discriminator of the GAN to compensate for the lack of temporal feature support in the original GAN. In terms of spatial features, HA LSTM-GAN adopts MSA of transformer block (TB) to strengthen global–local feature learning capabilities, enhancing the original GAN's reliance on CNN's local feature learning, and incorporating global temporal features. The combination of BiLSTM and MSA improves the spatiotemporal feature learning capability of the original GAN, leveraging the training stability as well.
The original GAN takes a normally distributed noise as input for sample generation. The generated sample categories are random and cannot be specified. For specific minority class sample generation, we construct the cross-attention mechanism (CAM) module to modify the generator architecture, so that the generator can take noise and labels as inputs, generating specific class samples, thereby avoiding the constraints of sample random generation of the generator and alleviating the dataset imbalance issue. The definition of the cross-attention function is calculated as follows:
CrossAttention ( q l , k n , v n ) = Soft max ( q l k n T d k ) v l
where q l indicates the query of the input label. k n and v n indicate the key and value of the input noise. The CAM maintains the computational method of the original self-attention mechanism but replaces the query, key, and value from the same input with a different combination from different inputs. This method integrates multiple attention mechanisms, laying a theoretical foundation for the generation of specific class samples.
Inversely proportional generation
The training datasets of the Metaverse NID commonly suffer from the issue of data imbalance, and the synthetic minority oversampling technique (SMOTE) oversampling method is typically used to overcome the imbalance; however, the newly generated samples often resemble similar classes, leading to blurring of the class boundaries and reducing the detection efficiency. We propose the IPG method, as shown in Fig. 2. By calculating the inverse proportion of each class in the dataset, the generator generates samples based on this proportion, which increases the proportion of the minority classes and reduces that of major classes. The data imbalance issue is then improved. The IPG functions are described in Eqs. 3 and 4.
∑ 1 n p c i = 1 , i ∈ { 1 , 2 , ⋯ , n }
p c i ′ = ln 1 p c i ∑ 1 n ln 1 p c i , i ∈ { 1 , 2 , ⋯ , n }
where c i denotes the ith class of the dataset, n denotes the number of classes, p c i indicates the proportion of c i in the dataset, and p c i ′ indicates the inverse proportion of c i.
The IPG guides the GAN's generator to produce more samples from the minority class and fewer from the majority class, enriching the feature learning set for the discriminator and helping to address the low detection accuracy caused by the data imbalance in the original dataset.
GAN-based supernet adaptive evolutionary strategy
Search space and supernet
The NAS we proposed follows the same idea of CR as in FBNet [59] to construct a search space for TB structure parameters. This allows us to update both the candidate block weights and layer parameters through backpropagation in a differentiable way and explore the generator and discriminator architectures of the HA LSTM-GAN with high efficiency. As depicted in Fig. 2, the generator and the discriminator contain l n and l m TBs, respectively. Notably, the numbers of l n and l m do not need to be consistent.
In the process of architecture searching, exploring as many hyperparameter combinations as possible is the better solution, but more combinations make the search space size of the supernet grow exponentially and substantially increase the search time. The performance gain for the final architecture is also not as obvious as expected. Considering the computational limitations of devices, we aim to search for the lightweighted neural networks. The search focuses on the head and feedforward dimension (ff-dim) parameters within the TB structure. The values for these parameters are [4, 8, 16] for the head and [32, 64, 128, 256, 512] for ff-dim, resulting in a total of 15 candidate blocks. In addition, to reduce the unnecessary TBs in the generator and discriminator, a skip operator is added starting from the second TB, allowing the model to skip the current TB while ensuring that at least one TB is included for feature extraction. We construct a supernet for both the generator and the discriminator via these 16 candidate blocks, forming a search space of size 15 2 × 16 l n + l m − 2. The detailed TB parameters are shown in Table 4.
Supernet adaptive evolutionary strategy
Existing NAS algorithms typically evolve sampled subnets. We evolve not only the sampled subnet but also the supernet by introducing SAES based on GANs. As depicted in Fig. 3 (stage 2), our strategy utilizes minimax, least-squares, Wasserstein, and hinge loss operators to mutate the supernet and generate offspring. The mutation of the supernet is driven by the loss function, which is computed by calculating the generator and discriminator supernet losses and performing gradient backpropagation. This paper introduces 4 mutation operators, allowing the generator and discriminator supernets to each produce 4 mutated offsprings. The specific loss functions for these operators are detailed below. Subsequently, the offspring are evaluated by calculating the generation accuracy of the generator offsprings and the training accuracy of the discriminator offsprings. The generation and training accuracy is then sorted respectively, with the top-performing model selected. The mutation directions for both the generator and discriminator supernets are automatically determined, resulting in more robust and stable GAN training.

Minimax mutation: This mutation corresponds to the minimax objective function in the original GAN [35], where the loss function defines a zero-sum game between the generator G and discriminator D. The generator produces samples to fit the real data from a specific class, while the discriminator seeks to identify both the authentic samples and generated samples. Unfortunately, the generator often produces samples that are concentrated in a few modes under this mutation, leading to mode collapse. The objective functions are defined as follows:

L D Minimax = 𝔼 x ∼ p data ( x ) [ log D x ] + 𝔼 n ∼ p n ( n ) [ log 1 − D G n ]
L G Minimax = 𝔼 n ∼ p n ( n ) [ log 1 − D G n ]
Here, D ( x ) denotes the discriminator's output for the real sample x, while G ( n ) denotes the new sample generated by the generator from the random noise n. 𝔼 x ∼ p data ( x ) refers to the expectation of data sampled from the real data distribution p data, while 𝔼 n ∼ p n ( n ) refers to that from the noise distribution p n. As D improves its ability to distinguish, it is easier to identify the samples G ( n ) generated by G and the value of D ( G n ) approaches 0. Consequently, the cross-entropy objective function L D Minimax of D progressively increases. In contrast, as G improves its generation ability, it becomes more difficult to distinguish the new sample and the value of D ( G n ) approaches 1, and the objective function L G Minimax of G decreases.

Least-squares mutation: Least-squares mutation is derived from least-squares GAN (LSGAN) [67], which uses the least-squares objective function ( D x − n real ) 2 to provide larger gradients. This helps alleviate the vanishing gradient problem that occurs when D ( G ( n ) approaches 0 during minimax mutation in the original GAN. By doing so, it resolves the issue of generator weight updates, reduces the occurrence of mode collapse, and accelerates the training process. The objective functions are defined as follows:

L G Least - Square = 𝔼 x ∼ p data ( x ) [ D x − N real 2 ] + 𝔼 n ∼ p n ( n ) [ D G n − N n e w 2 ]
L G Least - Square = 𝔼 n ∼ p n n D G n − N encoding 2
where N real and N n e w denote the class encoding numbers of the real sample and the new sample, respectively, and N encoding denotes the encoding number of the sample that the generator is expected to produce.

Wasserstein mutation: Originating from the Wasserstein GAN (WGAN) [68], this mutation assesses the discrepancy between the distributions of real and generated data using Wasserstein distance. This approach effectively addresses the limitation in the original GAN, where the nonoverlapping distributions between real and generated data cause the Jensen–Shannon divergence to lead to gradient vanishing, hindering the backpropagation and weight updates in the original GAN. The objective functions are defined as follows:

L D Wasserstein = 𝔼 x ∼ p data x D x + 𝔼 n ∼ p n n D G n
L G Wasserstein = 𝔼 z ∼ p z z D G z

Hinge mutation: By combining the hinge loss with the original GAN [69], this mutation can provide stable gradient updates and a training process by constraining the growth of the objective function. The discriminator's objective value exists when the discriminator output D ( x ) for a real sample is less than 1 and that for the generated sample G n is greater than −1. Otherwise, the value of the objective function equals 0, causing the gradient to vanish. The objective functions are described as follows:

L G Hinge = 𝔼 x ∼ p data ( x ) [ max 0 1 − D x ] + 𝔼 n ∼ p n ( n ) [ max 0 1 + D G n ]
L G Hinge = 𝔼 n ∼ p n ( n ) [ D G n ]

SAES is mainly used in stage 2 (model pretraining) of the NAS framework to improve the stability of the subsequent search process and accelerate the convergence speed. In this process, only the layer parameters are trained in this process, with no updates to the candidate block weights. In the process, the discriminator supernet takes the generated samples of the randomly initialized generator supernet as inputs. The discriminator supernet is then duplicated into multiple copies, each of which is mutated by the mutation operator mentioned above to generate the supernet offspring. We evaluate the detection accuracy of all mutated offsprings, keeping the highest one for the next iteration. The generator supernet uses the same method to obtain offspring. These offspring are evaluated with the same noise to generate samples, and their generative accuracy is calculated using the previously retained discriminator, keeping the highest one for the next iteration.
Double mutation multiobjective NAS
Optimization objectives
The Metaverse NID we proposed has 3 purposes: improving dataset imbalance, searching for light-weighted neural network architectures, and enhancing the detection accuracy, which means that the Metaverse NID is not a single-objective problem and that multiple optimization objectives need to be set. Since the discriminator of the GAN is responsible for identifying the normal and malicious traffic in the Metaverse NID, it is important to set the detection accuracy as one of the optimization objectives. Moreover, non-real-time Metaverse NID makes no sense for Metaverse devices, and the actual computational latency of Metaverse devices is often ignored; hence, the computational latency is also required as an optimization objective. While the generator in GANs excels at generating accurate samples, batch production often results in similar samples, limiting the diversity of newly generated data and hindering the practical use of this technology. Therefore, we optimize the NAS process with the following objectives: detection accuracy and computational latency of the discriminator, and generative accuracy and diversity of the generator. The discriminator and generator multiobjective optimization problems can be described as follows:
max F D i s x = f D i s Accu x f D i s L a t x T subject to: 0 ≤ f D i s Accu x ≤ 1 , f D i s L a t x > 0 , x ∈ X
max F G e n x = f G e n Accu x f G e n D i v x T subject to: 0 ≤ f G e n Accu x ≤ 1 , f G e n D i v x > 0 , x ∈ X
where the detection accuracy f D i s Accu ( x ) and the generative accuracy f G e n Accu ( x ) are obtained by feeding x into the discriminator of the IPHA LSTM-GAN. The computational latency f D i s L a t ( x ) is calculated by accumulating the average computational latency of each candidate block. The average computational latency is acquired by deploying the candidate blocks on the target Metaverse device and measuring the runtime over multiple runs. The diversity f G e n D i v ( x ) is improved by IS, which achieves the goal of minimizing the increase in computational cost. The latency and diversity function can be described as follows:
f D i s L a t x = 1 t L a t
f G e n D i v ( x ) = exp 1 N , ∑ i = 1 N , D K L , p y x i ‖ p y 1 N ∑ i = 1 N ( P E x i − P E x real ) 2
where t L a t denotes the average computational latency. x i denotes the ith generated sample, and x real denotes the real sample. N denotes the batch size, and p ( y , x i ) represents the conditional class distribution obtained by the discriminator after classifying the generated sample x i, p ( y ) denotes the marginal class distribution of all generated samples, P E ( x i ) denotes the relative positional encoding vector of x i, and D K L ( p y x i ‖ p y ) calculates the Kullback–Leibler (KL) divergence between the conditional class distribution p ( y , x i ) of the generated sample x i and the marginal distribution p ( y ). The generator diversity function enhances the reliability of diversity evaluation by introducing the relative positional distance between real and generated samples.
Double mutation NAS
Figure 4 illustrates the DMS-based double mutation NAS (DM NAS) algorithm, which is primarily applied in stage 3 for weight training. The training method in this stage is very similar to that in stage 2. The difference is that a sampling operation is added after supernet mutation. This enables the construction of a subnet population by applying the DMS. The mutated supernet with the largest nondominated solution set is retained as the optimal supernet after multiobjective evaluation and selection. Moreover, the generator and discriminator subnets with the highest generative/detection accuracy are also obtained in this process, which are used for the cross-validation of the generator and discriminator subnets in the next iteration. Through repeated iterations, the nondominated sets of discriminator and generator subnets are eventually obtained. A fuzzy decision-making method, using the triangular membership function and weighted average technique, is applied to select the best discriminator and generator from the nondominated sets. The GAN architecture is then searched. Fine-tuning the optimized GAN model produces a final model that can be deployed on Metaverse devices.
We utilize the CR of candidate blocks for NAS, aiming to search for the optimal candidate block with the highest weight. By sampling each layer's optimal candidate block through max sampling, the generator and discriminator subnets are constructed. However, weight maximization does not always reliably select candidate modules that accurately reflect the optimal performance when the network has not converged. In this regard, we sample the mutated generator and discriminator supernet with a DMS that combines multiple sampling methods of max sampling, random sampling, crossover sampling, and mutation sampling.
a

Max sampling: Selects the candidate blocks with the highest weight in each layer.

b

Random sampling: Randomly selects any candidate block in the layer.

c

Crossover sampling: Crosses over a gene segment between positions a and b (where a > b) from the gene sequences of any 2 optimal subnets in the previous iteration to generate 2 new subnets.

d

Mutation sampling: Mutate a gene at any position within the gene sequence of one optimal subnet in the previous iteration to form a new subnet.

Algorithm 1 provides the pseudocode for the DMS. When training enters the stage 3 (weight training phase), subnet sampling begins. First, one subnet is sampled via the max sampling method. Then, additional subnets are sampled to build the population by randomly choosing one of the following 2 schemes: (a) select any 2 individuals from the nondominated solution set in the previous iteration, perform crossover sampling to generate 2 new individuals, and then use the random sampling to sample N − 3 additional individuals; (b) select any one individual from the nondominated solution set in the previous iteration, generate a new individual via the mutation sampling, and then use the random sampling method to sample N − 2 additional individuals. In this way, the population with new individuals is constructed in each iteration.
Datasets
The experiments were conducted on the NSL-KDD, UNSW-NB15 [70], and CIC-IDS2017 datasets, where the issue of data imbalance is prominent in all 3.
NSL-KDD dataset
The NSL-KDD dataset, an enhanced version of the KDD CUP 99 dataset, is specifically designed for NID research. While the KDD CUP 99 dataset is based on the DARPA98 network traffic data, it has faced considerable criticism due to issues such as data redundancy and imbalance, which hinder the effectiveness of NID research. The NSL-KDD dataset reduces the amount of duplicated data and balances the samples, enhancing the effectiveness and consistency of model evaluation and making itself an essential benchmark for NID algorithms. The dataset has 41 features, with the training subset containing 22 known attack types and 17 more unknown attack types than the test subset. All the data are categorized into 5 main classes. Detailed information about the NSL-KDD is shown in Table 5.
UNSW-NB15 dataset
Developed by the Australian Centre for Cyber Security, the UNSW-NB15 dataset offers a comprehensive collection of normal traffic and various attack types from modern network environments, making it an essential benchmark for NID research. The dataset is generated by the IXIA PerfectStorm tool, contains 42 features, and covers 10 main classes. The detailed information about the UNSW-NB15 dataset is shown in Table 5.
CIC-IDS2017 dataset
The CIC-IDS2017 dataset, developed in collaboration between the Communications Security Establishment (CSE) and the Canadian Institute for Cybersecurity (CIC), serves as a valuable resource for NID research. It contains a collection of contemporary attack scenarios based on real-world network traffic data. It has 79 features and covers 15 main classes. The detailed information about the CIC-IDS2017 dataset is shown in Table 5.
Implementation settings
Implementation platform
The hardware platform used in the experiments of this paper contains an Intel Xeon(R) Platinum 8352V CPU, 40 GB of RAM, and an Nvidia GeForce RTX 3090 discrete graphics card with 24 GB of VRAM. The software platform is based on the 64-bit Ubuntu 20.04.6 LTS operating system.
Dataset preprocessing
The datasets mentioned above provide data types that include integer features, float features, Boolean features, and categorical features. Since the neural network of the Metaverse NID cannot handle the data with a variety of data types, all the data must be transferred into the float32 data type to be compatible with the DNN frameworks.
To this end, the dataset preprocessing begins with data cleaning. Columns with all 0s are regarded as irrelevant features, and rows containing NaN or INF are considered as error data. Dropping all these data cuts down the amount of training data. Later, the text data of categorical features are converted into numeric data via one-hot encoding. Although it increases the number of features, this method converts each category into an independent binary vector, enabling the machine learning model to correctly handle categorical data and avoid misinterpreting the relationships between categories. All numeric data are then normalized to the range of [0, 1] using min-max normalization, ensuring that features with larger ranges do not dominate the learning process, thus avoiding overfitting and improving the convergence speed during model training. Furthermore, the NSL-KDD and UNSW-NB15 datasets come pre-split into training and testing subsets, with each subset stored in its own file. We use the training subset for model training and the remaining portion for validation. However, CIC-IDS2017 consists of 7 network traffic files and does not provide a predefined split between the training set and the test set. To expedite model performance evaluation on this large-scale dataset, we randomly select 1% of the data as the test subset, with the remaining 99% used for training.
Results
Less
Evaluation metrics
We evaluate the performance of the proposed algorithm using accuracy (ACC), precision (PRC), recall (RCL), and F1 score (F1), which are standard metrics in NID algorithms. These metrics are based on false negatives (FN), false positives (FP), true positives (TP), and true negatives (TN), which can be calculated as follows:
Accuracy = T P + T N T P + T N + F P + F N
Precision = T P T P + F P
Recall = T P T P + F N
F 1 − score = Precision × Recall Precision + Recall × 2
Comparison with state-of-the-art methods
This section aims to compare our approach with other NID algorithms. However, we have not yet determined the exact number of TB to search for in the model. While adding more TB modules theoretically benefits model performance, the high computational cost of the attention mechanism implies that stacking excessive TBs results in a substantial expansion of the NAS search space, severely affecting the algorithm's convergence speed. Furthermore, adding more TB modules in the later stages results in diminishing returns in terms of performance improvement. To address this, we conducted experiments on each dataset using a multi-layer stacking method to identify the optimal number of TB modules for each dataset.
Table 6 displays the accuracy results. An increase in the number of TB layers does not lead to a continuous improvement in accuracy. The accuracy of NSL-KDD and UNSW-NB15 stops increasing when the TB layer reaches 5. In the CIC-IDS2017 dataset, accuracy shows a slight decline at 4 network layers and a notable decrease at 6 layers. Due to the presence of the skip option in the TB candidate blocks, a larger TB layer number allows NAS to reduce redundant computation through skipping. Therefore, to ensure that the network achieves its maximum performance, we increased the number of layers from the optimal configuration and set the number of TB layers to 6.
After determining the number of TBs, we compare our method with a variety of NID algorithms based on typical and multiobjective evolutionary schemes. All the algorithms are trained and tested on the NSL-KDD, UNSW-NB15, and CIC-IDS2017 datasets. The typical NID algorithms include representative models such as CNN-BiLSTM [19], BiDLSTM [18], BiLSTM-DNN [27], ABD [27], CANet [26], and FlowTransformer [29] in recent years. The multiobjective evolutionary intrusion detection algorithms include MECNN [71], EvoBMF [72], and MENAS [73]. All the neural network models were retrained based on the corresponding dataset to ensure fairness in comparison.
We use the training subsets of all these datasets for the training of the Metaverse NID models and validate the models on the test subsets. Table 7 shows the results of all evaluation metrics of all the algorithms including the competitors and our algorithm. As shown in the table, our method is superior in almost all the evaluation metrics mentioned above. The detection accuracies reach 79.17%, 77.97%, and 99.75%. The typical NID algorithms mainly utilize the combinations of CNNs, BiLSTM, and Transformers to enhance model performance, which we also utilize. Additionally, we propose DM NAS, and the results prove its positive impact on enhancing the performance of the Metaverse NID. Compared with the multiobjective evolution-based NID algorithms, all algorithms including ours use the same fast nondominated sorting to select the optimal solutions in multiobjective optimization. However, the competitors search for the CNN-only neural network models, which lack the spatiotemporal feature learning capabilities provided by BiLSTM and Transformer. The result shows the advantages of our HA LSTM-GAN with BiLSTM and Transformer introduced. Furthermore‌, the advantage is evident on all datasets, indicating that our method possesses a certain degree of generalization capability.
Model diversity comparison
To determine how the DMS method enhances model diversity compared with max sampling, we provide max sampling results and DMS results from the multi-class classification experiments on the datasets mentioned above. The results are shown in Figs. 5 to 7. All figures contain subplots A and B, which are nondominated set plots of the optimization objectives for the max sampling and DMS. Notably, the vertical and horizontal axes represent the sample generative accuracy and diversity of the generator in subplot A, whereas in subplot B, the axes represent the detection accuracy of the discriminator and the reciprocal of the discriminator computational latency, respectively. Higher values of these metrics indicate better performance; thus, the upper-right points indicate superior overall performance. The upper-right DMS points consistently occupy a dominant position compared to the max sampling points. To provide a more intuitive comparison of the performance between the max sampling and DMS methods, we calculate the hypervolume (HV) metric for the nondominated solution sets generated by these 2 approaches. Table 8 shows that the proposed DMS sampling method results in higher HV values for these datasets. The findings confirm that DMS increases sampling diversity and facilitates the search for improved subnet architectures.
Figures 5 to 7 show the optimal generator and discriminator obtained via fuzzy decision-making. The specific structures of these neural network architectures are illustrated in Fig. 8. As shown in Fig. 8 A to C, the final GAN architecture searched from the nondominated solutions of DMM NAS via the fuzzy decision-making method skips specific TBs, which helps reduce redundant computations and achieve the optimal balance between model performance and speed.
Ablation studies
This section presents the ablation studies of the modules proposed in this paper. To ensure the rigor of the experiments, the parameter settings of the layer number, layer architecture, etc., in the models are kept consistent with those of the previous experiment across all tests. The number of training iterations, optimizer selection, and data preprocessing steps remains the same.
The ablation study results of the multi-class detection accuracy are shown in Fig. 9. As the number of modules increases, the detection accuracy tends to increase on all the datasets. Comparing the baseline BiLSTM model with the model that includes the Transformer module, the detection accuracy increased by 0.68%, 0.05%, and 0.03% on their respective datasets, revealing that the integration of the attention mechanism in the Transformer enhances the spatiotemporal feature extraction of the Metaverse network traffic. The IPG module improves the detection accuracy on NSL-KDD, UNSW-NB15, and CIC-IDS2017 by 0.90%, 0.32%, and 0.12%, respectively, indicating that the setup of the IPG-based generator helps address the data imbalance issues to improve detection accuracy. Finally, we test the DMM NAS module, and the detection accuracy increases by 0.86%, 2.90%, and 0.39% and up to 79.17%, 77.97%, and 99.75%, respectively. These results validate that our approach effectively enhances the detection accuracy.
The ablation study results of the calculation latency are shown in Fig. 10. The curves for calculation latency differ from those for multi-class detection accuracy as the number of modules increases. Due to the significant consumption of computational resources by the attention mechanism, the introduction of the Transformer module improves model accuracy but also increases computational latency. In contrast, the IPG module improves the distribution of the generator's sample categories, balancing the minority class data in the training set, which enhances the recognition accuracy. Since this module adjusts only the distribution of the input noise and does not alter the model architecture, its computational latency is comparable to that of the Transformer module. The introduction of the DMM NAS module combines SAES, multiobjective optimization, and NAS, optimizing for both recognition accuracy and computational latency. This enables the search for a nondominated solution set that achieves a good balance between performance and speed. By employing a fuzzy decision method based on the triangular membership function and the weighted average method, the membership matrix is obtained, which is then multiplied by the weighted average matrix to obtain the defuzzification results. Thus, the DMM NAS module can automatically compute and select the optimal solution. The final model obtained through the search optimizes the computational latency introduced by the IPG module and enhances the detection performance.
Discussion
Less
The deployment of the GAN-based Metaverse NID in this paper benefits from the computational latency provided by the Metaverse device and the AME-GAN on the server side. After determining the basic architecture of the Metaverse NID neural network, the network layers and their candidate blocks will be deployed on the Metaverse device to obtain the real computational latency. To achieve the optimal balance between speed and accuracy of the Metaverse NID, the obtained real computational latency will be applied to the AME-GAN on the server side. The AME-GAN takes the actual computational capabilities of Metaverse devices into account. The IPG strategy of the IPHA LSTM-GAN can generate specific class samples, addressing the randomization flaw in GAN sample generation and the data imbalance issue. The SAES enables the supernet to mutate and generate multiple mutated supernet offspring and adaptively chooses the mutation direction, providing a more robust and stable training. The DMM NAS demonstrates its superiority in enhancing subnet population diversity and optimizing the search for the optimal model. The final optimal model will then be integrated into Metaverse devices for real-time Metaverse traffic monitoring.
Unfortunately, some research limitations remain, requiring further refinement and enhancement. Although the AME-GAN successfully performs the search for the generator and discriminator architectures within a multiobjective GAN framework, it restricts the search to the feature extraction network only, instead of all network layers, to reduce the NAS search space. While the DMS improves the diversity of the sampled subnet population, it also incurs higher computational costs and time consumption. Future work will focus on improving the sampled subnet diversity while reducing its number through methods such as decision variable grouping, achieving similar or improved Metaverse NID performance with minimal increases in search time consumption. Moreover, techniques such as model compression, quantization, and edge computing could be utilized to optimize the deployment of the Metaverse NID model, enabling its efficient operation even on devices with limited hardware capabilities.
Funding
Less
  • National Key R&D Program of China(2023YFB4503000)
  • National Natural Science Foundation of China(62473129)
  • Natural Science Fund of Hebei Province for Distinguished Young Scholars(F2021202010)
  • S&T Program of Hebei(24464401D)
  • Interdisciplinary Postgraduate Training Program of Hebei University of Technology(HEBUT-Y-XKJC-2022116)
  • Science and Technology Project of Hebei Education Department(JZX2023007)
References
Less
1.
Chen M, Liu M, Wang C, Song X, Zhang Z, Xie Y, Wang L. Cross-modal graph semantic communication assisted by generative AI in the metaverse for 6G. Research. 2024;7:0342.
2.
Kumar A, Shankar A, Behl A, Gupta BB, Mavuri S. Lights, camera, metaverse!: Eliciting intention to use industrial metaverse, organizational agility, and firm performance. J Global Inform Manage. 2023;31(8):1–20.
3.
Upadhyay U, Kumar A, Sharma G, Saini AK, Arya V, Gaurav A, Chui KT. Mitigating risks in the cloud-based metaverse access control strategies and techniques. Int J Cloud Appl Comput. 2024;14(1):1–30.
4.
Aldweesh A, Alauthman M, Al Khaldy M, Ishtaiwi A, Al-Qerem A, Almoman A, Gupta BB. The meta-fusion: A cloud-integrated study on blockchain technology enabling secure and efficient virtual worlds. Int J Cloud Appl Comput. 2023;13(1):1–24.
5.
Halvorsen J, Izurieta C, Cai H, Gebremedhin A. Applying generative machine learning to intrusion detection: A systematic mapping study and review. ACM Comput Surv. 2024;56(10):1–33.
6.
Saied M, Guirguis S, Madbouly M. Review of artificial intelligence for enhancing intrusion detection in the internet of things. Eng Appl Artif Intell. 2024;127(Part A):107231.
7.
Kimanzi R, Kimanga P, Cherori D, Gikunda PK. Deep learning algorithms used in intrusion detection systems—A review. arXiv. 2024. https://doi.org/10.48550/arXiv.2402.17020.
8.
Radoglou-Grammatikis P I, Sarigiannidis P G. An anomaly-based intrusion detection system for the smart grid based on CART decision tree. Paper presented at: 2018 Global Information Infrastructure and Networking Symposium (GIIS); 2018 Oct 23-25; Thessaloniki, Greece.
9.
Chen S, Chen S, Hou W, Ding W, You X. EGANS: Evolutionary generative adversarial network search for zero-shot learning. IEEE Trans Evol Comput. 2023;28(3):582–596.
10.
Gaber T, Awotunde JB, Torky M, Ajagbe SA, Hammoudeh M, Li W. Metaverse-IDS: Deep learning-based intrusion detection system for Metaverse-IoT networks. Internet Things. 2023;24: Article 100977.
11.
Truong VT, Le LB. Security for the metaverse: Blockchain and machine learning techniques for intrusion detection. IEEE Netw. 2024;38(5):204–212.
12.
Bajpai SA, Patankar AB. A study on self-configuring intrusion detection model based on hybridized deep learning models. Paper presented at: 2023 7th International Conference on Computing Methodologies and Communication (ICCMC); 2023 Feb 23–25; Erode, India.
13.
Wang LH, Dai Q, Du T, Chen L. Lightweight intrusion detection model based on CNN and knowledge distillation. Appl Soft Comput. 2024;165: Article 112118.
14.
El-Ghamry A, Darwish A, Hassanien AE. An optimized CNN-based intrusion detection system for reducing risks in smart farming. Internet Things. 2023;22: Article 100709.
15.
Bamber SS, Katkuri AVR, Sharma S, Angurala M. A hybrid CNN-LSTM approach for intelligent cyber intrusion detection system. Comput Secur. 2025;148: Article 104146.
16.
Wang M, Yang N, Weng N. Securing a smart home with a transformer-based iot intrusion detection system. Electronics. 2023;12(9):2100.
17.
Lai Q, Xiong C, Chen J, Wang W, Chen J, Gadekallu TR, Cai M, Hu X. Improved transformer-based privacy-preserving architecture for intrusion detection in secure V2X communications. IEEE Trans Consum Electron. 2023;70(1):1810–1820.
18.
Pinto A, Herrera L-C, Donoso Y, Gutierrez JA. Survey on intrusion detection systems based on machine learning techniques for the protection of critical infrastructure. Sensors. 2023;23(5):2415.
19.
Abed RA, Hamza EK, Humaidi AJ. A modified CNN-IDS model for enhancing the efficacy of intrusion detection system. Meas Sens. 2024;35:101299.
20.
Hui B, Chiew KL. An improved network intrusion detection method based on cnn-lstm-sa. J Adv Res Appl Sci Eng Technol. 2025;44(1):225–238.
21.
Cui Z, Xue F, Cai X, Cao Y, Wang G, Chen J. Detection of malicious code variants based on deep learning. IEEE Trans Industr Inform. 2018;14(7):3187–3196.
22.
Chen L, Kuang X, Xu A, Suo S, Yang Y. A novel network intrusion detection system based on CNN. Paper presented at: 2020 Eighth International Conference on Advanced Cloud and Big Data (CBD); 2020 Dec 5–6; Taiyuan, China.
23.
Acharya T, Annamalai A, Chouikha MF. Efficacy of CNN-bidirectional LSTM hybrid model for network-based anomaly detection. Paper presented at: 2023 IEEE 13th Symposium on Computer Applications & Industrial Electronics (ISCAIE); 2023 May 20–21; Penang, Malaysia.
24.
Long Z, Yan H, Shen G, Zhang X, He H, Cheng L. A Transformer-based network intrusion detection approach for cloud security. J Cloud Comput. 2024;13(1):5.
25.
Ren K, Yuan S, Zhang C, Shi Y, Huang Z. CANET: A hierarchical CNN-attention model for network intrusion detection. Comput Commun. 2023;205:170–181.
26.
Tao Y, Zhang J, Wei L, Gao Y, Shi L. An intrusion detection model with attention and BiLSTM-DNN. Paper presented at: Proceedings of the 2023 2nd Asia Conference on Algorithms, Computing and Machine Learning; 2023; Shanghai, China.
27.
Araujo-Filho PF, Naili M, Kaddoum G, Fapi ET, Zhu Z. Unsupervised GAN-based Intrusion detection system using temporal convolutional networks and self-attention. IEEE Trans Netw Serv Manag. 2023;20(4):4951–4963.
28.
Manocchio LD, Layeghy S, Lo WW, Kulatilleke GK, Sarhan M, Portmann M. FlowTransformer: A transformer framework for flow-based network intrusion detection systems. Expert Syst Appl. 2024;241: Article 122564.
29.
Ali M, Udoidiok I, Li F, Zhang J. A review on generative intelligence in deep learning based network intrusion detection. Paper presented at: 2024 Cyber Awareness and Research Symposium (CARS); 2024; Grand Forks, ND, USA.
30.
Bedi P, Gupta N, Jindal V. Siam-IDS: Handling class imbalance problem in intrusion detection systems using Siamese neural network. Procedia Comput Sci. 2020;171:780–789.
31.
Bedi P, Gupta N, Jindal V. I-SiamIDS: An improved Siam-IDS for handling class imbalance in network-based intrusion detection systems. Appl Intell. 2021;51(2):1133–1151.
32.
Binsaeed KA, Hafez AM. Enhancing intrusion detection systems with XGBoost feature selection and deep learning approaches. Int J Adv Comput Sci Appl. 2023;14(5):1084–1098.
33.
Hu H, Cai Y, Hu Q, Zhang Y. A deep generative model with multiscale features enabled industrial internet of things for intelligent fault diagnosis of bearings. Research. 2023;6:0176.
34.
Zhao X, Fok KW, Thing VLL. Enhancing network intrusion detection performance using generative adversarial networks. Comput Secur. 2024;145: Article 104005.
35.
Goodfellow I, Pouget-Abadie J, Mirza M, Xu B, Warde-Farley D, Ozair S, Courville A, Bengio Y. Generative adversarial networks. Commun ACM. 2020;63(11):139–144.
36.
Zhang C, Yu S, Tian Z, Yu JJQ. Generative adversarial networks: A survey on attack and defense perspective. ACM Comput Surv. 2023;56(4):1–35.
37.
Al-Ajlan M, Ykhlef M. A review of generative adversarial networks for intrusion detection systems: Advances, challenges, and future directions. Comput Mater Con. 2024;81(2):2053.
38.
Aydin M A. Using generative adversarial networks for handling class imbalance problem. Paper presented at: 2021 29th Signal Processing and Communications Applications Conference (SIU); 2021 Jun 9–11; Istanbul, Turkey.
39.
Yang H, Zhou Y. IDA-GAN: A novel imbalanced data augmentation GAN. Paper presented at: 2020 25th International Conference on Pattern Recognition (ICPR); 2021 Jan 10–15; Milan, Italy.
40.
Ding H, Sun Y, Huang N, Shen Z, Cui X. TMG-GAN: Generative adversarial networks-based imbalanced learning for network intrusion detection. IEEE Trans Inf Forensics Secur. 2024;19:1156–1167.
41.
Elsheikh M, Shalaby M, Sobh MA, Bahaa-Eldin AM. Deep learning techniques for intrusion detection systems: A survey and comparative study. Paper presented at: 2023 International Mobile, Intelligent, and Ubiquitous Computing Conference (MIUCC); 2023 Sep 27–28; Cairo, Egypt.
42.
Lee J, Park K. GAN-based imbalanced data intrusion detection system. Pers Ubiquit Comput. 2021;25(1):121–128.
43.
Duy PT, Khoa NH, Do Hoang H, Pham V. Investigating on the robustness of flow-based intrusion detection system against adversarial samples using generative adversarial networks. J Inf Secur Appl. 2023;74: Article 103472.
44.
Mishra AK, Paliwal S, Srivastava G. Anomaly detection using deep convolutional generative adversarial networks in the internet of things. ISA Trans. 2024;145:493–504.
45.
Lin Z, Shi Y, Xue Z. IDSGAN: Generative adversarial networks for attack generation against intrusion detection. In: Gama J, Li T, Yu Y, Chen E, Zheng Y, Teng F, editors. Pacific-asia conference on knowledge discovery and data mining. Cham: Springer; 2022. p. 79–91.
46.
Arafah M, Phillips I, Adnane A, Hadi W, Alauthman M, Al-Banna A-K. Anomaly-based network intrusion detection using denoising autoencoder and Wasserstein GAN synthetic attacks. Appl Soft Comput. 2025;168: Article 112455.
47.
Constantin MG, Stanciu DC, Ştefan LD, Dogariu M, Mihăilescu D, Ciobanu G, Bergeron M, Liu W, Belov K, Radu O, et al. Exploring generative adversarial networks for augmenting network intrusion detection tasks. ACM Trans Multimed Comput Commun Appl. 2024;21(1):1–19.
48.
Luo H, Wan L. A recombination generative adversarial network for intrusion detection. Int J Appl Math Comput Sci. 2024;34(2):323–334.
49.
Upadhyay D, Luo Q, Manero J, Zaman M, Sampalli S. Comparative analysis of tabular generative adversarial network (GAN) models for generation and validation of power grid synthetic datasets. Paper presented at: IEEE EUROCON 2023—20th International Conference on Smart Technologies; 2023 Jul 6–8; Torino, Italy.
50.
Bhatt R, Indra G. Detecting the undetectable: GAN-based strategies for network intrusion detection. Int J Inf Technol. 2024;16(8):5231–5237.
51.
Hoang T-N, Kim D. Detecting in-vehicle intrusion via semi-supervised learning-based convolutional adversarial autoencoders. Veh Commun. 2022;38: Article 100520.
52.
Balaji S, Narayanan SS. Dynamic distributed generative adversarial network for intrusion detection system over internet of things. Wirel Netw. 2023;29(5):1949–1967.
53.
Ganepola VVV, Wirasingha T. Automating generative adversarial networks using neural architecture search: A review. Paper presented at: 2021 IEEE/International Conference on Emerging Smart Computing and Informatics (ESCI); 2021; Pune, India.
54.
Xue Y, Tong W, Neri F, Chen P, Luo T, Zhen L, Wang X. Evolutionary architecture search for generative adversarial networks based on weight sharing. IEEE Trans Evol Comput. 2024;28(3):653–667.
55.
Liu X, Li J, Zhao J, Cao B, Yan R, Lyu Z. Evolutionary neural architecture search and its applications in healthcare. Comput Model Eng Sci. 2023;139(1):143–185.
56.
Gong X, Chang S, Jiang Y, Wang Z. AutoGAN: Neural architecture search for generative adversarial networks. Paper presented at: 2019 IEEE/CVF International Conference on Computer Vision (ICCV); 2019 Oct 27–Nov 2; Seoul, South Korea.
57.
Wang H, Huan J. AGAN: Towards automated design of generative adversarial networks. arXiv. 2019. https://doi.org/10.48550/arXiv.1906.11080.
58.
Liu H, Simonyan K, Yang Y. DARTS: Differentiable architecture search. arXiv. 2018. https://doi.org/10.48550/arXiv.1806.09055.
59.
Wu B, Dai X, Zhang P, Wang Y, Sun F, Wu Y, Tian Y, Vajda P, Jia Y, Keutzer K. FBNet: Hardware-aware efficient ConvNet design via differentiable neur al architecture search. Paper presented at: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR); 2020; Long Beach, CA, USA.
60.
Gao C, Chen Y, Liu S, Tan Z, Yan S. AdversarialNAS: Adversarial neural architecture search for GANs. Paper presented at: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR); 2020; Seattle, WA, USA.
61.
An T, Joo C. CycleGANAS: Differentiable neural architecture search for CycleGAN. Paper presented at: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR); 2024; Seattle, WA, USA.
62.
Cao B, Lei H. LGEGAN: A lightweight evolutionary generative adversarial network with statistic global information. Paper presented at: 2023 42nd Chinese Control Conference (CCC); 2023 Jul 24–26; Tianjin, China.
63.
Ying G, He X, Gao B, Han B, Chu X. EAGAN: Efficient two-stage evolutionary architecture search for GANs. Paper presented at: European Conference on Computer Vision (ECCV); 2022 Oct 21; Tel-Aviv, Israel.
64.
Lin Q, Fang Z, Chen Y, Tan KC, Li Y. Evolutionary architectural search for generative adversarial networks. IEEE Trans Emerg Top Comput Intell. 2022;6(4):783–794.
65.
Wang C, Xu C, Yao X, Tao D. Evolutionary generative adversarial networks. IEEE Trans Evol Comput. 2019;23(6):921–934.
66.
Baioletti M, Coello C A C, Bari G D, Poggioni V. Multi-objective evolutionary GAN. Paper presented at: Proceedings of the 2020 Genetic and Evolutionary Computation Conference Companion; 2020; Cancún, Mexico.
67.
Mao X, Li Q, Xie H, Lau RYK, Wang Z, Paul Smolley S. Least squares generative adversarial networks. Paper presented at: Proceedings of the IEEE International Conference on Computer Vision (ICCV); 2017; Venice, Italy.
68.
Arjovsky M, Chintala S, Bottou L. Wasserstein generative adversarial networks. Paper presented at: Proceedings of Machine Learning Research; 2017; Sydney, Australia.
69.
Lim J H, Ye J C. Geometric GAN. arXiv. 2017. https://doi.org/10.48550/arXiv.1705.02894.
70.
Moustafa N, Slay J. UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Paper presented at: 2015 Military Communications and Information Systems Conference (MilCIS); 2015 Nov 10–12; Canberra, Australian Capital Territory, Australia.
71.
Chen Y, Lin Q, Wei W, Ji J, Wong K-C, Coello CAC. Intrusion detection using multi-objective evolutionary convolutional neural network for internet of things in fog computing. Knowl-Based Syst. 2022;244:Article 108505.
72.
Wei W, Chen Y, Lin Q, Ji J, Wong K-C, Li J. Multi-objective evolving long–short term memory networks with attention for network intrusion detection. Appl Soft Comput. 2023;139:Article 110216.
73.
Lin Q, Liu Z, Yang Y, Wong K-C, Lu Y, Li J. Multi-objective evolutionary neural architecture search for network intrusion detection. Swarm Evol Comput. 2024;91:101702.
Appendix
Less
Year 2025 volume 8 Issue 4
PDF
121
62
Cite this Article
BibTeX
Article Info
doi: 10.34133/research.0665
  • Receive Date：2024-12-22
  • Online Date：2025-07-23
  • Published：2025-04-15
Article Data
Affiliations
History
  • Received：2024-12-22
  • Revised：2025-03-12
  • Accepted：2025-03-15
Funding
National Key R&D Program of China(2023YFB4503000)
National Natural Science Foundation of China(62473129)
Natural Science Fund of Hebei Province for Distinguished Young Scholars(F2021202010)
S&T Program of Hebei(24464401D)
Interdisciplinary Postgraduate Training Program of Hebei University of Technology(HEBUT-Y-XKJC-2022116)
Science and Technology Project of Hebei Education Department(JZX2023007)
Affiliations
    1 State Key Laboratory of Reliability and Intelligence of Electrical Equipment, Hebei University of Technology, Tianjin 300401, China.
    2 School of Artificial Intelligence, Hebei University of Technology, Tianjin 300401, China.

Corresponding:

* Address correspondence to:
References
Share
https://castjournals.cast.org.cn/joweb/research/EN/10.34133/research.0665
Share to
QR

Scan QR to access full text

Cite this article
BibTeX
Citations
表12种不同金属材料的力学参数
科
Family		 属数
Number of
genus		 种数
Number of
species		 占总种数比例
Percentage of
total species (%)		 属
Genus		 种数
Number of
species		 占总种数比例
Percentage of total
species (%)
鹅膏菌科Amanitaceae 2 11 5.26 鹅膏菌属 Amanita 10 4.78
小菇科 Mycenaceae 2 12 5.74 丝盖伞属 Inocybe 5 2.39
多孔菌科 Polyporaceae 8 14 6.70 蜡蘑属 Laccaria 5 2.39
红菇科 Russulaceae 3 23 11.00 小皮伞属 Marasmius 6 2.87
小菇属 Mycena 11 5.26
光柄菇属 Pluteus 5 2.39
红菇属 Russula 17 8.13
栓菌属 Trametes 5 2.39
关闭全屏
  • BibTeX
  • EndNote
  • RefWorks
  • TxT
Links
Articles
Latest Articles
Most Read
Collections
Updates
Events
News
Multimedia
About
About Us
Contact
No. 86 Xueyuan South Road, Haidian District, Beijing
100081
010-62199257
qkjq@cast.org.cn

Copyright © 2025 China Association for Science and Technology. All rights reserved. For all open access content, the relevant licensing terms apply.
Sponsored by the Office of the Leading Group for Cybersecurity and Informatization of CAST, and supported by Science and Technology Review Publishing House