# Analysis and Detection against Network Attacks in the Overlapping Phenomenon of Behavior Attribute

arXiv: https://arxiv.org/abs/2310.10660 · HTML: https://mlsanity.com/paper/2310.10660/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 66 references that are in the map.
- First posted on arXiv 13 Sep 2023.

## Builds on (most cited first, 6 of 6)

- [Improved Training of Wasserstein GANs](https://mlsanity.com/paper/1704.00028/) (2017)
- [Learning Spatial Regularization with Image-level Supervisions for Multi-label Image Classification](https://mlsanity.com/paper/1702.05891/) (2017)
- [Collaboration based Multi-Label Learning](https://mlsanity.com/paper/1902.03047/) (2019)
- [Multi-Label Sentiment Analysis on 100 Languages with Dynamic Weighting for Label Imbalance](https://mlsanity.com/paper/2008.11573/) (2020)
- [Multi-Label Learning from Medical Plain Text with Convolutional Residual Models](https://mlsanity.com/paper/1801.05062/) (2018)
- [Android Malware Category and Family Detection and Identification using Machine Learning](https://mlsanity.com/paper/2107.01927/) (2021)

## Built on by (most cited first, 1 of 1)

- [MamNet: A Novel Hybrid Model for Time-Series Forecasting and Frequency Pattern Analysis in Network Traffic](https://mlsanity.com/paper/2507.00304/) (2025)

## Abstract (arXiv)

The proliferation of network attacks poses a significant threat. Researchers propose datasets for network attacks to support research in related fields. Then, many attack detection methods based on these datasets are proposed. These detection methods, whether two-classification or multi-classification, belong to single-label learning, i.e., only one label is given to each sample. However, we discover that there is a noteworthy phenomenon of behavior attribute overlap between attacks, The presentation of this phenomenon in a dataset is that there are multiple samples with the same features but different labels. In this paper, we verify the phenomenon in well-known datasets(UNSW-NB15, CCCS-CIC-AndMal-2020) and re-label these data. In addition, detecting network attacks in a multi-label manner can obtain more information, providing support for tracing the attack source and building IDS. Therefore, we propose a multi-label detection model based on deep learning, MLD-Model, in which Wasserstein-Generative-Adversarial- Network-with-Gradient-Penalty (WGAN-GP) with improved loss performs data enhancement to alleviate the class imbalance problem, and Auto-Encoder (AE) performs classifier parameter pre-training. Experimental results demonstrate that MLD-Model can achieve excellent classification performance. It can achieve F1=80.06% in UNSW-NB15 and F1=83.63% in CCCS-CIC-AndMal-2020. Especially, MLD-Model is 5.99%-7.97% higher in F1 compared with the related single-label methods.