# Open DGML: Intrusion Detection Based on Open-Domain Generation Meta-Learning
## 3 System Design
### Data Augmentation  
In the domain of intrusion detection, the challenge of imbalanced sample has been a major concern [28]. To counteract this issue, we introduce a robust data augmentation strategy that enhances the diversity of the training samples without the need for additional data, thereby improving the model's generalization capabilities. The vicinal risk minimization (VRM) concept can be used to describe the neighborhood of each training sample and generate additional virtual samples to expand the support for the training distribution [29]. Common data augmentation techniques comprise (1) geometric transformations [30; 31], including horizontal and vertical flips, random rotations, and scaling, which are especially efficacious for addressing direction-insensitive challenges such as image classification; and (2) pixel-based transformations that encompass color adjustments, padding, and the introduction of noise. For example, Francisco et al. [32] demonstrate that the incorporation of Gaussian noise into the samples leads to a measurable enhancement of 1.65% in accuracy across a spectrum of nine datasets sourced from the UCI repository. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Feature Name** & **Description** & **Type** & **Value Range** \\ \hline \multicolumn{5}{c}{Basic Features} \\ \hline
1 & Duration & Duration of the connection & Continuous & 0–54,451 \\
2 & Protocol\_Type & Protocol type & Categorical & TCP, UDP, ICMP, etc. \\
3 & Status & Connection status & Categorical & S0, SI, SH, etc. \\ \hline \multicolumn{5}{c}{Content Features} \\ \hline
4 & Src Bytes &
\begin{tabular}{c} Number of bytes sent by the \\ source \\ \end{tabular} & Continuous & 0–1,379,963,888 \\
5 & Dst Bytes &
\begin{tabular}{c} Number of bytes sent by the \\ destination \\ \end{tabular} & Continuous & 0–309,937,401 \\
6 & Connection &
\begin{tabular}{c} Number of connections to \\ the same host \\ \end{tabular} & Categorical & \{0, 1\} \\
7 & Land &
\begin{tabular}{c} If source and destination are \\ the same port \\ \end{tabular} & Categorical & \{0, 1\} \\
8 & Service & Network service & Categorical &
\begin{tabular}{c} aol, auth, bgp, \\ etc. \\ 0–3 \\ \end{tabular} \\
9 & Urgent & Number of urgent packets & Continuous & 0–3 \\ \hline \multicolumn{5}{c}{Flow Similarity Features} \\ \hline
10 & Count &
\begin{tabular}{c} Number of connections to \\ the same service \\ \end{tabular} & Continuous & 0–511 \\
11 & Logged\_failed & Login failure rate & Continuous & 0.00–1.00 \\
12 & Logged\_In & Login status & Categorical & [0, 1] \\
13 & Root\_Shell & Obtained root shell & Categorical & \{0, 1\} \\
14 & Error\_Rate & Error rate & Categorical & 0.00–1.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Flow characteristics and description. MixupOur approach harnesses the power of Mixup, an established technique for data augmentation that creates new samples by interpolating between existing ones. This method introduces a parameter \(\lambda\), which follows a Beta distribution, to control the interpolation strength between a pair of randomly selected samples \((x_{i},y_{i})\) and \((x_{j},y_{j})\). The resulting mixed sample \(\tilde{x}\) and its corresponding label \(\tilde{y}\) are given by  
\[\tilde{x} =\lambda x_{i}+(1-\lambda)x_{j},\] \[\tilde{y} =\lambda y_{i}+(1-\lambda)y_{j}.\]  
Similar methodologies include Cutout and CutMix. Cutout mitigates overfitting by randomly zeroing out portions of the input, while CutMix enhances robustness by swapping and blending patches between images. Mul-MixupWe introduce Mul-Mixup, a novel schema for data augmentation that transcends traditional Mixup methods. By leveraging samples from multiple source domains, Mul-Mixup covers a larger sample space and generates more diverse and informative mixed samples. Unlike Mixup, which interpolates between two samples, Mul-Mixup combines features and labels from multiple domains through a weighted sum, where each domain's weight adheres to a multi-dimensional Beta distribution.