A method, device and electronic device for generating malicious attack traffic

Abstract

The present disclosure provides a method, device and electronic device for generating malicious attack traffic, which can identify the attack behavior of historical malicious attack data and construct an attack data interaction graph; extract the attack behavior chain and adjust the attack behavior parameters of the preset malicious attack traffic generation model; adjust the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and defense response effect of the historical malicious attack data; perform multimodal fusion on the historical malicious attack data from different data sources, and train the preset malicious attack traffic generation model under the guidance of the attack behavior parameters and attack attribute parameters according to the fused historical malicious attack data; input the target timestamp and the target attack condition into the trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp. The generation efficiency of malicious encrypted traffic can be improved, and the data diversity and authenticity can be improved at the same time.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security, and in particular to a method, device and electronic device for generating malicious attack traffic. Background Art

[0002] With the rapid development and popularization of the Internet, the number and complexity of network attacks are increasing. Malicious traffic, such as distributed denial of service (DDoS) attacks, phishing, ransomware, and data theft, has become the main means of threatening network security. In order to protect network security, network administrators and security experts need to continuously test and verify the effectiveness of protection systems. In particular, as more and more network traffic is encrypted, malicious behavior in encrypted traffic becomes more difficult to detect and defend. Traditional network security testing methods usually include simulating regular traffic and simple attack traffic. However, these methods are powerless in the face of modern complex malicious encrypted traffic, and the emergence of encrypted traffic increases the difficulty of detection and analysis.

[0003] At present, the main methods of generating malicious encrypted traffic include manual settings, rule-based generation systems, and semi-automated tools. Manual settings generate encrypted traffic by manually configuring malware to execute in a controlled environment; rule-based generation systems use predefined rules or patterns to simulate malicious traffic; semi-automated tools combine automated scripts and manual intervention to generate traffic. Although these traditional methods are effective in specific situations, they all have obvious limitations, such as insufficient diversity and authenticity of generated traffic, and difficulty in quickly adapting to new malware behaviors. In addition, manual and semi-automated processes also greatly increase the complexity and cost of operations. Summary of the invention

[0004] The embodiments of the present disclosure at least provide a method, device and electronic device for generating malicious attack traffic, which can improve the efficiency of generating malicious encrypted traffic while improving data diversity and authenticity.

[0005] The present disclosure provides a method for generating malicious attack traffic, including:

[0006] Acquire historical malicious attack data and identify corresponding attack behavior entities, and construct an attack data interaction graph based on the data interaction relationship between the attack behavior entities;

[0007] Extracting an attack behavior chain from the attack data interaction graph, and adjusting attack behavior parameters of a preset malicious attack traffic generation model according to the attack behavior chain;

[0008] Determine the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjust the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect;

[0009] Performing multimodal fusion on the historical malicious attack data from different data sources, and training a preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters according to the fused historical malicious attack data;

[0010] The target timestamp and the target attack condition are input into a trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp.

[0011] In an optional implementation, historical malicious attack data is obtained and corresponding attack behavior entities are identified, and an attack data interaction graph is constructed according to the data interaction relationship between the attack behavior entities, specifically including:

[0012] Extracting the historical malicious attack data from a variety of network monitoring devices, and extracting the attack behavior entity from the historical malicious attack data using a natural language processing algorithm, wherein the attack behavior entity at least includes a network attack tool, an address of an attacked system, and network port information;

[0013] For each of the attack behavior entities, determine an entity feature vector corresponding to the attack behavior entity, wherein the entity feature at least includes an attack behavior feature, an attack technology feature, and a time sequence feature;

[0014] The attack data interaction graph is constructed by taking each of the attack behavior entities as a node, the data interaction relationship between every two of the attack behavior entities as an edge, and taking the entity feature vector as an attribute corresponding to the node.

[0015] In an optional implementation, extracting an attack behavior chain from the attack data interaction graph, and adjusting attack behavior parameters of a preset malicious attack traffic generation model according to the attack behavior chain specifically includes:

[0016] Using an attention mechanism to assign corresponding attention weights to nodes and edges in the attack data interaction graph;

[0017] Extract nodes and edges with weights above the preset threshold, and determine the interaction between key attack nodes and key attack data;

[0018] According to the interaction behavior between the key attack node and the key attack data, construct the attack behavior chain from initial access to data leakage;

[0019] Control the preset malicious attack traffic generation model to learn the attack behavior chain, and adjust the attack behavior parameters so that the preset malicious attack traffic generation model simulates and learns the malicious attack behaviors under different attack scenarios, wherein the attack behavior parameters at least include data packet size, sending interval, and camouflage technology.

[0020] In an optional implementation, determining a defense response strategy and a defense response effect corresponding to the historical malicious attack data, and adjusting attack attribute parameters of a preset malicious attack traffic generation model according to the defense response strategy and the defense response effect, specifically includes:

[0021] Construct simulation scenarios including network attacks and network defense, and formulate a mechanism for receiving positive rewards if the malicious attack traffic data is not detected by the intrusion detection system in the network defense;

[0022] A reinforcement learning algorithm is used to analyze the defense response strategy and defense response effect corresponding to the historical malicious attack data, with the goal of maximizing the positive reward in the simulation scenario, and the malicious attack traffic data generated by the preset malicious attack traffic generation model is adjusted to correspond to the attack attribute parameters, wherein the attack attribute parameters include at least the attack frequency, traffic size, and the protocol parameters used.

[0023] In an optional implementation, the target timestamp and the target attack condition are input into a trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp, specifically including:

[0024] The target timestamp and the target attack condition are merged into a conditional feature vector, and the conditional feature vector is merged with random noise through an embedding layer and then input into a generator of a preset malicious attack traffic generation model;

[0025] The conditional feature vector is processed in turn through multiple layers of convolution, batch normalization layer, and ReLU activation layer to gradually construct malicious attack traffic features and generate the malicious attack traffic data;

[0026] Inputting the malicious attack traffic data into a discriminator of a preset malicious attack traffic generation model to determine whether the malicious attack traffic data is real data or data generated by a generator;

[0027] The output of the generator is trained adversarially with the output of the discriminator to generate more accurate and realistic malicious attack traffic data.

[0028] In an optional implementation manner, after generating the malicious attack traffic data having the target timestamp, the method further includes:

[0029] Constructing an encryption protocol database including multiple encryption protocols, and determining protocol features corresponding to each of the encryption protocols, wherein the protocol features at least include encryption strength, computational cost, and detection difficulty;

[0030] Screening the key encryption protocols that have achieved successful attacks in the historical malicious attack data, and determining the defense responses of different network defense systems to different encryption protocols;

[0031] Constructing a feature vector including multiple preset attack environments, the key encryption protocols, and defense responses of different network defense systems to different encryption protocols;

[0032] The preset encryption protocol selection model is trained by the feature vector, so as to train the preset encryption protocol selection model to select an appropriate encryption protocol according to different attack environments and corresponding defense systems;

[0033] The malicious attack traffic data and the target attack environment included in the target attack conditions are input into a preset encryption protocol selection model, a target encryption protocol is determined, and the malicious attack traffic data is encrypted using the target encryption protocol.

[0034] In an optional implementation manner, after generating the malicious attack traffic data having the target timestamp, the method further includes:

[0035] Obtaining defense response data corresponding to the historical malicious attack data;

[0036] According to the historical malicious attack data and the corresponding defense response data, as well as the preset defense response rules, a preset defense response model is trained to learn corresponding defense mechanisms triggered by different malicious attack data inputs;

[0037] Inputting the malicious attack traffic data into a preset defense response model to determine corresponding target defense response data;

[0038] The target defense response data is applied to the malicious attack traffic data to screen the target malicious attack traffic data that successfully implements the attack.

[0039] The embodiment of the present disclosure also provides a device for generating malicious attack traffic, including:

[0040] An attack data interaction graph construction module is used to obtain historical malicious attack data and identify corresponding attack behavior entities, and construct an attack data interaction graph based on the data interaction relationship between the attack behavior entities;

[0041] An attack behavior parameter adjustment module, used to extract an attack behavior chain from the attack data interaction graph, and adjust the attack behavior parameters of a preset malicious attack traffic generation model according to the attack behavior chain;

[0042] An attack attribute parameter adjustment module, used to determine the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjust the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect;

[0043] A malicious attack traffic generation model training module is used to perform multimodal fusion on the historical malicious attack data from different data sources, and train a preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters according to the fused historical malicious attack data;

[0044] The malicious attack traffic data generation module is used to input the target timestamp and the target attack condition into the trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp.

[0045] An embodiment of the present disclosure also provides an electronic device, including: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the above-mentioned method for generating malicious attack traffic is executed, or steps in any possible implementation of the above-mentioned method for generating malicious attack traffic are performed.

[0046] The embodiments of the present disclosure also provide a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program executes the above-mentioned method for generating malicious attack traffic, or the steps in any possible implementation of the above-mentioned method for generating malicious attack traffic.

[0047] The embodiments of the present disclosure also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-mentioned method for generating malicious attack traffic, or the steps in any possible implementation of the above-mentioned method for generating malicious attack traffic.

[0048] The disclosed embodiment provides a method, device and electronic device for generating malicious attack traffic, which obtains historical malicious attack data and identifies corresponding attack behavior entities, constructs an attack data interaction graph according to the data interaction relationship between the attack behavior entities; extracts the attack behavior chain from the attack data interaction graph, and adjusts the attack behavior parameters of the preset malicious attack traffic generation model according to the attack behavior chain; determines the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjusts the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect; performs multimodal fusion on the historical malicious attack data from different data sources, and trains the preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters according to the fused historical malicious attack data; inputs the target timestamp and the target attack condition into the trained preset malicious attack traffic generation model, and generates malicious attack traffic data with the target timestamp. The generation efficiency of malicious encrypted traffic can be improved, while improving data diversity and authenticity.

[0049] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0051] Figure 1 A flow chart of a method for generating malicious attack traffic provided by an embodiment of the present disclosure is shown;

[0052] Figure 2 A flow chart showing another method for generating malicious attack traffic provided by an embodiment of the present disclosure is shown;

[0053] Figure 3 A schematic diagram of a device for generating malicious attack traffic provided by an embodiment of the present disclosure is shown;

[0054] Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0056] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0057] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0058] Research has found that currently, the main methods for generating malicious encrypted traffic include manual settings, rule-based generation systems, and semi-automated tools. Manual settings generate encrypted traffic by manually configuring malware to execute in a controlled environment; rule-based generation systems use predefined rules or patterns to simulate malicious traffic; semi-automated tools combine automated scripts and manual intervention to generate traffic. Although these traditional methods are effective in specific situations, they all have obvious limitations, such as insufficient diversity and authenticity of generated traffic, and difficulty in quickly adapting to new malware behaviors. In addition, manual and semi-automated processes also greatly increase the complexity and cost of operations.

[0059] Based on the above research, the present disclosure provides a method, device and electronic device for generating malicious attack traffic, which obtains historical malicious attack data and identifies the corresponding attack behavior entities, constructs an attack data interaction graph according to the data interaction relationship between the attack behavior entities; extracts the attack behavior chain from the attack data interaction graph, and adjusts the attack behavior parameters of the preset malicious attack traffic generation model according to the attack behavior chain; determines the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjusts the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect; performs multimodal fusion on the historical malicious attack data from different data sources, and trains the preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters according to the fused historical malicious attack data; inputs the target timestamp and the target attack condition into the trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp. The generation efficiency of malicious encrypted traffic can be improved, while improving data diversity and authenticity.

[0060] To facilitate understanding of the present embodiment, a method for generating malicious attack traffic disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the method for generating malicious attack traffic provided in the embodiment of the present disclosure is generally a computer device with certain computing capabilities, and the computer device includes, for example: a terminal device or a server or other processing device, and the terminal device can be a user equipment (User Equipment, UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (Personal Digital Assistant, PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the method for generating malicious attack traffic can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0061] See also Figure 1 FIG. 1 is a flowchart of a method for generating malicious attack traffic provided by an embodiment of the present disclosure, the method comprising steps S101 to S105, wherein:

[0062] S101, acquiring historical malicious attack data and identifying corresponding attack behavior entities, and constructing an attack data interaction graph according to the data interaction relationship between the attack behavior entities.

[0063] In the specific implementation, historical malicious attack data is first automatically collected from a variety of network monitoring tools and security devices, such as firewalls, intrusion detection systems (IDS), and log management systems, where the data sources of historical malicious attack data include at least network traffic logs, system alarms, security incident reports, etc.

[0064] Here, the existing malicious encrypted traffic data is deeply learned through the graph attention network to understand and simulate complex attack patterns and behavior chains. This helps identify existing attack patterns, and more importantly, it can predict new strategies and evolutionary forms that may be adopted in the future, thereby generating malicious traffic that covers potential future attacks.

[0065] Specifically, the process of constructing the attack data interaction graph can be implemented through the following steps 1 to 3:

[0066] Step 1: extract the historical malicious attack data from multiple network monitoring devices, and use a natural language processing algorithm to extract the attack behavior entity from the historical malicious attack data, wherein the attack behavior entity at least includes a network attack tool, an attacked system address, and network port information.

[0067] Step 2: for each of the attack behavior entities, determine an entity feature vector corresponding to the attack behavior entity, wherein the entity feature at least includes an attack behavior feature, an attack technology feature, and a time sequence feature.

[0068] Step 3: construct the attack data interaction graph by taking each attack behavior entity as a node, the data interaction relationship between every two attack behavior entities as an edge, and taking the entity feature vector as the attribute corresponding to the node.

[0069] In the specific implementation, advanced natural language processing algorithms and pattern matching algorithms are used to identify key entities from historical malicious attack data. These entities may include key information such as the tools used by the attacker, the IP addresses of the target systems attacked, and the network ports involved.

[0070] Afterwards, a wide range of features are extracted for each entity, including behavioral features such as session length, request frequency, technical features such as the type of protocol used, specific network signatures, and temporal features such as the time when the activity occurred and its duration.

[0071] Here, when constructing the attack data interaction graph, nodes are first created. In the attack data interaction graph, each entity is regarded as a node, and the attributes of each node are represented by its feature vector, which comprehensively reflects the behavior and technical attributes of the entity. Then, the edges of the attack data interaction graph are established, and the edges represent the interaction relationship between nodes, such as data transmission, access request, or attack attempt.

[0072] It should be noted that the weight of the edge can be dynamically calculated based on the frequency and importance of the interaction between entities to reflect their role in network security.

[0073] As a possible implementation, as new historical malicious attack data is continuously accessed, the graph attention network can update the structure of the attack data interaction graph in real time. This dynamic update can capture changes in the network environment, such as emerging threats or changing attack behaviors.

[0074] S102: extracting an attack behavior chain from the attack data interaction graph, and adjusting attack behavior parameters of a preset malicious attack traffic generation model according to the attack behavior chain.

[0075] In the specific implementation, the attention mechanism is used to assign corresponding attention weights to the nodes and edges in the attack data interaction graph; the nodes and edges above the preset weight threshold are extracted to determine the interaction behaviors between key attack nodes and key attack data; based on the interaction behaviors between key attack nodes and key attack data, an attack behavior chain from initial access to data leakage is constructed.

[0076] It should be noted that the preset weight threshold can be selected according to actual needs and is not specifically limited here.

[0077] Afterwards, the preset malicious attack traffic generation model is controlled to learn the attack behavior chain, and the attack behavior parameters are adjusted so that the preset malicious attack traffic generation model simulates and learns the malicious attack behaviors under different attack scenarios, wherein the attack behavior parameters at least include data packet size, sending interval, and camouflage technology.

[0078] Specifically, the graph attention network learns to assign attention weights through training, which enables the model to strengthen its attention to key nodes and edges in the data interaction graph, which are usually the main activity points in network attacks. By analyzing the high-weight nodes and edges in the data interaction graph, the graph attention network identifies key behavior patterns in the attack, such as specific attack sequences or abnormal behavior chains.

[0079] Here, according to the behavior patterns extracted from the graph attention network, the attack behavior parameters of the preset malicious attack traffic generation model to generate malicious traffic are adjusted.

[0080] Among them, the attack behavior parameters may include adjusting the packet size, sending interval, camouflage technology, etc., making the generated traffic complex and difficult to predict.

[0081] Furthermore, by combining the behaviors learned from multiple attack scenarios, malicious attack traffic is generated that can simulate complex attack activities. For example, DDoS attacks and backdoor activities can be simulated at the same time. The generated malicious attack traffic is rigorously tested in a simulated environment to verify its concealment and realism. Based on the feedback, the system continues to adjust parameters to optimize future traffic generation.

[0082] Preferably, the preset malicious attack traffic generation model can adopt a deep conditional generation adversarial network model under the VirtualBox framework.

[0083] S103: Determine a defense response strategy and a defense response effect corresponding to the historical malicious attack data, and adjust attack attribute parameters of a preset malicious attack traffic generation model according to the defense response strategy and the defense response effect.

[0084] In the specific implementation, a simulation scenario including network attack and network defense is constructed, and a mechanism is established to receive positive rewards if the malicious attack traffic data is not detected by the intrusion detection system in the network defense.

[0085] Here, a reinforcement learning model can be used to strengthen the preset malicious attack traffic generation model based on historical attack data and the effect of defense response to automatically adjust the attack attribute parameters of malicious attack traffic generation, such as attack frequency, traffic size, and protocol used.

[0086] First, the reinforcement learning model needs to define an environment consisting of simulated scenarios of network attack and defense. Each state in the environment represents a specific configuration of the network and the current attack and defense situation. By building a simulation platform that contains a variety of network configurations and attack and defense scenarios, it not only provides training data, but also verifies the effectiveness of the preset malicious attack traffic generation model.

[0087] At the same time, a reward mechanism is defined to quantify the effect of the model's actions. For example, if the malicious attack traffic generated by the preset malicious attack traffic generation model successfully bypasses the IDS, it will receive a positive reward; if the malicious attack traffic is detected, it will be punished.

[0088] Furthermore, a reinforcement learning algorithm is used to analyze the defense response strategies and defense response effects corresponding to historical malicious attack data. With the goal of maximizing positive rewards in simulation scenarios, the attack attribute parameters corresponding to the malicious attack traffic data generated by the preset malicious attack traffic generation model are adjusted, where the attack attribute parameters include at least the attack frequency, traffic size, and the protocol parameters used.

[0089] Here, we first analyze historical malicious attack data, including the type of attack, the tools used, the success or failure records, etc. This data helps the reinforcement learning model understand which strategies have been effective in the past. The reinforcement learning model uses these analysis results to adjust the key parameters of the preset malicious attack traffic generation model to generate malicious traffic. For example, the reinforcement learning model may adjust the frequency of sending malicious traffic or change the size of the traffic to adapt to the changing network environment and defense strategy.

[0090] Among them, the reinforcement learning model learns how to adjust its strategy to maximize rewards through trial and error. This includes dynamic adjustment of parameters such as attack frequency, traffic size, and protocol used. At the same time, the reinforcement learning model regularly receives updates on new network defense technologies and attack methods. This information comes from security databases, security research reports, and real-time network defense feedback.

[0091] In this way, the reinforcement learning model continuously optimizes its generation strategy by analyzing this information and combining it with real-time network responses. For example, if a new firewall rule is found to be particularly effective in blocking a certain type of traffic, the reinforcement learning model will try to adjust the characteristics of the malicious attack traffic generation of the preset malicious attack traffic generation model to bypass these new rules.

[0092] Optionally, the reinforcement learning model periodically updates its decision-making strategy through an iterative process, ensuring that the generated malicious traffic can address current and future security challenges.

[0093] Preferably, the reinforcement learning model can adopt advanced reinforcement learning algorithms such as Deep Q-Network (DQN) and Proximal Policy Optimization (PPO). These algorithms can handle high-dimensional action space and state space and are suitable for complex network security scenarios.

[0094] In this way, the preset malicious attack traffic generation model under the VirtualBox framework can generate highly realistic and predictive malicious encrypted traffic, making it valuable in helping to research and test the next generation of network security solutions. By simulating new malicious behaviors that may appear in the real world, the framework can provide important forward-looking insights and tools for the network security field.

[0095] S104, performing multimodal fusion on the historical malicious attack data from different data sources, and training a preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters based on the fused historical malicious attack data.

[0096] In specific implementation, by fusing different types of network data (such as HTTP traffic, DNS queries, email communications, instant messages, etc.), a more comprehensive data view is provided for the training of the preset malicious attack traffic generation model. This multimodal fusion helps to reveal the potential correlation between different types of data and provide data support for the simulation of complex attack scenarios.

[0097] Here, first of all, we need to identify the data types that need to be integrated, including but not limited to HTTP traffic, DNS queries, email communications, and instant messages. These data types reflect different interaction patterns and behaviors in the network. We then export the data through network packet capture tools, log management systems, or directly from application servers and databases, while ensuring the timeliness and integrity of the data.

[0098] After that, invalid or incomplete data records are cleared, data formats and errors are corrected, timestamps and other key fields are standardized, and feature information is extracted from the original data, such as extracting URLs, methods (GET / POST), response codes, etc. from HTTP requests. At the same time, in order to make data from different sources comparable, the data needs to be standardized, such as converting all text data to lowercase and unifying the time format.

[0099] Specifically, ensure that data from different data sources at the same time point can be aligned, for example, a DNS query and the corresponding HTTP request can be matched based on the timestamp. Use advanced data fusion techniques, such as feature fusion networks or multi-view learning algorithms, to integrate features from different data sources together to enhance the information that the model can learn from them. Then analyze the potential associations between different types of data, such as whether a specific type of email communication is often accompanied by a specific type of network request.

[0100] Here, machine learning algorithms, such as generative adversarial networks (GANs) or variational autoencoders (VAEs), are applied to generate new data instances. These algorithms can generate seemingly realistic network behavior data based on the learned data distribution model. The authenticity and diversity of the synthetic data are verified using statistical tests and machine learning models. Evaluation metrics may include coverage, diversity, and novelty of the data.

[0101] Optionally, use the synthetic data in an actual cybersecurity system or in a control environment to verify its contribution to improving system performance. Continuously optimize the data synthesis and fusion algorithms based on usage feedback and new data trends for continuous optimization.

[0102] As a possible implementation method, for the training process of a preset malicious attack traffic generation model, the preset malicious attack traffic generation model may include a generator and a discriminator structure. The generator uses a deep convolutional neural network to gradually construct and refine the generated data through multiple convolutional layers, batch normalization layers, and ReLU activation layers. The discriminator also uses a convolutional neural network structure, and its task is to determine whether the input data is real data or generated by the generator.

[0103] Here, the preset malicious attack traffic generation model can work under the condition of accepting multiple conditional inputs, such as time dependency, event type, attack mode, etc. The input training data combined with conditions and noise is passed through the generator network. The network uses convolutional layers to gradually build detailed features of the data and generate malicious attack traffic data with specified conditional features. The generator and the discriminator compete with each other during the adversarial training process. The generator tries to generate more and more realistic data, while the discriminator strives to distinguish between real data and generated data. In this way, the generator learns to generate more accurate and realistic malicious behavior data.

[0104] During the training process, the parameters of the generator are adjusted based on the feedback from the discriminator. If the generated data does not accurately reflect the specified timestamp or other conditions, the model is optimized by adjusting the learning rate, optimizer parameters, or network architecture.

[0105] In this way, the malicious attack traffic generation model is preset in the training phase, using real network traffic data as the basis, and the characteristics of the generated content are controlled by conditional labels. These conditions include but are not limited to the severity level of the event, the type of attack, the time of occurrence, etc. The Adam optimizer and cross entropy loss function are used to optimize the performance of the generator and discriminator to ensure that high-quality data can be generated under complex conditions.

[0106] S105: Input the target timestamp and the target attack condition into a trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp.

[0107] In the specific implementation, the target timestamp and the target attack condition are fused into a conditional feature vector, and the conditional feature vector is merged with the random noise through an embedding layer and then input into the generator of a preset malicious attack traffic generation model; the conditional feature vector is processed through multiple layers of convolution, batch normalization layer and ReLU activation layer in sequence to gradually construct malicious attack traffic features and generate malicious attack traffic data; the malicious attack traffic data is input into the discriminator of the preset malicious attack traffic generation model to determine whether the malicious attack traffic data is real data or data generated by the generator; the output of the generator is adversarially trained with the output of the discriminator to generate more accurate and realistic malicious attack traffic data.

[0108] Here, when generating malicious attack traffic data, a specific timestamp is one of the key conditions. First, the target timestamp is converted into a format suitable for neural network processing, for example, by expressing time information through one-hot encoding or periodic encoding (such as sine and cosine transforms).

[0109] Afterwards, the target timestamp and target attack conditions (such as attack type, target system) are processed through one or more embedding layers to convert these conditions into feature vectors that can affect the generation process. These feature vectors are combined with random noise vectors to jointly determine the characteristics of the generated content.

[0110] Here, the input of the generator includes not only random noise, but also conditional labels such as timestamp, attack type, and other related parameters. These conditional labels are converted into dense vectors through the embedding layer, merged with the random noise, and used as the input of the generator.

[0111] The input vector that combines conditions and noise passes through the generator network, which uses convolutional layers to gradually build detailed features of the data and generate malicious attack traffic data with specified conditional features. During the generation process, the model is able to handle hierarchical conditions, allowing it to simultaneously consider conditional constraints in multiple dimensions, such as network protocol type, traffic size, session duration, etc., to enhance the diversity and authenticity of the generated data.

[0112] It should be noted that the generated malicious attack traffic data needs to be verified to ensure that it contains the correct timestamp information and can correctly exhibit the expected attack behavior in the simulated network environment.

[0113] As a possible implementation method, after the malicious attack traffic generation model is preset to generate malicious attack traffic data, see Figure 2 FIG. 2 is a flowchart of another method for generating malicious attack traffic provided by an embodiment of the present disclosure, wherein the method includes steps S201 to S205, wherein:

[0114] S201. Construct an encryption protocol database including multiple encryption protocols, and determine protocol features corresponding to each of the encryption protocols, wherein the protocol features at least include encryption strength, computational cost, and detection difficulty.

[0115] S202: Screen the key encryption protocols that achieve successful attacks in the historical malicious attack data, and determine the defense responses of different network defense systems to different encryption protocols.

[0116] S203, constructing a feature vector including multiple preset attack environments, the key encryption protocol, and defense responses of different network defense systems to different encryption protocols.

[0117] S204. Train a preset encryption protocol selection model using the feature vector to train the preset encryption protocol selection model to select an appropriate encryption protocol according to different attack environments and corresponding defense systems.

[0118] S205. Input the malicious attack traffic data and the target attack environment included in the target attack condition into a preset encryption protocol selection model, determine a target encryption protocol, and use the target encryption protocol to encrypt the malicious attack traffic data.

[0119] In specific implementations, the system first identifies the encryption preferences and defense capabilities of the target network, and then selects the encryption method that best suits the environment, such as selecting the best symmetric or asymmetric encryption algorithm, or using more complex obfuscation techniques.

[0120] Here, we first build an encryption protocol library, including various common and uncommon encryption technologies, such as AES, RSA, ECC, ChaCha20, etc., as well as specific configuration options such as key length, encryption mode, etc. And define characteristics for each protocol, including encryption strength, computational cost, detection difficulty, etc.

[0121] Furthermore, we analyze the collected historical malicious attack data, especially the attack instances involving encrypted traffic, to identify which encryption protocols have successfully evaded detection in the past. We also analyze the responses of various network defense systems (such as IDS, IPS, and firewalls) to different encryption protocols to identify which encryption strategies are the most difficult to detect.

[0122] Here, based on the above analysis, a feature vector is constructed, including the attack type, the security facilities of the target network environment, the historical response to different encryption protocols, etc., and a suitable preset encryption protocol selection model, such as random forest, support vector machine or neural network, is selected to predict the encryption protocol that best suits the current attack scenario. The model is trained using the collected data and cross-validated to optimize the model performance.

[0123] Preferably, when malicious traffic is generated, environmental data of the target network is collected in real time, such as current network traffic characteristics, defense system configuration, etc. The preset encryption protocol selection model dynamically recommends the most appropriate encryption protocol based on real-time data and pre-trained knowledge. The preset encryption protocol selection model considers factors such as the probability of evading detection and the cost of encryption operations to select the optimal protocol.

[0124] Afterwards, according to the recommendation of the preset encryption protocol selection model, the generated malicious traffic is encrypted using the selected encryption protocol, and the performance of the encrypted traffic in the network is monitored, especially the detection situation. This feedback information is used to further train and optimize the preset encryption protocol selection model.

[0125] Furthermore, the preset encryption protocol selection model is regularly updated, including retraining to adapt to new network defense technologies and attack methods, and the encryption protocol library is updated according to the development of encryption technology and emerging encryption methods.

[0126] In this way, the most appropriate encryption protocol is dynamically selected for the generated malicious traffic to simulate the encryption strategies adopted by malicious actors in the real world. Machine learning methods are used to predict and select encryption algorithms that can maximize the complexity of traffic analysis to enhance the stealth and realism of the generated traffic.

[0127] As another possible implementation, natural language processing (NLP) technology can be used to analyze historical security events and response logs, and train machine learning models to predict potential responses of defense systems. When malicious traffic is generated, the system automatically simulates possible defense responses, such as IPS / IDS trigger rules, and automatically isolates or redirects traffic. These simulated responses help assess the potential impact of malicious traffic and its ability to evade existing security measures. This can be achieved through the following steps 1-4:

[0128] Step 1: Obtain defense response data corresponding to the historical malicious attack data.

[0129] Step 2: Based on the historical malicious attack data and the corresponding defense response data, as well as preset defense response rules, a preset defense response model is trained to learn corresponding defense mechanisms triggered by different malicious attack data inputs.

[0130] Step 3: Input the malicious attack traffic data into a preset defense response model to determine the corresponding target defense response data.

[0131] Step 4: Apply the target defense response data to the malicious attack traffic data to screen the target malicious attack traffic data that has successfully carried out the attack.

[0132] In a specific implementation, the preset defense response model may include a data input module, a rule engine module, a machine learning decision support module, a response execution module, and an integration interface.

[0133] Here, the data input module is responsible for collecting real-time data from network devices (such as routers, switches), security devices (such as firewalls, IDS) and log systems. Rule engine module: The core component is responsible for storing and processing all security response rules and triggering corresponding security measures based on the input data. The machine learning decision support module is responsible for analyzing the data using pre-trained models to provide decision support for the rule engine, especially in new situations where the rules are ambiguous or insufficient to handle. The response execution module is responsible for implementing security measures determined by the rule engine and machine learning model, such as isolation, blocking, redirecting traffic, etc. The integration interface is responsible for designing API interfaces with existing security and network management tools to ensure seamless access and real-time acquisition of data and sending of control instructions.

[0134] Among them, for the rule engine and response strategy, system administrators and security analysts define a series of rules based on behavior, signature and anomaly detection, and set up rule update mechanism and rule trigger mechanism. The rule update mechanism allows new rules to be added quickly to respond to emerging threats and vulnerabilities. The rule trigger mechanism real-time data stream passes through the rule engine, and any data that matches the rules will trigger the corresponding response measures.

[0135] It should be noted that the above process supports complex conditional logic, such as combination rules and time series analysis, to identify complex attack patterns.

[0136] Specifically, the preset defense response model can select a model suitable for processing time series and network traffic data, such as a recurrent neural network (RNN) or a long short-term memory network (LSTM). The preset defense response model is regularly retrained and optimized with the latest security incident data to maintain its prediction accuracy and response speed.

[0137] Preferably, a decision support system is set up to provide auxiliary decision-making in complex or low-confidence situations where the rule engine cannot make a decision directly. Generate explainable decision suggestions to help security analysts understand the decision-making process of the preset defense response model.

[0138] Furthermore, the data processing process includes data normalization and cleaning, removing noise and irrelevant data, and extracting useful features. Real-time monitoring of data streams, using high-performance computing platforms to ensure low-latency and high-throughput data processing. Automated response, response actions include but are not limited to traffic isolation, session termination, IP blocking, and traffic redirection to honeypots. The system records all response decisions and actions to provide data support for subsequent audits and optimizations.

[0139] Optionally, simulate various network attacks in a simulation environment to test the accuracy and effectiveness of the system's response. Adjust and optimize rules and machine learning models to ensure the best security results. Continuously monitor system performance after deployment and continuously adjust system configuration through the feedback loop of machine learning models. Regularly perform system maintenance and upgrades, including updates to hardware facilities, software applications, and security policies.

[0140] The disclosed embodiment provides a method for generating malicious attack traffic, which obtains historical malicious attack data and identifies corresponding attack behavior entities, constructs an attack data interaction graph according to the data interaction relationship between the attack behavior entities; extracts the attack behavior chain from the attack data interaction graph, and adjusts the attack behavior parameters of a preset malicious attack traffic generation model according to the attack behavior chain; determines the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjusts the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect; performs multimodal fusion on the historical malicious attack data from different data sources, and trains a preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters according to the fused historical malicious attack data; inputs the target timestamp and the target attack condition into the trained preset malicious attack traffic generation model, and generates malicious attack traffic data with the target timestamp. The generation efficiency of malicious encrypted traffic can be improved, while improving data diversity and authenticity.

[0141] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0142] Based on the same inventive concept, the embodiments of the present disclosure also provide a device for generating malicious attack traffic corresponding to the method for generating malicious attack traffic. Since the principle of solving the problem by the device in the embodiments of the present disclosure is similar to the method for generating malicious attack traffic in the embodiments of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0143] See also Figure 3 , Figure 3 A schematic diagram of a device for generating malicious attack traffic provided by an embodiment of the present disclosure. Figure 3 As shown in , the malicious attack traffic generation device 300 provided in the embodiment of the present disclosure includes:

[0144] The attack data interaction graph construction module 310 is used to obtain historical malicious attack data and identify corresponding attack behavior entities, and construct an attack data interaction graph according to the data interaction relationship between the attack behavior entities.

[0145] The attack behavior parameter adjustment module 320 is used to extract the attack behavior chain in the attack data interaction diagram, and adjust the attack behavior parameters of the preset malicious attack traffic generation model according to the attack behavior chain.

[0146] The attack attribute parameter adjustment module 330 is used to determine the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjust the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect.

[0147] The malicious attack traffic generation model training module 340 is used to perform multimodal fusion on the historical malicious attack data from different data sources, and train a preset malicious attack traffic generation model based on the fused historical malicious attack data under the guidance of the attack behavior parameters and the attack attribute parameters.

[0148] The malicious attack traffic data generation module 350 is used to input the target timestamp and the target attack condition into the trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp.

[0149] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0150] The disclosed embodiment provides a malicious attack traffic generation device, which acquires historical malicious attack data and identifies corresponding attack behavior entities, constructs an attack data interaction graph according to the data interaction relationship between the attack behavior entities; extracts the attack behavior chain from the attack data interaction graph, and adjusts the attack behavior parameters of the preset malicious attack traffic generation model according to the attack behavior chain; determines the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjusts the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect; performs multimodal fusion on the historical malicious attack data from different data sources, and trains the preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters according to the fused historical malicious attack data; inputs the target timestamp and the target attack condition into the trained preset malicious attack traffic generation model, and generates malicious attack traffic data with the target timestamp. The generation efficiency of malicious encrypted traffic can be improved, while improving data diversity and authenticity.

[0151] Corresponds to Figure 1 and Figure 2 The method for generating malicious attack traffic in the embodiment of the present disclosure also provides an electronic device 400, such as Figure 4 FIG. 4 is a schematic diagram of the structure of an electronic device 400 provided in an embodiment of the present disclosure, including:

[0152] Processor 41, memory 42, and bus 43; memory 42 is used to store execution instructions, including memory 421 and external memory 422; memory 421 here is also called internal memory, which is used to temporarily store operation data in processor 41 and data exchanged with external memory 422 such as hard disk. Processor 41 exchanges data with external memory 422 through memory 421. When the electronic device 400 is running, the processor 41 communicates with the memory 42 through bus 43, so that the processor 41 executes Figure 1 and Figure 2 Steps of a method for generating malicious attack traffic.

[0153] The embodiment of the present disclosure also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for generating malicious attack traffic described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0154] The embodiments of the present disclosure also provide a computer program product, which includes computer instructions. When the computer instructions are executed by a processor, the steps of the method for generating malicious attack traffic described in the above method embodiment can be executed. For details, please refer to the above method embodiment, which will not be repeated here.

[0155] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is implemented as a computer storage medium. In another optional embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0156] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0157] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0158] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0159] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0160] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A method for generating malicious attack traffic, characterized in that: include: Acquire historical malicious attack data and identify corresponding attack behavior entities, and construct an attack data interaction graph based on the data interaction relationship between the attack behavior entities; Extracting an attack behavior chain from the attack data interaction graph, and adjusting attack behavior parameters of a preset malicious attack traffic generation model according to the attack behavior chain; Determine the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjust the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect; Performing multimodal fusion on the historical malicious attack data from different data sources, and training a preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters according to the fused historical malicious attack data; The target timestamp and target attack conditions are input into the trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp. Various network attacks are simulated in a simulation environment to test the response accuracy and effect of the system, adjust and optimize the rules and machine learning models to ensure the best security effect.

2. The method according to claim 1, characterized in that Obtain historical malicious attack data and identify corresponding attack behavior entities, and construct an attack data interaction graph based on the data interaction relationship between the attack behavior entities, specifically including: Extracting the historical malicious attack data from a variety of network monitoring devices, and extracting the attack behavior entity from the historical malicious attack data using a natural language processing algorithm, wherein the attack behavior entity at least includes a network attack tool, an address of an attacked system, and network port information; For each of the attack behavior entities, determine an entity feature vector corresponding to the attack behavior entity, wherein the entity feature at least includes an attack behavior feature, an attack technology feature, and a time sequence feature; The attack data interaction graph is constructed by taking each of the attack behavior entities as a node, the data interaction relationship between every two of the attack behavior entities as an edge, and taking the entity feature vector as an attribute corresponding to the node.

3. The method according to claim 1, characterized in that Extracting an attack behavior chain from the attack data interaction graph, and adjusting attack behavior parameters of a preset malicious attack traffic generation model according to the attack behavior chain, specifically includes: Using an attention mechanism to assign corresponding attention weights to nodes and edges in the attack data interaction graph; Extract nodes and edges with weights above the preset threshold, and determine the interaction between key attack nodes and key attack data; According to the interaction behavior between the key attack node and the key attack data, construct the attack behavior chain from initial access to data leakage; Control the preset malicious attack traffic generation model to learn the attack behavior chain, and adjust the attack behavior parameters so that the preset malicious attack traffic generation model simulates and learns the malicious attack behaviors under different attack scenarios, wherein the attack behavior parameters at least include data packet size, sending interval, and camouflage technology.

4. The method according to claim 1, characterized in that: Determining a defense response strategy and a defense response effect corresponding to the historical malicious attack data, and adjusting attack attribute parameters of a preset malicious attack traffic generation model according to the defense response strategy and the defense response effect, specifically including: Construct simulation scenarios including network attacks and network defense, and formulate a mechanism for receiving positive rewards if the malicious attack traffic data is not detected by the intrusion detection system in the network defense; A reinforcement learning algorithm is used to analyze the defense response strategy and defense response effect corresponding to the historical malicious attack data, with the goal of maximizing the positive reward in the simulation scenario, and the malicious attack traffic data generated by the preset malicious attack traffic generation model is adjusted to correspond to the attack attribute parameters, wherein the attack attribute parameters include at least the attack frequency, traffic size, and the protocol parameters used.

5. The method according to claim 1, characterized in that Input the target timestamp and the target attack condition into the trained preset malicious attack traffic generation model to generate malicious attack traffic data with the target timestamp, specifically including: The target timestamp and the target attack condition are merged into a conditional feature vector, and the conditional feature vector is merged with random noise through an embedding layer and then input into a generator of a preset malicious attack traffic generation model; The conditional feature vector is processed in turn through multiple layers of convolution, batch normalization layer, and ReLU activation layer to gradually construct malicious attack traffic features and generate the malicious attack traffic data; Inputting the malicious attack traffic data into a discriminator of a preset malicious attack traffic generation model to determine whether the malicious attack traffic data is real data or data generated by a generator; The output of the generator is trained adversarially with the output of the discriminator to generate more accurate and realistic malicious attack traffic data.

6. The method according to claim 1, characterized in that After generating the malicious attack traffic data having the target timestamp, the method further includes: Constructing an encryption protocol database including multiple encryption protocols, and determining protocol features corresponding to each of the encryption protocols, wherein the protocol features at least include encryption strength, computational cost, and detection difficulty; Screening the key encryption protocols that have achieved successful attacks in the historical malicious attack data, and determining the defense responses of different network defense systems to different encryption protocols; Constructing a feature vector including a plurality of preset attack environments, the key encryption protocols, and defense responses of different network defense systems to different encryption protocols; The preset encryption protocol selection model is trained by the feature vector, so as to train the preset encryption protocol selection model to select an appropriate encryption protocol according to different attack environments and corresponding defense systems; The malicious attack traffic data and the target attack environment included in the target attack conditions are input into a preset encryption protocol selection model, a target encryption protocol is determined, and the malicious attack traffic data is encrypted using the target encryption protocol.

7. The method according to claim 1, characterized in that After generating the malicious attack traffic data having the target timestamp, the method further includes: Obtaining defense response data corresponding to the historical malicious attack data; According to the historical malicious attack data and the corresponding defense response data, as well as the preset defense response rules, a preset defense response model is trained to learn corresponding defense mechanisms triggered by different malicious attack data inputs; Inputting the malicious attack traffic data into a preset defense response model to determine corresponding target defense response data; The target defense response data is applied to the malicious attack traffic data to screen the target malicious attack traffic data that successfully implements the attack.

8. A device for generating malicious attack traffic, characterized in that: include: An attack data interaction graph construction module is used to obtain historical malicious attack data and identify corresponding attack behavior entities, and construct an attack data interaction graph based on the data interaction relationship between the attack behavior entities; An attack behavior parameter adjustment module, used to extract an attack behavior chain from the attack data interaction graph, and adjust the attack behavior parameters of a preset malicious attack traffic generation model according to the attack behavior chain; An attack attribute parameter adjustment module, used to determine the defense response strategy and defense response effect corresponding to the historical malicious attack data, and adjust the attack attribute parameters of the preset malicious attack traffic generation model according to the defense response strategy and the defense response effect; A malicious attack traffic generation model training module is used to perform multimodal fusion on the historical malicious attack data from different data sources, and train a preset malicious attack traffic generation model under the guidance of the attack behavior parameters and the attack attribute parameters according to the fused historical malicious attack data; The malicious attack traffic data generation module is used to input the target timestamp and target attack conditions into the trained preset malicious attack traffic generation model, generate malicious attack traffic data with the target timestamp, simulate various network attacks in a simulation environment, test the system's response accuracy and effect, adjust and optimize rules and machine learning models, and ensure the best security effect.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the method for generating malicious attack traffic as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for generating malicious attack traffic according to any one of claims 1 to 7 are executed.

Images