Sample generation method, device, equipment and medium for unbalanced user attack data

Abstract

The present invention discloses a sample generation method, device, equipment and medium for unbalanced user attack data, the method comprising obtaining a user attack behavior data set; generating a minority class feature map according to a minority class set of the user attack behavior data set; constructing and training an adversarial network of dual generators and dual discriminators according to the minority class feature map; using the trained adversarial network to generate a minority class prediction feature map, summarizing the minority class feature map, the minority class prediction feature map and the majority class feature map, and obtaining a user attack feature sample data set with a balanced quantity. The present invention generates an RGBA feature map of minority class attack behavior, which can provide more effective information and accurately characterize the internal feature information of user attack behavior data; the network is optimized and trained according to the continuous improvement of the objective function of the dual generator and the loss function of the dual discriminator, the similarity between the generated data and the real data is improved, and the problem of unbalanced feature samples of user attack data is solved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and medium for generating samples of unbalanced user attack data. Background Art

[0002] With the rapid development of the Internet software industry, open source software has become the core infrastructure and an important and critical component of information systems.

[0003] It is crucial to identify and prevent user attack behaviors in open source software. Preventing network attack behaviors requires a certain number of sample data sets, but the sample data sets of existing technologies have data imbalance problems. The proportion of minority user attack data and majority user attack data is quite different. Sample data sets with large differences can easily lead to problems in identifying attack behaviors incorrectly in subsequent website protection, causing serious losses to Internet security.

[0004] It can be seen that how to obtain a reasonable sample data set has become a technical problem that technical personnel in this field need to solve urgently. Summary of the invention

[0005] The present invention provides a method, device, equipment and medium for generating samples of unbalanced user attack data, so as to solve the problem of data imbalance of existing network attack data samples.

[0006] In order to solve the above technical problems, an embodiment of the present invention provides a method for generating samples of unbalanced user attack data, the method comprising:

[0007] Data on network user attack behaviors are collected and classified to obtain a user attack behavior dataset containing several types of data.

[0008] According to the quantity of each type of data in the user attack behavior data set, the data is divided into a minority class set and a majority class set.

[0009] Generate corresponding minority class feature graphs and majority class feature graphs according to the user attack behavior data in the minority class set and the majority class set, respectively.

[0010] An adversarial network of dual generators and dual discriminators is constructed and trained according to the minority class feature map. The training process of the adversarial network is designed to optimize the objective function of the dual generator and the loss function of the dual discriminator according to the generation results of the dual generator and the discrimination results of the dual discriminator, so as to realize the training of the adversarial network.

[0011] The trained adversarial network is used to generate a minority class prediction feature map, and the minority class feature map, the minority class prediction feature map and the majority class feature map are summarized to obtain a user attack feature sample data set with a balanced quantity.

[0012] The division is performed according to the quantity of each type of data in the user attack behavior data set to obtain a minority class set and a majority class set, including:

[0013] Taking the class containing the largest number of user attack behaviors in the user attack behavior data set as a benchmark, the quantity imbalance degree of each type of data in the user attack behavior data set is calculated.

[0014] A balance threshold for data partitioning is set based on the harmfulness of user attack behaviors, the difficulty of defending against user attack behaviors, and security protection requirements.

[0015] The minority class set and the majority class set are obtained by performing division according to the quantity imbalance degree and the balance threshold.

[0016] Furthermore, generating corresponding minority class feature graphs and majority class feature graphs according to the user attack behavior data in the minority class set and the majority class set, respectively, includes:

[0017] The user attack behavior data in the minority class set and the majority class set are respectively converted into hexadecimal data, and each of the hexadecimal data is mapped in the corresponding RGB image channel to obtain a first RGB feature map of the minority class set and a second RGB feature map of the majority class set.

[0018] The information entropy of the user attack behavior data in the minority class set is used to generate a single-channel grayscale image as the first transparency channel.

[0019] The first RGB feature map and the first transparency channel are fused to obtain an RGBA feature map of the minority class set.

[0020] The information entropy of the user attack behavior data in the majority class set is used to generate a single-channel grayscale image as a second transparency channel.

[0021] The second RGB feature map and the second transparency channel are fused to obtain an RGBA feature map of the majority class set.

[0022] Furthermore, the training of the adversarial network includes:

[0023] According to the minority class feature map, a predicted RGB feature map and a predicted information entropy single-channel grayscale map are generated using the first generator and the second generator respectively, and the predicted RGB feature map and the predicted information entropy single-channel grayscale map are fused to obtain a predicted RGBA feature map.

[0024] The predicted RGBA feature map and the minority class feature map are discriminated according to the first discriminator and the second discriminator to obtain a discrimination result.

[0025] The objective function of the dual generator is optimized according to the discrimination result.

[0026] Furthermore, the second discriminator is an enhanced discriminator.

[0027] The enhancement discriminator performs data enhancement processing on the input RGBA feature map, and the data enhancement processing includes at least one of transposition, sharpening or filtering.

[0028] Furthermore, the training of the adversarial network includes:

[0029] An objective function is constructed according to the similarity value of the generated result, the absolute mean difference value of the feature map and the discrimination result of the dual discriminator, and the dual generator is trained according to the objective function. The similarity value is a calculated value of the similarity between the predicted RGBA feature map and the real image. The calculation process of the similarity value is:

[0030]

[0031] in, To calculate the similarity between the predicted RGBA feature map and the real image, is the symbol for similarity calculation, is the expected value of the random noise following the normal distribution, is the expected value of the real minority class RGBA image obeying the real data distribution, To generate the RGB feature map of the image, is the RGB feature map of the real image, To generate a single-channel grayscale image of the information entropy of the image, is the single-channel grayscale image of the information entropy of the real image, To generate the RGBA feature map of the image, is the RGBA feature map of the real image.

[0032] The absolute mean difference value of the feature map is the absolute mean difference value between the real RGBA feature map and the feature map generated by the dual generator. The calculation process of the absolute mean difference value of the feature map is:

[0033]

[0034] in, is the absolute mean difference of the feature map, is the real RGBA feature map pixel mean, The pixel mean of the feature map generated by the dual generator.

[0035] Furthermore, the objective function is:

[0036]

[0037] in, For the discriminator RGBA feature map generated by the dual generator The judgment result of To enhance the discriminator RGBA feature map generated by the dual generator The judgment result of and are the coefficients of the similarity value and the absolute mean difference of the RGBA feature map, respectively.

[0038] The adversarial network is trained according to the objective function until the dual discriminators and the dual generators reach a Nash equilibrium.

[0039] Another embodiment of the present invention provides a sample generation device for unbalanced user attack data, comprising:

[0040] The data collection module is used to collect and classify the network user's attack behavior to obtain a user attack behavior data set containing several types of data.

[0041] The data partitioning module is used to partition the data according to the quantity of each type of data in the user attack behavior data set to obtain a minority class set and a majority class set.

[0042] The feature generation module is used to generate corresponding minority class feature graphs and majority class feature graphs according to the user attack behavior data in the minority class set and the majority class set respectively.

[0043] A network training module is used to construct and train an adversarial network of dual generators and dual discriminators based on the minority class feature map. The training process of the adversarial network is designed to optimize the objective function of the dual generator and the loss function of the dual discriminator based on the generation results of the dual generator and the discrimination results of the dual discriminator, so as to realize the training of the adversarial network.

[0044] The data balancing module is used to generate a minority class prediction feature map using the trained adversarial network, and to aggregate the minority class feature map, the minority class prediction feature map and the majority class feature map to obtain a user attack feature sample data set with a balanced quantity.

[0045] Yet another embodiment of the present invention provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the sample generation method of unbalanced user attack data as described above when executing the computer program.

[0046] Yet another embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the sample generation method of unbalanced user attack data as described above is implemented.

[0047] Compared with the prior art, the embodiments of the present invention have the following advantages:

[0048] (1) Generate RGBA feature images of minority attack behaviors. The effective information contained in the RGB feature image is three times that of the grayscale image, which can provide more effective information. The transparency channel is the information entropy representing the randomness of the data when the user attacks, which can highlight the characteristic information of the user when attacking;

[0049] (2) The matching degree between the data generated by the dual generator and the real data, the absolute mean difference between the real RGBA feature map and the feature map generated by the dual generator, and the discrimination results of the dual discriminator are used as optimization conditions to optimize the training of the dual generator to avoid overfitting of the dual generator and improve the similarity between the generated data and the real data. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A flow chart of the steps of a method for generating samples of unbalanced user attack data provided by an embodiment of the present invention;

[0051] Figure 2 A framework diagram of a sample generation method for unbalanced user attack data provided by an embodiment of the present invention;

[0052] Figure 3 A framework network structure diagram of a dual generator provided in an embodiment of the present invention;

[0053] Figure 4 A framework network structure diagram of a dual discriminator provided in an embodiment of the present invention;

[0054] Figure 5 A structural block diagram of a sample generation device for unbalanced user attack data provided by an embodiment of the present invention;

[0055] Figure 6 A structural diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0057] In the description of this application, the terms "first", "second", "third", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the feature. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0058] In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. The terms "vertical", "horizontal", "left", "right", "upper", "lower" and similar expressions used herein are only for illustrative purposes, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0059] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in the present invention have the same meaning as those commonly understood by those skilled in the art. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0060] An embodiment of the present invention provides a method for generating samples of unbalanced user attack data. For details, see Figure 1-Figure 2 , Figure 1 FIG. 1 is a flow chart showing the steps of a method for generating samples of unbalanced user attack data in one embodiment of the present invention. Figure 2 A framework diagram of a sample generation method of unbalanced user attack data provided by an embodiment of the present invention is shown, including steps S11 to S15:

[0061] S11, collecting and classifying the network user attack behavior data to obtain a user attack behavior data set containing several types of data.

[0062] The user attack behavior flow data of the open source software system is monitored and collected through a data monitoring interface with a user attack behavior detection function. The user attack behavior detection function can determine whether the user behavior is an attack behavior. According to the interface return status, the collected user attack behavior flow data is marked with the user attack behavior type, and the user attack behavior type flow data is stored in the user attack behavior data set. Among them Data subsets representing different categories of user attack behaviors, Indicates the number of collected user attack behavior types.

[0063] The user attack behavior type dataset The data is processed by filtering out empty data packets that do not contain transmission content, and the processed data is stored in a new data set. as the user attack behavior dataset.

[0064] By collecting network user behavior data, abnormal activities in the network can be monitored in real time, such as unauthorized access attempts, malware propagation, data leakage, etc. These data can help the operation and maintenance team quickly identify potential attack behaviors and take immediate countermeasures to prevent the attack from spreading further and causing greater losses.

[0065] S12, dividing the user attack behavior data set according to the quantity of each type of data to obtain a minority class set and a majority class set.

[0066] The current collection of network attack behavior data has the problem of data imbalance, which is that there are too few samples of minority attack behaviors and the information they contain is limited. As a result, the algorithm often performs poorly when faced with unbalanced data sets and has weak detection capabilities for minority attack behaviors.

[0067] In the case of unbalanced attack data, the security defense system may pay more attention to the frequently occurring attack types and ignore those attacks that occur less frequently but are more harmful. This will lead to the lack of targeted defense strategies and the inability to effectively deal with diverse attack methods.

[0068] Therefore, this embodiment divides the minority class set and the majority class set by calculating the imbalance degree of each type of attack data in the collected user attack behavior data set. Specifically, the division method adopted in this embodiment is:

[0069] According to the class with the largest number of user attack behaviors in the user attack behavior dataset As a benchmark, the quantitative imbalance of each type of data in the user attack behavior dataset is calculated. Quantity imbalance The calculation process is:

[0070]

[0071] For Class The data balance coefficient is set according to the harmfulness of the user's attack behavior, the difficulty of defending against the user's attack behavior, and the security protection requirements.

[0072] The types with quantity imbalance values ​​greater than the preset value are divided into the minority class set of user attack behaviors, and the rest are the majority class set.

[0073] S13, generating corresponding minority class feature graphs and majority class feature graphs according to the user attack behavior data in the minority class set and the majority class set respectively.

[0074] In order to comprehensively characterize the effective feature information of user attack behaviors, a visual feature map is used to characterize the traffic data of each user's attack behaviors. RGB feature maps and information entropy single-channel grayscale maps are generated respectively, and then the two are fused to generate minority class RGBA feature maps and majority class RGBA feature maps. The specific generation process is as follows:

[0075] Convert the attack behavior data of each user in the minority class set and the majority class set into hexadecimal data respectively, use the hexadecimal data information as the pixels in the image, and set the length to The data realizes the spatial mapping of RGB values, and the length is insufficient The data of is padded with zeros to generate a three-channel RGB feature map that can characterize the characteristics of the user attack behavior traffic data. Its dimension is In this embodiment, is 12288, so RGB feature map of size.

[0076] The information entropy of each user's attack behavior data is calculated as the transparency channel (i.e., Alpha channel) of the generated feature map, which can fully characterize the random distribution characteristics of the internal space of the traffic data during the user behavior attack. The information entropy is calculated as:

[0077]

[0078] in, is the information entropy, It is the internal bytes of the user's attack behavior data. The internal bytes of the user attack behavior traffic The probability of occurrence. The information entropy data bytes are used as the pixels of the image, and the byte length of the information entropy of the user attack behavior data is set to , maps the byte data to the pixels of the grayscale image, generating a size of Grayscale image of , insufficient length The data is filled with zeros. In this embodiment, , so it generates Grayscale image of size.

[0079] The single-channel grayscale image generated by the information entropy of the user attack behavior data is used as the transparency channel to merge with the RGB feature map to generate a four-channel RGBA feature maps, we obtain the RGBA feature maps of attack behaviors of minority and majority users respectively.

[0080] Compared with the single-channel grayscale image, the RGBA feature map has four channels, which can simultaneously characterize the characteristic information and data randomness of the user's attack behavior. It has richer information and can accurately characterize the internal characteristics of the user's attack behavior data.

[0081] S14, constructing and training an adversarial network of dual generators and dual discriminators according to the minority class feature map, wherein the training process of the adversarial network is designed to optimize the objective function of the dual generator and the loss function of the dual discriminator according to the generation results of the dual generator and the discrimination results of the dual discriminator, so as to realize the training of the adversarial network.

[0082] This embodiment adopts a deep convolutional generative adversarial network DD-DCGAN with dual generators and dual discriminators, which consists of a first generator, a second generator, a first discriminator and a second discriminator. The first generator is an RGB image generator. , the second generator is the information entropy single channel grayscale image generator , the first discriminator is a conventional discriminator , the second discriminator is an enhanced discriminator Among them, the first generator and the second generator Together they form a dual generator network , the first discriminator and the second discriminator Together they form a dual discriminator network .

[0083] During the training of the adversarial network, random noise is added Input double generator, respectively from the first generator and the second generator Output the generated RGB feature map And information entropy single channel grayscale image In order to more accurately characterize the feature diversity of the generated data and keep it consistent with the format of the real RGBA feature map of the minority class, the generated RGB feature map And information entropy single channel grayscale image Fusion generates RGBA data .

[0084] The first discriminator and the second discriminator The input is the real minority class RGBA feature map And the generated RGBA feature map , the output is the difference between the true minority class RGBA feature map and the generated RGBA feature map, and the difference between the enhanced true minority class RGBA feature map and the generated RGBA feature map, wherein the enhancement operation of the second discriminator includes but is not limited to transposition, sharpening, filtering and other processing.

[0085] Adding the results of the two discriminators together can more precisely distinguish between real data and generated data and reduce errors. The loss function of the discriminant results generated by the two discriminators is then back-propagated to the dual generators. and dual discriminator Training is performed to optimize and improve the objective function of the dual generator and the loss function of the dual discriminator. Through multiple rounds of training, the ability of the adversarial network to discriminate data and generate real data is improved.

[0086] Specifically, Figure 3 As shown, Figure 3 A framework network structure diagram of a dual generator provided in an embodiment of the present invention is shown. The specific structure of the dual generator in this embodiment includes a first generator and a second generator.

[0087] Among them, the first generator is the RGB image generation network , RGB image generator network It consists of four layers of transposed convolutional layers that gradually increase the size of the feature map, including:

[0088] Input layer: 100-dimensional random noise As an RGB image generator network The input random noise is converted into A smaller feature map with 256 channels.

[0089] The first transposed convolutional layer: input The feature map of passes through the first layer of transposed convolution layer, output The feature map of Function to activate.

[0090] The second transposed convolution layer: input The feature map of passes through the second layer of transposed convolution layer and outputs The feature map of , where the activation function is function.

[0091] The third transposed convolution layer: input The feature map of passes through the third layer of transposed convolution layer and outputs The feature map of , where the activation function is function.

[0092] Fourth transposed convolution layer: input The feature map of is passed through the fourth layer of transposed convolution layer, and the output The feature map of The activation function generates an RGB feature map.

[0093] The second generator is an information entropy single-channel grayscale image generator network , Information Entropy Single Channel Grayscale Image Generator Network It consists of four layers of transposed convolutional layers that gradually increase the size of the feature map, including:

[0094] Input layer: Use 100-dimensional random noise as information entropy single-channel grayscale image generator network The input random noise is converted into A smaller feature map with 256 channels.

[0095] The first transposed convolutional layer: input The feature map of passes through the first layer of transposed convolution layer, output The feature map of Function to activate.

[0096] The second transposed convolution layer: input The feature map of passes through the second layer of transposed convolution layer and outputs The feature map of , where the activation function is function.

[0097] The third transposed convolution layer: input The feature map of is passed through the third layer of transposed convolution layer, output The feature map of , where the activation function is function.

[0098] Fourth transposed convolution layer: input The feature map of is passed through the fourth layer of transposed convolution layer, and the output The feature map of The activation function generates a grayscale image of a single channel of information entropy.

[0099] The RGB feature map output by the first generator is fused with the grayscale image of the single channel of information entropy generated by the second generator to generate a four-channel image with the same structure as the real minority class RGB feature map. RGBA feature map of .

[0100] A dual generator network is used to generate RGB images and information entropy single-channel grayscale images of user attack behavior respectively, and then the generated RGB images and information entropy single-channel grayscale images are fused. This can effectively capture the local features of the data and reduce the number of model parameters, thereby increasing the training speed and effectively improving the convergence speed.

[0101] like Figure 4 As shown, Figure 4 The figure shows a framework network structure diagram of a dual discriminator provided in an embodiment of the present invention. The specific structure of the dual discriminator in this embodiment includes a first discriminator and a second discriminator.

[0102] The second discriminator adds an operation to enhance the input data, and the rest of the structure is the same as the first discriminator. In the discriminant operation of the image, the first discriminator uses four channels The RGBA feature map is taken as input, and the second discriminator first The RGBA feature map is enhanced and the enhanced RGBA feature map is used as the input of the second discriminator.

[0103] In addition to the input layer, the structure of the dual discriminator also includes:

[0104] The first convolution layer: The convolution kernel is , a convolutional layer with a stride of 2 and padding of 1, the number of channels is 32 times the original, and the output dimension is , through which Function to activate.

[0105] Image scaling layer: The feature map output by the first convolutional layer is scaled using the existing bilinear interpolation method to obtain the size and pass it to the fusion layer.

[0106] The second convolution layer: The convolution kernel is , a convolutional layer with a stride of 2 and a padding of 1, the number of channels is doubled, and the output dimension is , through which Function to activate.

[0107] Image scaling layer: The feature map output by the second convolutional layer is scaled using the existing bilinear interpolation method to obtain the size The image scaling layer can maintain the spatial consistency of the feature map, maintain the relative position relationship between pixels and local feature information, unify the size of the feature map through scaling, improve the calculation efficiency, and provide effective data for the subsequent fusion layer.

[0108] The third convolution layer: The convolution kernel is , a convolutional layer with a stride of 2 and a padding of 1, the number of channels is doubled, and the output dimension is ,pass Function to activate.

[0109] Fusion layer: The output of the first two convolutional layers is interpolated using a bilinear method. Scale to , Scale to , then fuse the output feature maps of the first two convolutional layers with the feature maps of the third convolutional layer to obtain a dimension of Feature maps. Feature maps generated by different convolutional layers have different levels of features. Shallow feature maps contain more detail information such as edges and textures, while deep feature maps contain richer attribute information. By fusing feature maps from different convolutional layers, the feature information of feature maps can be better represented.

[0110] The fourth convolutional layer: The input is the output of the fusion layer, and the convolution kernel is , a convolutional layer with a stride of 2 and padding of 0, the number of channels is 128, and the output dimension is .

[0111] Flatten layer: Finally, the Flatten layer is used to convert the multidimensional data into one-dimensional data. The input of the Flatten layer is the output of the fourth convolutional layer. Finally, the discrimination result of the RGBA feature map is output through the fully connected layer. The discrimination result obtained by the first discriminator is , the discrimination result obtained by the second discriminator is , the discrimination result of the dual discriminator is obtained by linear combination , Represents the probability that the input generated RGBA feature map is identified as a true RGBA feature map:

[0112]

[0113] in, is the linear combination coefficient.

[0114] According to the discrimination results of the dual discriminator, if the input data belongs to the real minority class data distribution, the probability value of the data being discriminated as real data is high, and the probability value of being discriminated as generated data is low. If the input data belongs to the data distribution generated by the generator, the probability value of the data being discriminated as real data is low, and the probability value of being discriminated as data generated by the generator is high.

[0115] Therefore, in order to improve the quality of data generated by the generator and the ability of the discriminator to distinguish, after the adversarial network DD-DCGAN is built, it is necessary to optimize the training between the dual generators and the dual discriminators to improve the quality of the generated feature maps.

[0116] Specifically, the optimization training process adopted in this embodiment includes training of dual discriminators and training of dual generators.

[0117] Among them, in the training of the dual discriminator, the input data uses the generated minority class RGBA feature map and the real minority class RGBA feature map, and the random noise The minority class RGBA feature map generated by the dual generator is represented as , where random noise Normal distribution , the real RGBA image is represented as , obeys the real data distribution Therefore, the training input data The dual discriminator is trained in this way.

[0118] During the training process, the first discriminator The cross loss function is calculated as:

[0119]

[0120] The second discriminator The cross loss function is calculated as:

[0121]

[0122] in, is the expected value of the real minority class RGBA image obeying the real data distribution, is the expected value of the random noise following the normal distribution, , Represent the first discriminator and the second discriminator For real minority class data The judgment result of , Represent the first discriminator and the second discriminator RGBA feature map generated by the generator The discrimination result of .

[0123] According to the above formula, the overall cross loss function of the dual discriminator is:

[0124]

[0125] in, is the linear combination coefficient, , are the output results of the first discriminator and the second discriminator respectively.

[0126] Through the above cross loss function , for the dual discriminator network Carry out optimization training to improve its ability to discriminate data.

[0127] During the training process of the dual generator, in order to avoid the overfitting problem of the dual generator, the objective function of the dual generator needs to be improved. For the improvement conditions of the objective function, this embodiment not only considers the discrimination results of the dual discriminators, but also adds the matching value of the similarity calculation between the data generated by the dual generator and the real minority class data and the absolute mean difference value of the RGBA feature map as the optimization conditions of the dual generator, and jointly constructs the objective function of the dual generator.

[0128] Among them, the similarity calculation process between the data generated by the dual generator and the real data is:

[0129]

[0130] In the above formula, sim is the similarity calculation symbol. The larger the value of , the higher the quality of the data generated by the dual generator. To generate the RGB feature map of the image, is the RGB feature map of the real image, To generate a single-channel grayscale image of the information entropy of the image, is the single-channel grayscale image of the information entropy of the real image, To generate the RGBA feature map of the image, is the RGBA feature map of the real image.

[0131] In order to further improve the accuracy of the data generated by the generator, the pixel values ​​of the RGBA feature map of the real data and the pixel values ​​of the RGBA feature map generated by the dual generator are read, and the mean values ​​of the RGBA feature maps of the four channels are calculated respectively. and , calculate the absolute mean difference between the real RGBA feature map and the RGBA feature map generated by the dual generator:

[0132]

[0133] in, The smaller the value of , the smaller the difference between the image generated by the dual generator and the real image, and the higher the quality of the generated RGBA feature map.

[0134] According to the above calculation results, the objective function of the dual generator is formed by the discriminator's discrimination result, the similarity value between the real data and the generated data, and the absolute mean difference value of the feature map. :

[0135]

[0136] in, For the discriminator RGBA feature map generated by the dual generator The judgment result of To enhance the discriminator RGBA feature map generated by the dual generator The judgment result of and are the coefficients of the similarity value and the absolute mean difference of the RGBA feature map, is the absolute mean difference between the feature maps of the generated image and the real image.

[0137] Through the above objective function, the dual generator of the adversarial network is optimized and trained to improve the quality of the feature map generated by the dual generator. The dual discriminator network discriminates the input data respectively. The enhancement operation enables the dual discriminator to pay more attention to the multi-faceted features of the data. The transposition enhancement technology makes the DD-DCGAN adversarial network more reliable, avoiding the accumulation of errors caused by a single discriminator. The robustness of the adversarial network improves the diversity and accuracy of the generated sample data. The image scaling layer is introduced in the discrimination process. The image scaling layer can maintain the spatial consistency of the feature map, and well maintain the relative position relationship and local feature information between pixels. The size of the feature map is unified by scaling, which improves the computational efficiency and provides effective data for the subsequent fusion layer. The feature maps generated by different convolutional layers have different levels of features. The shallow feature map contains more detail information such as edges and textures, and the deep feature map contains richer attribute information. By fusing feature maps from different convolutional layers, the feature information of the feature map can be better represented.

[0138] In order to enable those skilled in the art to better understand the training process, the training process of the DD-DCGAN adversarial network is now further explained.

[0139] The dual generator and dual discriminator deep convolutional generative adversarial network (DD-DCGAN) of this embodiment uses the optimizer Adam to optimize the dual discriminator loss function and objective function to update the dual discriminator parameters and dual generator parameters. The learning rate of the dual generator is initially set to 0.0001, and the learning rate of the dual discriminator is initially set to 0.0002. The exponential decay function with a rate of 0.8999 is used to adjust the learning rate. The number of training iterations is set to 15,000 times, the batch size is 200, and the dual discriminator loss function is set to 0.0001. The linear combination coefficient is set to 0.5, and the three-dimensional similarity value parameter of the objective function of the dual generator is , The specific training process is:

[0140] A: From 100-dimensional random noise Sampling in ;

[0141] B: Input into the dual generator to generate RGB feature map And information entropy single channel grayscale image ;

[0142] C: Fusion of the generated RGB feature map and the single-channel grayscale image of information entropy to generate an RGBA feature map ;

[0143] D: Sampling from the minority class true RGBA feature map , , ;

[0144] E: First, fix the parameters of the dual generators, train the dual discriminators through the optimizer Adam, update the parameters of the dual discriminators, and maximize the overall cross loss function of the dual discriminators. , update the parameters of the dual discriminator. The training process of the dual discriminator continues until the number of iterations of the dual discriminator reaches the upper limit.

[0145] F: Fix the parameters of the dual discriminator obtained above, train the dual generator through the optimizer Adam, update the parameters of the dual generator, and minimize the objective function of the dual generator , update the parameters of the dual generator. Generate RGBA feature map by training the dual generator fusion , submitted to the dual discriminator for discrimination, and the discrimination result is obtained and .

[0146] G: Repeat steps (E) to (F) until the dual discriminators and dual generators reach Nash equilibrium to complete the training of the DD-DCGAN adversarial network.

[0147] S15, using the trained adversarial network to generate a minority class prediction feature map, summarizing the minority class feature map, the minority class prediction feature map and the majority class feature map to obtain a user attack feature sample data set with a balanced quantity.

[0148] According to the RGBA feature maps in the real minority class set, a large number of minority class RGBA feature maps are generated using the balanced DD-DCGAN adversarial network. The generated minority class RGBA feature maps and the real RGBA feature maps are aggregated so that their number is stored in the user attack feature balanced sample dataset in a 1:1 ratio with the number of RGBA feature maps in the majority class set, forming a user attack feature sample dataset with a balanced quantity, which effectively improves the problem of imbalanced sample data of user attack behavior traffic features.

[0149] It is understandable that the balance ratio of 1:1 used in this embodiment is only an example. In the actual data set construction, adaptive adjustments can be made according to the harmfulness of the user attack behavior represented in each minority class set, the difficulty of defending the user attack behavior, and the security protection requirements.

[0150] The sample generation method of unbalanced user attack data of the present invention generates an RGBA feature image of a minority attack behavior, wherein the effective information contained in the RGB feature image is three times that of the grayscale image, which can provide more effective information, and the transparency channel is the information entropy representing the randomness of the data during the user attack, which can highlight the characteristic information during the user attack; the matching degree between the data generated by the dual generator and the real data, the absolute mean difference between the real RGBA feature map and the feature map generated by the dual generator, and the discrimination result of the dual discriminator are used as optimization conditions to optimize the training of the dual generator, avoid overfitting of the dual generator, and improve the similarity between the generated data and the real data.

[0151] The embodiment of the present invention further provides a sample generation device for unbalanced user attack data, which is used to execute the sample generation method for unbalanced user attack data as described above. Figure 5 This is a structural block diagram of a sample generation device for unbalanced user attack data according to an embodiment of the present invention, the device comprising:

[0152] The data collection module 21 is used to collect and classify the network user's attack behavior data to obtain a user attack behavior data set containing several types of data.

[0153] The data partitioning module 22 is used to partition the data according to the quantity of each type of data in the user attack behavior data set to obtain a minority class set and a majority class set.

[0154] The feature generation module 23 is used to generate corresponding minority class feature graphs and majority class feature graphs according to the user attack behavior data in the minority class set and the majority class set respectively.

[0155] The network training module 24 is used to construct and train an adversarial network of a dual generator and a dual discriminator according to the minority class feature map. The training process of the adversarial network is designed to optimize the objective function of the dual generator and the loss function of the dual discriminator according to the generation results of the dual generator and the discrimination results of the dual discriminator, so as to realize the training of the adversarial network.

[0156] The data balancing module 25 is used to generate a minority class prediction feature map using the trained adversarial network, and to aggregate the minority class feature map, the minority class prediction feature map and the majority class feature map to obtain a user attack feature sample data set with a balanced quantity.

[0157] The technical features and technical effects of the device proposed in the embodiment of the present invention are the same as those of the method proposed in the embodiment of the present invention, and are not described in detail here. Each module in the above device can be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0158] An embodiment of the present invention further provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the sample generation method of unbalanced user attack data as described above.

[0159] The embodiment of the present invention further provides a computer device, Figure 6 A structural block diagram of a preferred embodiment of a computer device provided by the present invention, wherein the computer device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the sample generation method of unbalanced user attack data as described above when executing the computer program.

[0160] Preferably, the computer program can be divided into one or more modules / units (such as computer program 1, computer program 2, ...), and the one or more modules / units are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units can be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0161] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor, or the processor may be any conventional processor. The processor is the control center of the computer device, and various parts of the computer device are connected using various interfaces and lines.

[0162] The memory mainly includes a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, etc., and the data storage area can store related data, etc. In addition, the memory can be a high-speed random access memory, or a non-volatile memory, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, and a flash card (Flash Card), etc., or the memory can also be other volatile solid-state storage devices.

[0163] It should be noted that the above-mentioned computer device may include, but is not limited to, a processor and a memory. Those skilled in the art will understand that Figure 6 The structural block diagram is merely an example of a computer device and does not constitute a limitation of the computer device, and may include more or less components than shown in the figure, or combine certain components, or different components.

[0164] In summary, the sample generation method, apparatus, device and storage medium of unbalanced user attack data provided by the embodiments of the present invention have the following beneficial effects compared with the prior art:

[0165] (1) Generate RGBA feature images of minority attack behaviors. The effective information contained in the RGB feature image is three times that of the grayscale image, which can provide more effective information. The transparency channel is the information entropy representing the randomness of the data when the user attacks, which can highlight the characteristic information of the user when attacking;

[0166] (2) The matching degree between the data generated by the dual generator and the real data, the absolute mean difference between the real RGBA feature map and the feature map generated by the dual generator, and the discrimination results of the dual discriminator are used as optimization conditions to optimize the training of the dual generator to avoid overfitting of the dual generator and improve the similarity between the generated data and the real data.

[0167] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A sample generation method for unbalanced user attack data, characterized in that: include: Collect and classify the network user's attack behavior data to obtain a user attack behavior data set containing several types of data; Dividing the data according to the quantity of each type of data in the user attack behavior data set to obtain a minority class set and a majority class set; Generating corresponding minority class feature graphs and majority class feature graphs according to the user attack behavior data in the minority class set and the majority class set respectively; An adversarial network of dual generators and dual discriminators is constructed and trained according to the minority class feature map, and the training process of the adversarial network is designed as follows: according to the minority class feature map, a predicted RGB feature map and a predicted information entropy single-channel grayscale map are generated using a first generator and a second generator respectively, and the predicted RGB feature map and the predicted information entropy single-channel grayscale map are fused to obtain a predicted RGBA feature map; the predicted RGBA feature map and the minority class feature map are discriminated according to the first discriminator and the second discriminator to obtain a discrimination result; An objective function is constructed according to the similarity value between the generated result of the dual generator and the real image, the absolute mean difference value of the feature map and the discrimination result of the dual discriminator, and the dual generator is trained according to the objective function. The similarity value is the calculated similarity value between the predicted RGBA feature map and the real image. The calculation process of the similarity value is: in, To calculate the similarity between the predicted RGBA feature map and the real image, is the symbol for similarity calculation, is the expected value of the random noise following the normal distribution, is the expected value of the real minority class RGBA image obeying the real data distribution, To generate the RGB feature map of the image, is the RGB feature map of the real image, To generate a single-channel grayscale image of the information entropy of the image, is the single-channel grayscale image of the information entropy of the real image, To generate the RGBA feature map of the image, is the RGBA feature map of the real image; The absolute mean difference value of the feature map is the absolute mean difference value between the real RGBA feature map and the feature map generated by the dual generator. The calculation process of the absolute mean difference value of the feature map is: in, is the absolute mean difference of the feature map, is the real RGBA feature map pixel mean, The pixel mean of the feature map generated by the dual generator; The first generator is an RGB image generator, the second generator is an information entropy single-channel grayscale image generator, the first discriminator is a conventional discriminator, and the second discriminator is an enhanced discriminator; the second discriminator is used to perform data enhancement processing on the input RGBA feature map, and the data enhancement processing includes at least one of transposition, sharpening or filtering; The trained adversarial network is used to generate a minority class prediction feature map, and the minority class feature map, the minority class prediction feature map and the majority class feature map are summarized to obtain a user attack feature sample data set with a balanced quantity.

2. The sample generation method of unbalanced user attack data according to claim 1, characterized in that: The division is performed according to the quantity of each type of data in the user attack behavior data set to obtain a minority class set and a majority class set, including: Taking the class containing the largest number of user attack behaviors in the user attack behavior data set as a benchmark, calculating the quantity imbalance of each type of data in the user attack behavior data set; A balance threshold for data partitioning is set based on the harmfulness of user attack behaviors, the difficulty of defending against user attack behaviors, and security protection requirements; The minority class set and the majority class set are obtained by performing division according to the quantity imbalance degree and the balance threshold.

3. The sample generation method of unbalanced user attack data according to claim 1, characterized in that: The generating corresponding minority class feature graph and majority class feature graph according to the user attack behavior data in the minority class set and the majority class set respectively includes: Respectively converting the user attack behavior data in the minority class set and the majority class set into hexadecimal data, mapping each of the hexadecimal data in the corresponding RGB image channel, and respectively obtaining a first RGB feature map of the minority class set and a second RGB feature map of the majority class set; Generate a single-channel grayscale image using the information entropy of the user attack behavior data in the minority class set as a first transparency channel; Fusing the first RGB feature map and the first transparency channel to obtain an RGBA feature map of the minority class set; Generate a single-channel grayscale image using the information entropy of the user attack behavior data in the majority class set as a second transparency channel; The second RGB feature map and the second transparency channel are fused to obtain an RGBA feature map of the majority class set.

4. The sample generation method of unbalanced user attack data according to claim 1, characterized in that: The objective function is: in, For the discriminator RGBA feature map generated by the dual generator The judgment result of To enhance the discriminator RGBA feature map generated by the dual generator The judgment result of and are the coefficients of the similarity value and the absolute mean difference of the RGBA feature map; The adversarial network is trained according to the objective function until the dual discriminators and the dual generators reach a Nash equilibrium.

5. A sample generation device for unbalanced user attack data, characterized in that: include: A data collection module is used to collect and classify the network user's attack behavior to obtain a user attack behavior data set containing several types of data; A data partitioning module, used for partitioning the data according to the quantity of each type of data in the user attack behavior data set to obtain a minority class set and a majority class set; A feature generation module, used to generate corresponding minority class feature graphs and majority class feature graphs according to the user attack behavior data in the minority class set and the majority class set respectively; A network training module is used to construct and train an adversarial network of dual generators and dual discriminators according to the minority class feature map, wherein the training process of the adversarial network is designed as follows: according to the minority class feature map, a predicted RGB feature map and a predicted information entropy single-channel grayscale map are generated using a first generator and a second generator respectively, and the predicted RGB feature map and the predicted information entropy single-channel grayscale map are fused to obtain a predicted RGBA feature map; the predicted RGBA feature map and the minority class feature map are discriminated according to the first discriminator and the second discriminator to obtain a discrimination result; An objective function is constructed according to the similarity value between the generated result of the dual generator and the real image, the absolute mean difference value of the feature map and the discrimination result of the dual discriminator, and the dual generator is trained according to the objective function. The similarity value is the calculated similarity value between the predicted RGBA feature map and the real image. The calculation process of the similarity value is: in, To calculate the similarity between the predicted RGBA feature map and the real image, is the symbol for similarity calculation, is the expected value of the random noise following the normal distribution, is the expected value of the real minority class RGBA image obeying the real data distribution, To generate the RGB feature map of the image, is the RGB feature map of the real image, To generate a single-channel grayscale image of the information entropy of the image, is the single-channel grayscale image of the information entropy of the real image, To generate the RGBA feature map of the image, is the RGBA feature map of the real image; The absolute mean difference value of the feature map is the absolute mean difference value between the real RGBA feature map and the feature map generated by the dual generator. The calculation process of the absolute mean difference value of the feature map is: in, is the absolute mean difference of the feature map, is the real RGBA feature map pixel mean, The pixel mean of the feature map generated by the dual generator; The first generator is an RGB image generator, the second generator is an information entropy single-channel grayscale image generator, the first discriminator is a conventional discriminator, and the second discriminator is an enhanced discriminator; the second discriminator is used to perform data enhancement processing on the input RGBA feature map, and the data enhancement processing includes at least one of transposition, sharpening or filtering; The data balancing module is used to generate a minority class prediction feature map using the trained adversarial network, summarize the minority class feature map, the minority class prediction feature map and the majority class feature map, and obtain a user attack feature sample data set with a balanced quantity.

6. A computer device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for generating samples of unbalanced user attack data as claimed in any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the sample generation method of unbalanced user attack data according to any one of claims 1 to 4 is implemented.

Images