General traffic image generation method for solving unbalanced network traffic classification

Abstract

The invention relates to the technical field of computers, in particular to a general traffic image generation method for solving unbalanced network traffic classification, which comprises the following steps of: arranging and combining original network traffic into a session stream according to a time sequence based on a session stream mode, and converting the session stream into an image by taking a data packet as a unit. Converting the effective load of each data packet into a grayscale image; the SCGAN is used for training; eliminating noise by adopting a convolution noise reduction auto-encoder, and performing high-definition reconstruction on the generated flow sample; and combining a minority of types of traffic image samples generated through high-definition reconstruction with the original real traffic samples. According to the method, when the data packets are converted into the traffic images, the time sequence dependency relationship of the network traffic is reserved, the structural features among the data packets in image representation are also reserved, a balanced new network traffic data set is constructed, the authenticity and diversity of the data set are kept, and the generalization ability and effect of the model are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a universal traffic image generation method for solving network traffic classification imbalance. Background Art

[0002] Existing methods for representing network traffic data include traditional extraction from PCAP files and visualization using mature computer vision algorithms. Extracting network traffic data from traditional PCAP files requires not only a deep understanding and processing of the complex PCAP file format but also the reliance on expert experience to design complex statistical features for classification. This often consumes considerable time and effort on the part of researchers, even impacting subsequent work. While visualization of network traffic data using mature computer vision algorithms can accurately convert each byte into a pixel and map each byte to a corresponding pixel value, generating a complete image that more intuitively and reasonably displays the inherent characteristics of network traffic, it also fails to account for the varying size and number of packets within a flow. This makes it difficult to distinguish different packets in the generated traffic image, hindering the study of inter-packet dependencies. Furthermore, in real-world network environments, most network traffic tends to fall into a few common types, while malicious and unconventional traffic is relatively rare in datasets. Importantly, these minor traffic types are generally of greater concern. This imbalance phenomenon will cause the classification model to be unable to obtain enough feature information during the training process, causing the model to be more inclined to predict traffic samples as the majority category and ignore minority samples, which in turn affects the classification effect. Summary of the Invention

[0003] The present invention aims to at least address the technical problems existing in the prior art. To this end, the present invention proposes a universal traffic image generation method to address the imbalanced classification of network traffic. This method significantly improves the class imbalance problem of network traffic datasets and enhances the ability of classification models to accurately identify minority classes.

[0004] According to some embodiments of the present invention, a general traffic image generation method for solving network traffic classification imbalance includes the following steps:

[0005] S100, merging the original network traffic into a session flow in chronological order based on the session flow, removing data packets irrelevant to the encryption flow classification, and converting the payload of each data packet into an image using a method of converting the data packet into an image;

[0006] S200 uses SCGAN for training to add realistic traffic samples to the minority class of traffic image generation; a convolutional denoising autoencoder is used to remove noise and reconstruct the generated traffic samples in high definition;

[0007] S300, merging the minority category traffic image samples generated by high-definition reconstruction with the original real traffic samples to obtain a new balanced real data set.

[0008] According to some embodiments of the present invention, a general traffic image generation method for solving network traffic classification imbalance has at least the following beneficial effects:

[0009] The present invention introduces a minority sample generation mechanism based on generative adversarial networks (SCGAN), which can automatically generate realistic minority traffic image samples, thereby significantly improving the scarcity of minority samples in the original dataset and enhancing the classification model's ability to recognize minority classes. It adopts a method of merging data packets in chronological order based on session flows and converting them into grayscale images in units of single data packets. This not only retains the temporal dependency of network traffic, but also retains the structural features between data packets in the image representation, which is conducive to the deep learning model to better capture the behavioral patterns of traffic. At the same time, a convolutional denoising autoencoder (CDAE) is introduced to perform high-definition reconstruction of the generated traffic images and remove noise interference in the images. SCGAN-CDAE is used to construct a balanced new network traffic dataset, maintaining the authenticity and diversity of the dataset and improving the generalization ability and effect of the model.

[0010] According to some embodiments of the present invention, a general traffic image generation method for solving the imbalance of network traffic classification is provided, wherein the session flow-based method is to merge the original network traffic into a session flow S in a time sequence. session Including: using the quintuple-based partitioning method to extract the bidirectional conversation flow S session , S session Formalized as S session =S Src→Dst ∪S Dst→Src , where S Src→Dst Indicates a packet flow with source IP address Src, destination IP address Dst, and source port SrcPort. Dst→Src It represents the data packet flow with source IP address Dst, destination IP address Src and source port DstPort, and the symbol ∪ represents the merging operation of these two data packet flows in time order.

[0011] According to some embodiments of the present invention, a general traffic image generation method for solving the imbalance of network traffic classification is provided. The method of converting the data packet into an image comprises: extracting the first m bytes of the application layer data of each data packet, where m is a perfect square number. The total number of data packets taken at the same time, n, is also a perfect square number. If the length exceeds m bytes, the remaining part will be truncated. If it is less than m bytes, it will be padded with 0x00. The byte data is read and each byte is converted into the corresponding integer. Finally, the obtained integer value is converted to s p ×s p Pictures of Each P generated i By merging the images, a grayscale image can be obtained.

[0012] According to some embodiments of the present invention, a general traffic image generation method for solving the imbalance of network traffic classification is provided. Step S200 includes: applying a generator G and a discriminator D in the SCGAN model framework, wherein the generator G uses a deconvolutional network structure to transform the input category information y and statistical features s z and a random noise vector ∈ that conforms to the Gaussian distribution, are mapped through a fully connected layer with a RELU activation function to obtain a low-dimensional hidden feature vector h0, and then h0 is upsampled through multiple layers of deconvolution to finally form a fake traffic sample x; the discriminator D distinguishes between samples from real data and fake traffic samples x, and determines the actual category to which the fake traffic sample x belongs.

[0013] According to a general traffic image generation method for solving network traffic classification imbalance according to some embodiments of the present invention, the working process of the generator G can be expressed as follows:

[0014]

[0015] Deconv represents the deconvolution operation, which is to apply transposed convolution to expand the size of the feature map, W i and b i represents the weights and biases of the i-th deconvolution layer.

[0016] According to some embodiments of the present invention, a general traffic image generation method for solving the imbalance of network traffic classification is provided. The discriminator D network includes three sub-networks, namely a fully connected network, a one-dimensional convolutional network, and an LSTM network. The outputs of the three sub-networks are spliced ​​together and mapped into a new feature h through a fully connected layer. yzxt , and then classified by the Softmax activation function to obtain the category label distribution y of the input sample x.

[0017] According to some embodiments of the present invention, a general traffic image generation method for solving network traffic classification imbalance is provided, wherein a fully connected network is used to extract category information y and statistical feature vector x. z , expressed as: h yz =ReLU(W yz [y,s z ]+b yz ); where W yz and b yz are the weights and biases of the fully connected layer respectively; the spatiotemporal features of sample x extracted by the one-dimensional convolutional network and LSTM sub-network are expressed as:

[0018] h x =Conv1D(x)

[0019] h t =LSTM(x)

[0020] Among them, Conv1D represents a one-dimensional convolution operation, and LSTM is a long short-term memory network used to extract long-term dependencies of sequence data x;

[0021] The category label distribution y is expressed as:

[0022] y=Softmax(W y [h yzxt ]+b y )

[0023] Among them, W y and b y are the weights and biases of the fully connected layers.

[0024] According to some embodiments of the present invention, a general traffic image generation method for solving the imbalance of network traffic classification is provided. The generator G and the discriminator D continuously compete with each other, restrain each other, and grow together, and eventually reach a state of dynamic equilibrium. The generator G optimizes the objective function minimization formula during the training process as follows:

[0025]

[0026] Where (i) is the i-th generated sample, D(.) is the discrimination result of the discriminator D on the generated sample, D(.) is the generated sample obtained by the generator G by transforming the input noise, category information and statistical characteristics, and m is the number of generated samples;

[0027] Discriminator D y The following formula is used to maximize the optimization objective function for discriminating the actual category of traffic samples:

[0028]

[0029] Here x(i) represents the i-th real sample, and the definitions of other symbols are the same as the minimization formula of the optimization objective function of the generator G.

[0030] According to some embodiments of the present invention, a general traffic image generation method for solving the imbalance of network traffic classification is provided. The convolutional denoising autoencoder is composed of an encoder and a decoder. The core of the encoder is composed of several convolutional layers. The convolutional layers are composed of a convolution operation and a nonlinear activation function. The convolutional layers extract useful information from the input image samples and perform compression encoding. The decoder module is composed of multiple deconvolution operations. Each deconvolution layer is composed of a deconvolution operation and a nonlinear activation function. The deconvolution operation upsamples the feature map generated by the convolution operation in the encoder to obtain a size similar to the original image.

[0031] According to some embodiments of the present invention, a general traffic image generation method for solving the imbalance of network traffic classification is provided. Step S300 further includes: when constructing a training set, giving priority to selecting real samples; when constructing a test set, retaining a portion of real samples to evaluate the performance of the model in a real scenario.

[0032] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments with reference to the accompanying drawings, in which:

[0034] Figure 1 The process of the embodiment of the present invention Figure 1 .

[0035] Figure 2 The process of the embodiment of the present invention Figure 2 .

[0036] Figure 3 Flowchart of converting the payload of each data packet into a grayscale image according to the present invention.

[0037] Figure 4 FIG. 4 is a flow chart of the merging operation when n=4 and m=256 according to the present invention. DETAILED DESCRIPTION

[0038] The following describes embodiments of the present invention in detail. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended only to explain the present invention and are not to be construed as limiting the present invention.

[0039] In the description of the present invention, it should be understood that descriptions involving orientations, such as up, down, left, right, front, and back, etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the modules or components referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, they cannot be understood as limitations on the present invention.

[0040] In the description of the present invention, if there is a description of first and second, it is only for the purpose of distinguishing the technical features, and cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0041] In the description of the present invention, unless otherwise clearly defined, terms such as setting, installing, and connecting should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in the present invention based on the specific content of the technical solution.

[0042] like Figures 1-4 As shown, an embodiment of the present invention provides a general traffic image generation method for solving the imbalance of network traffic classification.

[0043] A general traffic image generation method for solving the imbalance of network traffic classification includes the following steps:

[0044] S100, based on the session flow method, the original network traffic is arranged in time sequence and merged into a session flow S session , and remove the data packets that are not related to the encryption flow classification, and use the method of converting the data packet into an image unit to convert the payload of each data packet into a grayscale image;

[0045] S200 uses SCGAN for training to add realistic traffic samples to the minority class of traffic image generation; a convolutional denoising autoencoder is used to remove noise and reconstruct the generated traffic samples in high definition;

[0046] S300, merging the minority category traffic image samples generated by high-definition reconstruction with the original real traffic samples to obtain a new balanced real data set.

[0047] The present invention introduces a minority sample generation mechanism based on a generative adversarial network (SCGAN), which can automatically generate realistic minority traffic image samples, thereby significantly improving the problem of scarcity of minority samples in the original data set and improving the classification model's recognition ability of minority classes. It adopts a method of merging data packets in chronological order based on session flow and converting them into grayscale images in units of single data packets. It not only retains the temporal dependency of network traffic, but also retains the structural features between data packets in image representation, which is conducive to the deep learning model to better capture the behavior pattern of traffic. At the same time, it introduces a convolutional denoising autoencoder (CDAE) to perform high-definition reconstruction of the generated traffic image, remove noise interference in the image, and use SCGAN-CDAE to construct a balanced new network traffic dataset, maintain the authenticity and diversity of the dataset, and improve the generalization ability and effect of the model.

[0048] It is understandable that after extracting the network session flow, it is necessary to remove data packets that are not related to the encryption flow classification to eliminate noise and redundancy in the data set. Since IP addresses and MAC addresses change frequently in real environments, the model may be overly focused on the source of the data packet, causing the model to learn incorrect information. Therefore, the present invention only retains the application layer data packets in each session flow, and does not consider IP address information. In this way, our traffic visualization method can better retain the interaction information between data packets, extract more fine-grained features for each data packet from the network flow, and more accurately capture the changes and patterns of data packets in different time periods. In addition, the present invention adopts a method of converting data packets into images, rather than just taking the first m bytes of the network flow and converting them into images, so that the processed traffic image can accurately locate different data packets. The present invention also uses a timestamp-based method to maintain the original time order of the data packets, so that when performing the convolution operation, it can better identify and distinguish data packets in different time periods and accurately extract the features of each data packet.

[0049] The embodiment of the present invention provides a general traffic image generation method for solving the imbalance of network traffic classification. The method based on the session flow is to merge the original network traffic into a session flow S in time sequence. session Including: using the quintuple-based partitioning method to extract the bidirectional conversation flow S session , S session Formalized as S session =S Src→Dst ∪S Dst→Src , where S Src→Dst Indicates a packet flow with source IP address Src, destination IP address Dst, and source port SrcPort. Dst→SrcIt represents the data packet flow with source IP address Dst, destination IP address Src and source port DstPort, and the symbol ∪ represents the merging operation of these two data packet flows in time order.

[0050] like Figure 3 As shown, the method of converting the payload of each data packet into an image in units of data packets includes extracting the first m bytes of the application layer data of each data packet, where m is a perfect square number. The total number of data packets taken at the same time, n, is also a perfect square number. If the length exceeds m bytes, the remaining part will be truncated. If it is less than m bytes, it will be padded with 0x00. The byte data is read and each byte is converted into the corresponding integer. Finally, the obtained integer value is converted to s p ×s p Pictures of Each P generated i The images are merged to obtain a grayscale session image. Specifically, if the number of data packets is less than n, the filling method is also used to fill it. For example, when n = 4 and m = 256, the entire merging operation process is as follows: Figure 4 shown.

[0051] The general traffic image generation method for solving the imbalance of network traffic classification described in this embodiment includes step S200: applying the generator G and the discriminator D in the SCGAN model framework, the generator G uses the deconvolution network structure to transform the input category information y and statistical features s z and a random noise vector ∈ that conforms to the Gaussian distribution, are mapped through a fully connected layer with a RELU activation function to obtain a low-dimensional hidden feature vector h0, and then h0 is upsampled through multiple layers of deconvolution to finally form a fake traffic sample x; the discriminator D distinguishes between samples from real data and fake traffic samples x, and determines the actual category to which the fake traffic sample x belongs.

[0052] In the general traffic image generation method for solving the imbalance of network traffic classification described in this embodiment, the working process of the generator G can be expressed as follows:

[0053]

[0054] Deconv represents the deconvolution operation, which is to apply transposed convolution to expand the size of the feature map, W i and b i represents the weights and biases of the i-th deconvolution layer.

[0055] In this embodiment, a general traffic image generation method for solving the imbalance of network traffic classification is described. The discriminator D network includes three sub-networks, namely a fully connected network, a one-dimensional convolutional network, and an LSTM network. The outputs of the three sub-networks are spliced ​​together and mapped into a new feature h through a fully connected layer. yzxt , and then classified by the Softmax activation function to obtain the category label distribution y of the input sample x.

[0056] In this embodiment, a general traffic image generation method for solving the imbalance of network traffic classification is described, in which a fully connected network is used to extract category information y and statistical feature vector x. z , expressed as: h yz =ReLU(W yz [y,s z ]+b yz ); where W yz and b yz are the weights and biases of the fully connected layer respectively; the spatiotemporal features of sample x extracted by the one-dimensional convolutional network and LSTM sub-network are expressed as:

[0057] h x =Conv1D(x)

[0058] h t =LSTM(x)

[0059] Among them, Conv1D represents a one-dimensional convolution operation, and LSTM is a long short-term memory network used to extract long-term dependencies of sequence data x;

[0060] The category label distribution y is expressed as:

[0061] y=Softmax(W y [h yzxt ]+b y )

[0062] Among them, W y and b y are the weights and biases of the fully connected layers.

[0063] In this embodiment, a general traffic image generation method for solving the imbalance of network traffic classification is described. The generator G and the discriminator D continuously compete with each other, restrain each other, and grow together, eventually reaching a dynamic equilibrium state. The formula for minimizing the objective function optimized by the generator G during the training process is:

[0064]

[0065] Where (i) is the i-th generated sample, D(.) is the discrimination result of the discriminator D on the generated sample, D(.) is the generated sample obtained by the generator G by transforming the input noise, category information and statistical characteristics, and m is the number of generated samples;

[0066] Discriminator D y The following formula is used to maximize the optimization objective function for discriminating the actual category of traffic samples:

[0067]

[0068] Here x(i) represents the i-th real sample, and the definitions of other symbols are the same as the minimization formula of the optimization objective function of the generator G.

[0069] After repeated generation and discrimination training using the SCGAN model framework, the generator can generate samples that are very close to the true distribution, while the discriminator can also accurately judge true and false samples and categories.

[0070] After the SCGAN model framework is trained, its generator is used to fuse and encode the input traffic categories, statistical features, and random noise. A decoding operation is then performed to generate a traffic image that matches the conditions. However, considering that the network traffic image samples generated by this data balancing technique may contain noise, a convolutional denoising autoencoder (CDAE) is proposed to effectively eliminate the noise. This reconstructs the generated samples into high-definition images, making them closer to real samples.

[0071] The embodiment of the present invention provides a general traffic image generation method for solving the imbalance of network traffic classification. The core of the encoder module is composed of several convolutional layers. The convolutional layers are composed of a convolution operation and a nonlinear activation function. These layers can extract useful information from the input image samples and perform compression encoding. It can be expressed as follows:

[0072] Enc(X noisy ;Θ enc )=f(Conv(X noisy ;Θ enc ))

[0073] Where f(·) represents the activation function, Conv(·; Θ enc ) represents the convolution operation, Θ enc Is the parameter of the encoding operation. X noisy Expressed as:

[0074]

[0075] X real Represents real network traffic image samples, represents Gaussian noise with mean μ and variance σ.

[0076] The decoder and encoder are symmetrical. The decoder module consists of multiple deconvolution operations. Each deconvolution layer consists of a deconvolution operation and a nonlinear activation function. The deconvolution operation upsamples the feature map generated by the convolution operation in the encoder to obtain a size similar to the original image. The operation formula of the decoder is:

[0077] Dec(Enc(X noisy ;Θ enc );Θ dec )=g(Deconv(Enc(X noisy ;Θ enc ),Θ dec ))

[0078] Among them, g(·) is the activation function, Deconv(·; Θ dec ) represents the deconvolution operation, Θ dec are the parameters for the decoding operation.

[0079] Finally, in order to minimize the square error between the real network traffic data and the reconstructed network traffic data, we continuously adjust the parameters Θ of the autoencoder enc and Θ dec , which enables the convolutional denoising autoencoder to effectively optimize the network traffic image samples generated by SCGAN and improve their quality. The loss function is defined as:

[0080]

[0081] The general traffic image generation method described in this embodiment to solve the imbalance of network traffic classification is to merge the minority class traffic image samples generated by SCGAN-CDAE with the original real traffic samples, and ensure that the proportion of minority class samples matches the proportion of other class samples to avoid reintroducing the data imbalance problem. When constructing the training set, real samples are given priority to ensure that the model learns sufficient real data information. In terms of the test set, a portion of real samples is retained to evaluate the performance of the model in real scenarios, but it is also possible to consider including generated samples to test the model's generalization ability on unseen data.

[0082] After this stage, a new balanced network traffic dataset can be constructed, in which the number of samples in each category is relatively balanced, and the authenticity and diversity of the dataset are maintained. Such a dataset can be better used for model training and evaluation, improving the generalization ability and effect of the model.

[0083] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the claims and their equivalents.

Claims

1. A general traffic image generation method for solving the imbalance of network traffic classification, characterized by: The following steps are involved: S100, based on the session flow method, the original network traffic is arranged in time sequence and merged into a session flow S session , and remove the data packets that are not related to the encryption flow classification, and use the method of converting the data packet into an image unit to convert the payload of each data packet into a grayscale image; S200 uses SCGAN for training to add realistic traffic samples to the minority class of traffic image generation; a convolutional denoising autoencoder is used to remove noise and reconstruct the generated traffic samples in high definition; S300, merging the minority category traffic image samples generated by high-definition reconstruction with the original real traffic samples to obtain a new balanced real data set.

2. A general traffic image generation method for solving network traffic classification imbalance according to claim 1, characterized in that: The session flow-based approach combines the original network traffic into a session flow S in chronological order. session Including: using the quintuple-based partitioning method to extract the bidirectional conversation flow S session , S session Formalized as S session =S Src→Dst ∪S Dst→Src , where S Src→Dst Indicates a packet flow with source IP address Src, destination IP address Dst, and source port SrcPort. Dst→Src It represents the data packet flow with source IP address Dst, destination IP address Src and source port DstPort, and the symbol ∪ represents the merging operation of these two data packet flows in time order.

3. A general traffic image generation method for solving network traffic classification imbalance according to claim 1, characterized in that: The method of converting the payload of each data packet into an image in units of data packets includes extracting the first m bytes of the application layer data of each data packet, where m is a perfect square number. The total number of data packets taken at the same time, n, is also a perfect square number. If the length exceeds m bytes, the remaining part will be truncated. If it is less than m bytes, it will be padded with 0x00. The byte data is read and each byte is converted into the corresponding integer. Finally, the obtained integer value is converted to s p ×s p The picture of Each P generated i By merging the images, a grayscale image can be obtained.

4. A general traffic image generation method for solving network traffic classification imbalance according to claim 1, characterized in that: Step S200 includes: applying the generator G and the discriminator D in the SCGAN model framework, the generator G uses the deconvolution network structure to transform the input category information y and statistical features s z and a random noise vector ∈ that conforms to the Gaussian distribution, are mapped through a fully connected layer with a RELU activation function to obtain a low-dimensional hidden feature vector h0, and then h0 is upsampled through multiple layers of deconvolution to finally form a fake traffic sample x; the discriminator D distinguishes between samples from real data and fake traffic samples x, and determines the actual category to which the fake traffic sample x belongs.

5. A general traffic image generation method for solving network traffic classification imbalance according to claim 4, characterized in that: The working process of the generator G can be expressed as: Deconv represents the deconvolution operation, which is to apply transposed convolution to expand the size of the feature map, W i and b i represents the weights and biases of the i-th deconvolution layer.

6. A general traffic image generation method for solving network traffic classification imbalance according to claim 4, characterized in that: The discriminator D network consists of three sub-networks: a fully connected network, a one-dimensional convolutional network, and an LSTM network. The outputs of the three sub-networks are spliced ​​together and mapped into a new feature h through a fully connected layer. yzxt , and then classified by the Softmax activation function to obtain the category label distribution y of the input sample x.

7. A general traffic image generation method for solving network traffic classification imbalance according to claim 6, characterized in that: The fully connected network is used to extract category information y and statistical feature vector x z , expressed as: h yz =ReLU(W yz [y,s z ]+b yz ); Among them, W yz and b yz are the weights and biases of the fully connected layer respectively; the spatiotemporal features of sample x extracted by the one-dimensional convolutional network and LSTM sub-network are expressed as: h x =Conv1D(x) h t =LSTM(x) Among them, Conv1D represents a one-dimensional convolution operation, and LSTM is a long short-term memory network used to extract long-term dependencies of sequence data x; The category label distribution y is expressed as: y=Softmax(W y [h yzxt ]+b y ) Among them, W y and b y are the weights and biases of the fully connected layers.

8. A general traffic image generation method for solving network traffic classification imbalance according to claim 7, characterized in that: The generator G and the discriminator D are constantly competing with each other, restraining each other, and growing together, and finally reaching a state of dynamic equilibrium. The formula for minimizing the objective function optimized by the generator G during the training process is: Where (i) is the i-th generated sample, D(.) is the discrimination result of the discriminator D on the generated sample, D(.) is the generated sample obtained by the generator G by transforming the input noise, category information and statistical characteristics, and m is the number of generated samples; Discriminator D y The following formula is used to maximize the optimization objective function for discriminating the actual category of traffic samples: where x (i) It represents the i-th real sample, and the definitions of other symbols are the same as the minimization formula of the optimization objective function of the generator G.

9. A general traffic image generation method for solving network traffic classification imbalance according to claim 1, characterized in that: The convolutional denoising autoencoder consists of an encoder and a decoder. The core of the encoder consists of several convolutional layers. The convolutional layers consist of a convolution operation and a nonlinear activation function. The convolutional layers extract useful information from the input image samples and perform compression encoding. The decoder module consists of multiple deconvolution operations. Each deconvolution layer consists of a deconvolution operation and a nonlinear activation function. The deconvolution operation upsamples the feature map generated by the convolution operation in the encoder to obtain a size similar to the original image.

10. A general traffic image generation method for solving network traffic classification imbalance according to claim 1, characterized in that: Step S300 also includes giving priority to real samples when constructing a training set, and retaining a portion of real samples when constructing a test set to evaluate the performance of the model in real scenarios.

Images