A method for generating HTTP traffic mimicry based on multiple generators

Abstract

The present invention discloses a method for generating a mimetic HTTP traffic based on multiple generators, which comprises the following steps in sequence: A: constructing a network traffic data set; B: generating an original traffic sample using a Word2vec network model; C: constructing a generative adversarial network model and training the model; D: inputting Gaussian noise into the generator of the generative adversarial network model to obtain a comparison sample; E: restoring the comparison sample to obtain restored data and inputting it into a traffic generator to generate flow-level data; F: inputting the flow-level data into the traffic generator, generating data packet-level data by constructing a data packet length sequence and a time interval sequence, and obtaining mimetic network traffic data consistent with the data characteristics of the flow-level data and the initial network traffic data. The present invention achieves the purpose of being highly similar to real data in statistical characteristics and data packet construction by learning the pattern of normal network data traffic and performing traffic shaping on existing data.

Description

Technical Field

[0001] The present invention relates to the field of traffic mimicry, and in particular to a method for generating HTTP traffic mimicry based on multiple generators. Background Art

[0002] With the explosive development of the Internet, Internet security has ushered in a huge challenge. A type of attack behavior from the perspective of statistical analysis, namely traffic analysis attacks, is increasing day by day. In the face of this type of attack based on network traffic statistics and from the perspective of real-time data behavior analysis, the existing traffic synthesizers and tunneling technologies cannot effectively avoid this type of attack while ensuring the accuracy and authenticity of the synthesized traffic.

[0003] The purpose of mimicry is to disguise the regulated protocol as a whitelist protocol format to evade the attacker's review. Among the existing research results, even the relatively mature traffic obfuscation technology used by onion routing has the problem of too high data packet entropy, which can be easily detected and identified by deep packet inspection-based technology. Summary of the invention

[0004] The purpose of the present invention is to provide a method for generating http traffic mimicry based on multiple generators, which achieves the purpose of being highly similar to real data in statistical characteristics and data packet structure by learning the pattern of normal network data traffic and performing traffic shaping on existing data.

[0005] The present invention adopts the following technical solutions:

[0006] A method for generating HTTP traffic mimicry based on multiple generators comprises the following steps in sequence:

[0007] A: Construct a network traffic data set; each piece of initial network traffic data in the network traffic data set includes the following data features: total number of packets, source port, destination port, total number of bytes, and flow duration;

[0008] B: Using the Word2vec network model, the initial network traffic data in the network traffic dataset is preprocessed to generate the corresponding Word2vec vector as the original traffic sample;

[0009] C: Build a PyTorch-based generative adversarial network model with multiple generators and parallel discriminators and train the model to obtain the trained generative adversarial network model; the generator in the generative adversarial network model consists of two serial transposed convolution generators, and the first layer of the discriminator is a parallel convolution structure, followed by multiple convolution layers in series;

[0010] D: Input Gaussian noise into the generator of the trained GAN model and use the generated data as comparison samples;

[0011] E: Build a traffic generator, and restore the comparison sample obtained in step D according to the data characteristics to obtain restored data with the same format as the initial network traffic data, and input the restored data into the traffic generator to generate flow-level data;

[0012] F: Input the flow-level data obtained in step E into the traffic generator, which searches for the most similar first N initial network traffic data in the entire network traffic data set for matching based on the input flow-level data, and generates packet-level data by constructing a packet length sequence and a time interval sequence, to obtain pseudo-network traffic data that is consistent with the data characteristics of the flow-level data and the initial network traffic data.

[0013] In the step B, the existing Word2vec network model is used to train the initial network traffic data, and the features of each dimension in a single piece of initial network traffic data are converted into a fixed-length 80-dimensional Word2vec vector. The dimensions of all feature conversions total 400 dimensions. The 400-dimensional vector is then transformed into a 20*20 picture format, and the corresponding Word2vec vector obtained is used as the original traffic sample.

[0014] In the step C, when training the generative adversarial network model based on pytorch's multi-generator and parallel discriminator, the training data is input into the discriminator D of the generative adversarial network model to obtain the Wasserstien distance; if the obtained Wasserstien distance is less than the set distance threshold K1, the training is terminated to obtain the trained generative adversarial network model; if the obtained Wasserstien distance is greater than or equal to the set distance threshold K1, the parameters of the generative adversarial network model are adjusted and the training is continued until the obtained Wasserstien distance is less than the set distance threshold K1, and finally the trained generative adversarial network model is obtained.

[0015] The step D comprises the following specific steps:

[0016] D1: Input multiple 20*20 noise matrices that conform to the Gaussian distribution in the range of [-1, 1] into the first generator G1 of the generative adversarial network model, and the first generator G1 generates intermediate results;

[0017] D2: The intermediate result generated by the first generator G1 is input into the second generator G2 of the generative adversarial network model. The second generator G2 outputs multiple generated data in the form of 20*20 matrices as comparison samples.

[0018] In the step E, the traffic generator includes a data restoration module, a data length matching module, a data packet interval matching module and a data verification module; the data restoration module is used to restore the comparison sample to the original data form; the data packet length matching module is used to generate the data packet length according to the requirements of the flow level data; the data packet interval matching module is used to match the sending time interval between data packets; the data verification module is used to verify the correctness of the generated data packet sequence and the time interval sequence.

[0019] In the step E, when the data restoration module restores the comparison sample according to the data features, the comparison sample is first cut according to the data feature division method in step A. Each comparison sample obtained after cutting is a short vector with a length of 80 dimensions. The short vector is then used to perform similarity matching in the feature information library, and the data feature results with the highest feature similarity to each comparison sample are obtained respectively. Then, several data feature results are combined to finally form a complete flow-level data; the feature information library is formed by the data features of the initial network traffic data through the word2vec model.

[0020] The step F comprises the following specific steps:

[0021] F1: According to the input flow level data, the data packet length matching module in the traffic generator searches for the most similar first N pieces of initial network traffic data in the entire network traffic data set, and randomly selects a data packet in the data packet stream corresponding to a piece of initial network traffic data, and adds the length of the data packet to the generated data packet length sequence; then proceeds to step F2;

[0022] F2: After adding the randomly selected packet length to the packet length sequence, determine whether the Cumul flow accumulation representation of the current packet length sequence is greater than or equal to the set similarity threshold K2 with the Cumul flow accumulation representation of the most similar first N initial network flow data;

[0023] If it is greater than or equal to the set similarity threshold K2, the current data packet length sequence is saved; then the initial network traffic data corresponding to the added data packet length is selected, and the average time interval of the data packets of the initial network traffic data is added to the time interval sequence by the data packet interval matching module, and the current time interval sequence is saved; then the process goes to step F3;

[0024] If it is less than the set similarity threshold K2, after removing the randomly selected data packet length from the generated data packet length sequence, save the current time interval sequence; then return to step F1 and re-randomly select the data packet;

[0025] F3: Continue to randomly add data packets according to the method of steps F1 and F2 until the total number of added data packets is the same as the total number of data packets in the data feature of the stream level data; then proceed to step F4;

[0026] F4: Accumulate the lengths of all randomly added data packets to obtain the total number of bytes M1 of the added data packets; and determine whether the error |M1-M2| / M2 between the total number of bytes M1 and the number of bytes M2 in the data feature of the stream-level data is less than or equal to the set length error threshold K3; if it is less than or equal to the length error threshold K3, save the current data packet length sequence and then enter step F5; if it is greater than the length error threshold K3, return to step F1 and re-select the data packet randomly;

[0027] F5: According to the currently obtained data packet length sequence and time interval sequence, the data flow direction check and data flow duration check are performed using the data check module;

[0028] When performing data flow direction verification, the data flowing out of the source port is defined as the sending data, and the data flowing in from the destination port is defined as the receiving data; if the ratio of the sending data to the receiving data obtained through the data packet length sequence is greater than the set flow direction verification ratio threshold value K4, it is determined that the data flow direction is unreasonable, and the process returns to step F1 to randomly select the data packet again; if the ratio of the sending data to the receiving data obtained through the data packet length sequence is less than or equal to the set flow direction verification ratio threshold value K4, it is determined that the data flow direction is reasonable;

[0029] When performing data flow duration verification, determine whether the error |T1-T2| / T2 between the flow duration T1 of the time interval sequence and the flow duration T2 in the data feature of the flow level data is less than or equal to the set flow duration threshold K5; if it is less than or equal to the set flow duration threshold K5, then determine that the total duration of the data flow of the data is reasonable; if it is greater than the set flow duration threshold K5, then determine that the total duration of the data flow of the data is unreasonable, return to step F1, and re-select the data packet randomly;

[0030] If the results of the data flow direction check and the data flow duration check are both reasonable, a data packet sequence consisting of a data packet length sequence and a time interval sequence is output; then, according to the output data packet sequence, the data packets are filled with loads one by one to obtain the data content of the simulated network traffic data, and the total number of data packets, total number of bytes and flow duration contained in the data content are the same as those in the data characteristics of the flow-level data; and the source port and destination port in the data characteristics of the flow-level data are used as the source port and destination port of the simulated network traffic data respectively; finally, simulated network traffic data consistent with the data characteristics of the flow-level data and the initial network traffic data is obtained.

[0031] The distance threshold K1 is 3.

[0032] The N is 10; the similarity threshold K2 is 0.9, the length error threshold K3 is 0.25; and the flow direction verification ratio threshold K4 is 1.5.

[0033] In the step E, the similarity matching of the comparison samples is calculated using cosine similarity, and the minimum value set when calculating the similarity is 0.8, and the matching results with a similarity lower than 0.8 are discarded.

[0034] The present invention uses a generative adversarial network model based on pytorch's multi-generator and parallel discriminator to learn common normal traffic features, and uses common network security software to identify and verify the mimicry results. The structure of the serial generator adopted in the present invention can make the diversity and accuracy of the generated samples better than the traditional method, and at the same time cooperate with a more rigorous parallel discriminator, and enhance the robustness of the discriminator model on the basis of improving the identification effect through the parallel discriminator. The present invention uses a specially designed traffic generator to generate packet-level data by constructing a packet length sequence and a time interval sequence, and obtains mimic network traffic data that is consistent with the data characteristics of the flow-level data and the initial network traffic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0036] The present invention is described in detail below with reference to the accompanying drawings and embodiments:

[0037] like Figure 1 The method for generating HTTP traffic mimicry based on multiple generators of the present invention comprises the following steps in sequence:

[0038] A: Build a network traffic dataset;

[0039] In the present invention, each piece of initial network traffic data in the network traffic data set includes the following data features: total number of data packets, source port, destination port, total number of bytes and flow duration; the network traffic data are all collected in a normal network traffic environment, and the target websites visited are all well-known domestic websites.

[0040] B: Using the Word2vec network model, the initial network traffic data in the network traffic dataset is preprocessed to generate the corresponding Word2vec vector as the original traffic sample;

[0041] In the present invention, the existing Word2vec network model is used to train the initial network traffic data, and the features of each dimension in a single piece of initial network traffic data are converted into a fixed-length 80-dimensional Word2vec vector. The dimensions of all feature conversions total 400 dimensions. The 400-dimensional vector is then transformed into a 20*20 picture format, and the corresponding Word2vec vector obtained is used as the original traffic sample to simulate normal network traffic.

[0042] C: Build a PyTorch-based generative adversarial network model with multiple generators and parallel discriminators and train the model to obtain the trained generative adversarial network model; the generator in the generative adversarial network model consists of two serial transposed convolution generators, and the first layer of the discriminator is a parallel convolution structure, followed by multiple convolution layers in series;

[0043] In the present invention, the first layer of the specially designed discriminator D is a parallel convolution structure, followed by a series of multiple convolution layers; the first layer adopts a parallel convolution structure, which can sense the characteristics of the data from different fields of view with convolution kernels of different sizes, and judge the authenticity of the data from different angles with different fields of view, thereby increasing the probability of accurately identifying the authenticity. Then, the results obtained by the two different convolution kernel sizes are merged in the channel layer number, thereby obtaining a result set with unchanged length and width but deepened channels, which is further input into the next structure of the discriminator D to continue the convolution operation.

[0044] After the first layer of parallel convolution, the channel layer number operation is performed, and the subsequent convolution architecture no longer uses a parallel architecture, but a serial architecture, that is, the output of the previous layer is directly used as the input of the next layer, and the number of channels is increased and the size of the image is reduced in the process of continuous backward transmission. Since the previous parallel architecture has collected enough field of view information, adding additional parallel architectures will only increase the computational cost. Therefore, the first layer used by the discriminator D in the present invention is a parallel convolution structure, and the structure of the subsequent series of multi-layer convolution layers is more reasonable, which can have both computational overhead and result accuracy.

[0045] In the present invention, when training a generative adversarial network model based on pytorch's multi-generator and parallel discriminator, the training data is input into the discriminator D of the generative adversarial network model to obtain the Wasserstien distance; if the obtained Wasserstien distance is less than the set distance threshold K1, the training is terminated to obtain the trained generative adversarial network model; if the obtained Wasserstien distance is greater than or equal to the set distance threshold K1, the parameters of the generative adversarial network model are adjusted and the training is continued until the obtained Wasserstien distance is less than the set distance threshold K1, and finally the trained generative adversarial network model is obtained;

[0046] In this embodiment, the distance threshold K1 is 3;

[0047] The generative adversarial network model used in the present invention does not directly output the authenticity of the picture like the traditional network model, but outputs the Wasserstien distance used to measure the authenticity of the data of the comparison sample. The Wasserstien distance can not only naturally measure the distance between the discrete distribution and the continuous distribution, but also provides a solution for how to transform one distribution into another distribution, which further stabilizes the training process of the entire generative adversarial network model and makes the data generated by the generative adversarial network model more diversified. In the present invention, if the Wasserstien distance of the original traffic sample and the comparison sample in the training data output by the generative adversarial network model is greater than or equal to 3, it means that the authenticity of the generated data is insufficient, and the parameters in the model need to be modified; if the Wasserstien distance is less than 3, it means that the generated data is very similar to the original traffic data and has a high authenticity.

[0048] The present invention uses a generative adversarial network model based on pytorch's multi-generator and parallel discriminator to learn common normal traffic features, and uses common network security software to identify and verify the mimicry results. The serial generator structure adopted in the present invention can make the diversity and accuracy of the generated samples better than the traditional method, and at the same time cooperate with a more rigorous parallel discriminator, and enhance the robustness of the discriminator model on the basis of improving the identification effect through the parallel discriminator.

[0049] D: Input Gaussian noise into the generator of the trained GAN model and use the generated data as comparison samples;

[0050] In the present invention, the step D comprises the following specific steps:

[0051] D1: Input multiple 20*20 noise matrices that conform to the Gaussian distribution in the range of [-1, 1] into the first generator G1 of the generative adversarial network model, and the first generator G1 generates intermediate results;

[0052] D2: The intermediate result generated by the first generator G1 is input into the second generator G2 of the generative adversarial network model, and the second generator G2 outputs multiple generated data in the form of 20*20 matrices as comparison samples;

[0053] In the present invention, the purpose of generator G1 is to preliminarily generate the characteristics of the data, and the purpose of generator G2 is to further refine the intermediate results based on the intermediate results generated by generator G1, so as to enhance the quality of the generated data. Since the generation capacity of a single generator is limited, in the face of the situation where the gain brought by the continuous deepening of the number of layers of the neural network of a single generator is not as good as the training time cost, the series dual generator solution adopted by the present invention has achieved better results in efficiency and effect. In the present invention, the architecture of transposed convolution is adopted inside each generator, and each layer reduces the number of channels on the basis of the previous layer, and simultaneously increases the length and width attributes of the picture.

[0054] In the present invention, the dual generators connected in series are related to each other, and related update operations are performed during gradient back propagation, which can further strengthen and constrain the cooperative relationship between the two generators.

[0055] In the present invention, the original traffic sample obtained in step B has been converted into a 20*20 picture format through the Word2vec network model to ensure that it has the same format as the comparison sample obtained in step D, thereby adapting to the characteristics of the two-dimensional convolutional structure.

[0056] E: Build a traffic generator, and restore the comparison sample obtained in step D according to the data characteristics to obtain restored data with the same format as the initial network traffic data, and input the restored data into the traffic generator to generate flow-level data;

[0057] In the present invention, the traffic generator includes a data restoration module, a data length matching module, a data packet interval matching module and a data verification module; the data restoration module is used to restore the comparison sample to the original data form; the data packet length matching module is used to generate the data packet length according to the requirements of the flow level data; the data packet interval matching module is used to match the sending time interval between data packets; the data verification module is used to verify the correctness of the generated data packet sequence and the time interval sequence.

[0058] In the present invention, since the comparison samples generated by the generator are consistent with the format of the original traffic samples generated by the initial network traffic data through the Word2vec network model, the comparison samples need to be input into the data restoration module to be restored and converted into normal network traffic data (original data form, i.e., the same format as the initial network traffic data) before use.

[0059] When the data restoration module restores the comparison sample according to the data features (the data features include the total number of data packets, source port, destination port, total number of bytes and flow duration recorded in step A), the comparison sample is first cut according to the data feature division method in step A. Each comparison sample obtained after cutting is a short vector with a length of 80 dimensions. The short vector is then used to perform similarity matching in the feature information library to obtain the data feature results with the highest feature similarity to each comparison sample, and then several data feature results are combined to finally form a complete flow-level data.

[0060] Among them, the feature information library is formed by the data features of the initial network traffic data through the word2vec model.

[0061] In the present invention, the similarity matching of the comparison samples is calculated using cosine similarity. The minimum value set when calculating the similarity is 0.8, and the matching results with a similarity lower than 0.8 are discarded.

[0062] F: Input the flow-level data obtained in step E into the traffic generator, which searches for the most similar first N initial network traffic data in the entire network traffic data set for matching based on the input flow-level data, and generates packet-level data by constructing a packet length sequence and a time interval sequence, to obtain pseudo-network traffic data that is consistent with the data characteristics of the flow-level data and the initial network traffic data.

[0063] In the present invention, the step F comprises the following specific steps:

[0064] F1: According to the input flow level data, the data packet length matching module in the traffic generator searches for the most similar first N pieces of initial network traffic data in the entire network traffic data set, and randomly selects a data packet in the data packet stream corresponding to a piece of initial network traffic data, and adds the length of the data packet to the generated data packet length sequence; then proceeds to step F2;

[0065] In the present invention, considering that the size of N has a great influence on the computing performance, if N is too small, the diversity of the generated samples will be insufficient, and if N is too large, the computing time will be significantly prolonged and the model efficiency will be reduced; therefore, after continuous attempts and weighing the diversity and efficiency, the applicant determines the value range of N to be [5,15]. In this embodiment, N=10;

[0066] In the prior art, the packet length matching module generally selects packets according to length characteristics and time intervals. However, in this application scenario, the database generated by network traffic data is very large, and the number of packets contained in the packet flow is large. Assuming that each packet flow has 10 packets, there are There are possible permutations and combinations. If a full permutation method is used to search, the time cost of the program is unacceptable. Therefore, the present invention adopts a method of randomly adding data packets, which on the one hand further increases the diversity of generated data and on the other hand effectively shortens the time cost.

[0067] F2: After adding the randomly selected packet length to the packet length sequence, determine whether the Cumul flow accumulation representation of the current packet length sequence is greater than or equal to the set similarity threshold K2 with the Cumul flow accumulation representation of the most similar first N initial network flow data;

[0068] If it is greater than or equal to the set similarity threshold K2, the current data packet length sequence is saved; then the initial network traffic data corresponding to the added data packet length is selected, and the average time interval of the data packets of the initial network traffic data is added to the time interval sequence by the data packet interval matching module, and the current time interval sequence is saved; then the process goes to step F3;

[0069] If it is less than the set similarity threshold K2, after removing the randomly selected data packet length from the generated data packet length sequence, save the current time interval sequence; then return to step F1 and re-randomly select the data packet;

[0070] In this embodiment, the similarity threshold K2 is 0.9;

[0071] In the present invention, when the randomly selected data packet length is added to the generated data packet length sequence in the data packet length matching module, the Cumul flow cumulative representation is used to guide the generation of the data packet length sequence. The Cumul flow cumulative representation specifically sets the size of the data packet entering the node to a positive value, and the size of the data packet flowing out of the node to the opposite number, and then the inflow and outflow of the data packet of the entire data node are cumulatively represented according to time. The Cumul flow cumulative representation is a prior art in the field and will not be described in detail here;

[0072] F3: Continue to randomly add data packets according to the method of steps F1 and F2 until the total number of added data packets is the same as the total number of data packets in the data feature of the stream level data; then proceed to step F4;

[0073] F4: Accumulate the lengths of all randomly added data packets to obtain the total number of bytes M1 of the added data packets; and determine whether the error |M1-M2| / M2 between the total number of bytes M1 and the number of bytes M2 in the data feature of the stream-level data is less than or equal to the set length error threshold K3; if it is less than or equal to the length error threshold K3, save the current data packet length sequence and then enter step F5; if it is greater than the length error threshold K3, return to step F1 and re-select the data packet randomly;

[0074] In this embodiment, the length error threshold K3 is 0.25;

[0075] F5: According to the currently obtained data packet length sequence and time interval sequence, the data flow direction check and data flow duration check are performed using the data check module;

[0076] When performing data flow direction verification, the data flowing out of the source port is defined as the sending data, and the data flowing in from the destination port is defined as the receiving data; if the ratio of the sending data to the receiving data obtained through the data packet length sequence is greater than the set flow direction verification ratio threshold value K4, it is determined that the data flow direction is unreasonable, and the process returns to step F1 to randomly select the data packet again; if the ratio of the sending data to the receiving data obtained through the data packet length sequence is less than or equal to the set flow direction verification ratio threshold value K4, it is determined that the data flow direction is reasonable;

[0077] In this embodiment, the flow direction verification ratio threshold K4 is 1.5;

[0078] When performing data flow duration verification, determine whether the error |T1-T2| / T2 between the flow duration T1 of the time interval sequence and the flow duration T2 in the data feature of the flow level data is less than or equal to the set flow duration threshold K5; if it is less than or equal to the set flow duration threshold K5, then determine that the total duration of the data flow of the data is reasonable; if it is greater than the set flow duration threshold K5, then determine that the total duration of the data flow of the data is unreasonable, return to step F1, and re-select the data packet randomly;

[0079] If the results of the data flow direction check and the data flow duration check are both reasonable, a data packet sequence consisting of a data packet length sequence and a time interval sequence is output; then, according to the output data packet sequence, the data packets are filled with loads one by one to obtain the data content of the simulated network traffic data, and the total number of data packets, total number of bytes and flow duration contained in the data content are the same as those in the data characteristics of the flow-level data; and the source port and destination port in the data characteristics of the flow-level data are used as the source port and destination port of the simulated network traffic data respectively; finally, simulated network traffic data consistent with the data characteristics of the flow-level data and the initial network traffic data is obtained.

Claims

1. A method for generating HTTP traffic mimicry based on multiple generators, characterized in that: The following steps are included in sequence: A: Construct a network traffic data set; each piece of initial network traffic data in the network traffic data set includes the following data features: total number of packets, source port, destination port, total number of bytes, and flow duration; B: Using the Word2vec network model, the initial network traffic data in the network traffic dataset is preprocessed to generate the corresponding Word2vec vector as the original traffic sample; C: Build a PyTorch-based generative adversarial network model with multiple generators and parallel discriminators and train the model to obtain the trained generative adversarial network model; the generator in the generative adversarial network model consists of two serial transposed convolution generators, and the first layer of the discriminator is a parallel convolution structure, followed by multiple convolution layers in series; D: Input Gaussian noise into the generator of the trained GAN model and use the generated data as comparison samples; E: Build a traffic generator, and restore the comparison sample obtained in step D according to the data characteristics to obtain restored data with the same format as the initial network traffic data, and input the restored data into the traffic generator to generate flow-level data; F: Input the flow-level data obtained in step E into the traffic generator, which searches for the most similar first N initial network traffic data in the entire network traffic data set for matching based on the input flow-level data, and generates packet-level data by constructing a packet length sequence and a time interval sequence, to obtain pseudo-network traffic data that is consistent with the data characteristics of the flow-level data and the initial network traffic data.

2. According to the multi-generator-based http traffic mimicry generation method according to claim 1, it is characterized in that: In the step B, the existing Word2vec network model is used to train the initial network traffic data, and the features of each dimension in a single piece of initial network traffic data are converted into a fixed-length 80-dimensional Word2vec vector. The dimensions of all feature conversions total 400 dimensions. The 400-dimensional vector is then transformed into a 20*20 picture format, and the corresponding Word2vec vector obtained is used as the original traffic sample.

3. The method for generating HTTP traffic mimicry based on multiple generators according to claim 1 is characterized in that: In the step C, when training the generative adversarial network model based on pytorch's multi-generator and parallel discriminator, the training data is input into the discriminator D of the generative adversarial network model to obtain the Wasserstien distance; if the obtained Wasserstien distance is less than the set distance threshold K1, the training is terminated to obtain the trained generative adversarial network model; if the obtained Wasserstien distance is greater than or equal to the set distance threshold K1, the parameters of the generative adversarial network model are adjusted and the training is continued until the obtained Wasserstien distance is less than the set distance threshold K1, and finally the trained generative adversarial network model is obtained.

4. The method for generating HTTP traffic mimicry based on multiple generators according to claim 1 is characterized in that: The step D comprises the following specific steps: D1: Input multiple 20*20 noise matrices that conform to the Gaussian distribution in the range of [-1, 1] into the first generator G1 of the generative adversarial network model, and the first generator G1 generates intermediate results; D2: The intermediate result generated by the first generator G1 is input into the second generator G2 of the generative adversarial network model. The second generator G2 outputs multiple generated data in the form of 20*20 matrices as comparison samples.

5. The method for generating HTTP traffic mimicry based on multiple generators according to claim 1 is characterized in that: In the step E, the traffic generator includes a data restoration module, a data length matching module, a data packet interval matching module and a data verification module; the data restoration module is used to restore the comparison sample to the original data form; the data packet length matching module is used to generate the data packet length according to the requirements of the flow level data; the data packet interval matching module is used to match the sending time interval between data packets; the data verification module is used to verify the correctness of the generated data packet sequence and the time interval sequence.

6. The method for generating HTTP traffic mimicry based on multiple generators according to claim 5 is characterized in that: In the step E, when the data restoration module restores the comparison sample according to the data features, the comparison sample is first cut according to the data feature division method in step A. Each comparison sample obtained after cutting is a short vector with a length of 80 dimensions. Then, the short vector is used to perform similarity matching in the feature information library, and the data feature results with the highest feature similarity with each comparison sample are obtained respectively. Then, several data feature results are combined to finally form a complete stream-level data. The feature information database is formed by the data features of the initial network traffic data through the word2vec model.

7. The method for generating HTTP traffic mimicry based on multiple generators according to claim 1 is characterized in that: The step F comprises the following specific steps: F1: According to the input flow-level data, the packet length matching module in the traffic generator searches for the most similar first N pieces of initial network traffic data in the entire network traffic data set, and randomly selects a packet in the packet stream corresponding to a piece of initial network traffic data, and adds the length of the packet to the generated packet length sequence; Then go to step F2; F2: After adding the randomly selected packet length to the packet length sequence, determine whether the Cumul flow accumulation representation of the current packet length sequence is greater than or equal to the set similarity threshold K2 with the Cumul flow accumulation representation of the most similar first N initial network flow data; If it is greater than or equal to the set similarity threshold K2, the current data packet length sequence is saved; then the initial network traffic data corresponding to the added data packet length is selected, and the average time interval of the data packets of the initial network traffic data is added to the time interval sequence by the data packet interval matching module, and the current time interval sequence is saved; then the process goes to step F3; If it is less than the set similarity threshold K2, after removing the randomly selected data packet length from the generated data packet length sequence, save the current time interval sequence; then return to step F1 and re-randomly select the data packet; F3: Continue to randomly add data packets according to the method of steps F1 and F2 until the total number of added data packets is the same as the total number of data packets in the data feature of the stream level data; then proceed to step F4; F4: Accumulate the lengths of all randomly added data packets to obtain the total number of bytes M1 of the added data packets; and determine whether the error |M1-M2| / M2 between the total number of bytes M1 and the number of bytes M2 in the data feature of the stream-level data is less than or equal to the set length error threshold K3; if it is less than or equal to the length error threshold K3, save the current data packet length sequence and then enter step F5; if it is greater than the length error threshold K3, return to step F1 and re-select the data packet randomly; F5: According to the currently obtained data packet length sequence and time interval sequence, the data flow direction check and data flow duration check are performed using the data check module; When performing data flow direction verification, the data flowing out of the source port is defined as the sending data, and the data flowing in from the destination port is defined as the receiving data; if the ratio of the sending data to the receiving data obtained through the data packet length sequence is greater than the set flow direction verification ratio threshold value K4, it is determined that the data flow direction is unreasonable, and the process returns to step F1 to randomly select the data packet again; if the ratio of the sending data to the receiving data obtained through the data packet length sequence is less than or equal to the set flow direction verification ratio threshold value K4, it is determined that the data flow direction is reasonable; When performing data flow duration verification, determine whether the error |T1-T2| / T2 between the flow duration T1 of the time interval sequence and the flow duration T2 in the data feature of the flow level data is less than or equal to the set flow duration threshold K5; if it is less than or equal to the set flow duration threshold K5, then determine that the total duration of the data flow of the data is reasonable; if it is greater than the set flow duration threshold K5, then determine that the total duration of the data flow of the data is unreasonable, return to step F1, and re-select the data packet randomly; If the results of the data flow direction check and the data flow duration check are both reasonable, a data packet sequence consisting of a data packet length sequence and a time interval sequence is output; then, according to the output data packet sequence, the data packets are filled with loads one by one to obtain the data content of the simulated network traffic data, and the total number of data packets, total number of bytes and flow duration contained in the data content are the same as those in the data characteristics of the flow-level data; and the source port and destination port in the data characteristics of the flow-level data are used as the source port and destination port of the simulated network traffic data respectively; finally, simulated network traffic data consistent with the data characteristics of the flow-level data and the initial network traffic data is obtained.

8. The method for generating HTTP traffic mimicry based on multiple generators according to claim 3 is characterized in that: The distance threshold K1 is 3.

9. The method for generating HTTP traffic mimicry based on multiple generators according to claim 7 is characterized in that: The N is 10; the similarity threshold K2 is 0.9, the length error threshold K3 is 0.25; and the flow direction verification ratio threshold K4 is 1.

5.

10. The method for generating HTTP traffic mimicry based on multiple generators according to claim 6, characterized in that: In the step E, the similarity matching of the comparison samples is calculated using cosine similarity, and the minimum value set when calculating the similarity is 0.8, and the matching results with a similarity lower than 0.8 are discarded.

Images