A network traffic generation method based on a generative adversarial network

Abstract

The application discloses a network traffic generation method based on a generative adversarial network. The method is as follows: preprocessing a data set, including attribute feature evaluation, text conversion to a value, missing value processing, and feature data normalization; designing a generative adversarial network model architecture for network traffic generation, including a generator module, a discriminator module, and a network reward mechanism; then training the network model, divided into two stages of model pre-training and formal training; data evaluation and screening of the generated traffic data, including quality evaluation, similarity evaluation, and label evaluation, screening qualified samples to form a labeled traffic set. The application uses WGAN-GP to design the model, and combines LSTM to further learn the time characteristics of the network traffic sequence, so that the generated network traffic data is improved in classification label, authenticity and success rate, and can provide a large amount of high-quality labeled data for network intrusion detection model training based on machine learning.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network traffic generation, and particularly relates to a network traffic generation method based on a generative adversarial network. BACKGROUND

[0002] With the rapid development of network technology, the types and quantities of traffic data in the network space are increasing, and the progress of machine learning methods also provides new network attack tools for malicious actors, resulting in a large number of new and complex malicious attacks. The first line of defense against these attacks is the network intrusion detection system (NIDS), which can understand the network activity pattern by monitoring the traffic and issue an alarm when encountering malicious traffic. In recent years, a large number of studies have been devoted to developing network intrusion detection systems based on machine learning, which requires the use of a large amount of high-quality training data.

[0003] Network traffic data has important practical significance for testing network devices, network services and security products, but due to the lack of labels, authenticity and the involvement of user privacy information security, there is a lack of quantity and quality assurance, so the traffic generation problem has been a widespread concern in the academic and business communities at home and abroad, and is an important research topic in the field of network management and security today. Network traffic generation methods can be divided into three categories: network traffic generation methods based on statistical models, network traffic generation methods based on autoregressive models and network traffic generation methods based on generative adversarial networks.

[0004] The method based on statistical model is suitable for network performance testing, but due to its limited representation ability, it cannot generate high-fidelity Internet traffic data sets; the synthetic data realized by the autoregressive model does not improve the accuracy of the anomaly detection model compared to real data. Since generative adversarial networks have achieved remarkable results in many generation tasks, including video, audio and image generation, models based on generative adversarial networks have become the mainstream method in network traffic generation. As a generative deep learning model, the generative adversarial network model avoids some of the shortcomings of traditional generation models in practical applications. The learning process of the generative adversarial network does not require approximate reasoning, and it cleverly approximates some unsolvable loss functions through game theory, i.e. adversarial learning, which is its greatest innovation. However, generative adversarial networks are not perfect, and while they solve existing problems, they also create new difficulties, such as training with the original generative adversarial network suffering from mode collapse, i.e. the generator tends to generate some similar data with confidence, but is reluctant to try to generate new data with no confidence, resulting in a lack of diversity in the samples. In addition, in the problem of network traffic generation, the real validity and time correlation of network traffic data also need to be considered, which is a key problem that current existing methods have failed to capture and solve. SUMMARY

[0005] The application aims to provide a network traffic generation method capable of generating a large amount of high-quality labeled data for a network intrusion detection system.

[0006] The technical solution for achieving the application is a network traffic generation method based on a generative adversarial network, comprising the following steps:

[0007] Step 1: Preprocessing the data set, including attribute feature evaluation, text conversion to numerical value, missing value processing, and feature data normalization.

[0008] Step 2: Designing a generative adversarial network model architecture for network traffic generation, including a generator module, a discriminator module, and a network reward mechanism.

[0009] Step 3: Training the network model, divided into two stages of model pre-training and formal training.

[0010] Step 4: Data evaluation and screening of the generated traffic data, including quality evaluation, similarity evaluation, and label evaluation, and screening qualified samples to form a labeled traffic set.

[0011] Further, the preprocessing of the data set in step 1 includes attribute feature evaluation, text conversion to numerical value, missing value processing, and feature data normalization, specifically:

[0012] The current publicly available data set and real network traffic are used for preprocessing, including attribute feature evaluation, text conversion to numerical value, missing value processing, and feature data normalization.

[0013] Further, the preprocessing of the data set in step 1 includes attribute feature evaluation, text conversion to numerical value, missing value processing, and feature data normalization, and the steps are as follows:

[0014] Step 1.1: Attribute feature evaluation: Use public traffic data sets and real network traffic for traffic data generation experiments. Data set one contains more than 2 million network streams with 49 attributes and 9 attack categories, and data set two contains more than 2.8 million network traffic with 80 features. First, remove the timestamp attribute column that is not suitable for machine learning, and set the dataset_features dictionary.

[0015] Step 1.2: Convert the attack type in the source file to a digital identifier.

[0016] Step 1.3: Delete the row with missing values in the source data.

[0017] Step 1.4: Normalize the feature data.

[0018] Further, step 2 described the design of a generative adversarial network model architecture for network traffic generation, including a generator module, a discriminator module and a network reward mechanism, specifically:

[0019] The generative adversarial network GAN includes a generator module and a discriminator module, which learns through the continuous game of two neural networks, thereby generating synthetic data that is difficult for the discriminator to distinguish;

[0020] The method model uses a Wasserstein GAN with gradient penalty, i.e. WGAN-GP, combined with a long short-term memory network LSTM to capture the time correlation in network traffic sequences, and designs a generator and a discriminator, respectively, and uses a network reward mechanism to improve the generation quality.

[0021] Further, step 2 described the design of a generative adversarial network model architecture for network traffic generation, including a generator module, a discriminator module and a network reward mechanism, and the steps are as follows:

[0022] Step 2.1, the network model uses a variant of the generative adversarial network, i.e. the Wasserstein GAN with gradient penalty, i.e. WGAN-GP, compared with the classic generative adversarial network, WGAN improves from the perspective of loss function;

[0023] The Wasserstein distance is calculated to measure the distance between the data distribution and the real data distribution, and the formula is as follows:

[0024]

[0025] Where inf denotes the maximum lower bound; π(P1, P2) represents all possible joint distributions of distributions P1 and P2, and each joint distribution is used to describe the cost of converting between distributions in continuous space, i.e. the percentage required to convert from x to y so that x, y follow the same distribution;

[0026] Step 2.2, modify the objective function of the original generative adversarial network, improve the Lipschitz continuity constraint condition on the basis of WGAN, change the weight pruning strategy to gradient constraint, thereby improve the modeling ability of the model, solve the problem of gradient disappearance or gradient explosion; The objective function of the improved W generative adversarial network-GP is calculated as follows:

[0027]

[0028] Where the first half is the critic loss of the original W generative adversarial network, and the second half adds a regularization term, which is the gradient constraint GP;

[0029] Step 2.3, In order to capture the time correlation in the traffic sequence, the long short-term memory network (LSTM) is combined into the generator model, and the Attention-LSTM structure is introduced in G to extract the time characteristics of the sample data;

[0030] Step 2.4, Considering the opposite objectives between G, D and the specific patterns of network flows, a reward mechanism is designed to improve the quality of data generation, and the reward value is divided into two parts, namely the discrimination reward and the inspection reward, and the calculation methods are as follows:

[0031] Discrimination reward:

[0032]

[0033] Where D is the discriminator, is the cumulative value, s is the state, and a is the action, Only complete network flow X is calculated 1:t If the generation work is not completed, the remaining attributes are sampled by Monte Carlo (MC) search;

[0034] Inspection reward:

[0035] Therefore, the final network reward calculation formula is as follows:

[0036]

[0037] Further, the calculation formula of the LSTM structure in step 2.3 at each position is as follows:

[0038] Input gate: i t = σ(W i *[h t-1 ,x t ]+b i )

[0039] Forget gate: f t = σ(W f *[h t-1 ,x t ]+b f )

[0040]

[0041] Output gate: o t = σ(W o [h t-1 ,x t ]+b o )

[0042] Long memory:

[0043] Short memory: h t =o t *tanh(C t )

[0044] Furthermore, the training of the network model described in step 3 is divided into two stages: model pre-training and formal training, specifically as follows:

[0045] The generator G and discriminator D are pre-trained. Then, the batch size is set to 64, and the network is trained in batches. The training is set to 100 iterations, and 20,000 samples are generated for each dataset.

[0046] Furthermore, the training of the network model described in step 3 is divided into two stages: model pre-training and formal training, as follows:

[0047] Step 3.1: Use the Maximum Likelihood Estimation (MLE) algorithm to pre-train the generator G; then pre-train the discriminator D and keep it in balance with the generator G.

[0048] Step 3.2: Formal training of the generative model, setting the learning rates of G and D to 0.005 and 0.01 respectively, and training G more times than D; the formal training is set to 100 rounds, with step sizes of 1 and 5 for G and D respectively;

[0049] Step 3.3: Feedback network rewards to the generator G to further guide training. Calculate the reward according to the designed discrimination reward formula, and check whether the generated stream has passed the domain knowledge check to calculate the check reward. Then, feed the reward back to the generator to guide the next round of generation training.

[0050] Step 3.4: Save the network parameters for formal training, the generated traffic data samples, and finally save the loss values ​​of G and D for each round for subsequent result evaluation.

[0051] Furthermore, step 4 involves data evaluation and filtering of the generated traffic data, including quality evaluation, similarity evaluation, and labeling evaluation, to select qualified samples and form a labeled traffic set. Specifically:

[0052] For the generated data results, domain knowledge is used to check and evaluate the validity of the data; the feature distribution is visualized by kernel density estimation (KDE), and the similarity is evaluated by calculating the Wasserstein distance between the actual traffic distribution and the synthetic traffic distribution; the data labeling is evaluated by calculating the bias rate of the data labels; finally, qualified samples are selected and integrated to form a new high-quality labeled traffic set.

[0053] Further, data evaluation and screening are performed on the generated traffic data in step 4, including quality evaluation, similarity evaluation and label evaluation, and the qualified samples form a labeled traffic set, as follows:

[0054] Step 4.1, quality evaluation, field knowledge inspection is performed on the generated data stream;

[0055] Step 4.2, similarity evaluation, similarity is evaluated by kernel density estimation, calculation of Wasserstein distance between actual traffic distribution and synthetic traffic distribution;

[0056] Step 4.3, label evaluation, data label is evaluated by bias rate calculation;

[0057] Step 4.4, synthetic labeled traffic set, qualified samples are screened by piecewise inspection of the generated data, and a new labeled traffic set is formed.

[0058] Compared with the prior art, the present application has the following advantages: (1) two complete and reliable data sets in the current network security intrusion detection field are selected for model training and evaluation, which are representative and reliable; (2) the trained WGAN-GP model can solve the problem of traditional model mode collapse, and the sample quality is improved; (3) the LSTM network is innovatively introduced into the generator module to capture the time correlation of the traffic sequence, and the sample authenticity is increased; (4) a targeted network reward mechanism is designed, thereby further improving the generation quality of the model. BRIEF DESCRIPTION OF DRAWINGS

[0059] Figure 1 is a flow schematic diagram of a network traffic generation method based on a generative adversarial network according to the present application.

[0060] Figure 2 is a flow schematic diagram of data set preprocessing in an embodiment of the present application.

[0061] Figure 3 is a structural schematic diagram of a network model architecture in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The present application will be further described in detail below in combination with the drawings and specific embodiments.

[0063] In combination with Figure 1 , the network traffic generation method based on the generative adversarial network according to the present application comprises the following steps:

[0064] Step 1, preprocessing of the data set, including attribute feature evaluation, text conversion to numerical value, missing value processing, and feature data normalization;

[0065] Step 2, design a generative adversarial network model architecture for network traffic generation, including a generator module, a discriminator module, and a network reward mechanism;

[0066] Step 3, training the network model, divided into two stages of model pre-training and formal training;

[0067] Step 4, data evaluation and screening of generated traffic data, including quality evaluation, similarity evaluation and label evaluation, screening qualified samples to form a labeled traffic set.

[0068] As a specific example, in step 1, the current publicly available data set and real network traffic are preprocessed. Including attribute feature evaluation of traffic data, text to value, missing value processing and feature data normalization, as follows:

[0069] Step 1.1, attribute feature evaluation: the method uses public traffic data sets and real network traffic for traffic data generation experiments, data set one contains more than 2 million network streams with 49 attributes and 9 attack categories, data set two contains more than 2.8 million network traffic with 80 features, first need to remove the timestamp attribute column not suitable for machine learning, set dataset_features dictionary;

[0070] Step 1.2, convert text to value, convert attack type in source file to digital identifier;

[0071] Step 1.3, delete the row with missing values in the source data;

[0072] Step 1.4, normalize the feature data;

[0073] Step 1.5, divide the data set into training set and test set, and pre-set the model output 20000 samples as the evaluation generation set.

[0074] As a specific example, in step 2, the method model uses WGAN-GP with gradient penalty, combined with LSTM to capture the time correlation in network traffic sequence, to realize generator and discriminator respectively, and uses network reward mechanism to improve generation quality; The network model architecture design is as follows:

[0075] Step 2.1, the network model uses a variant of generative adversarial network, WGAN-GP with gradient penalty, compared with the classic generative adversarial network, WGAN mainly improves the loss function, which can get good performance results even in fully connected layer;

[0076] The method measures the distance between the data distribution and the real data distribution by calculating the Wasserstein distance, and the calculation formula is as follows:

[0077]

[0078] Where inf denotes the maximum lower bound, and pi(P1, P2) represents all possible joint distributions of distributions P1 and P2, each joint distribution is used to describe the cost of converting between distributions in a continuous space, that is, the percentage required to transfer from x point to y point so that x and y follow the same distribution;

[0079] Step 2.2, modify the objective function of the original generative adversarial network, improve the Lipschitz continuity constraint on the basis of WGAN, change the weight pruning strategy to gradient constraint, so as to improve the modeling ability of the model and solve the problem of gradient disappearance or gradient explosion. The objective function of the improved WGAN-GP is calculated as follows:

[0080]

[0081] Where the first half is the critic loss of the original WGAN, and the second half adds a regularization term, which is the gradient constraint GP;

[0082] Step 2.3, in order to capture the time correlation in the traffic sequence, the long short-term memory network LSTM is combined into the generator model, and the Attention-LSTM structure is introduced into G to extract the main features of the sample data;

[0083] The calculation formula of the LSTM structure at each position is as follows:

[0084] Input gate: i t = σ(W i *[h t-1 ,x t ]+b i )

[0085] Forget gate: f t = σ(W f *[h t-1 ,x t ]+b f )

[0086]

[0087] Output gate: o t = σ(W o [h t-1 ,x t ]+b o )

[0088] Long memory:

[0089] Short memory: h t = o t = tanh(C t )

[0090] Step 2.4. Considering the opposite goals between G, D and the specific mode of network flow, the method designs a novel reward mechanism to improve the quality of data generation, which is divided into two parts, namely the identification reward and the inspection reward, and the calculation methods are as follows:

[0091] Identification reward:

[0092]

[0093] Where D is the discriminator, is the cumulative value, s is the state, and a is the action, Only complete network flow X 1:t If the generation work is not completed, the remaining attributes are sampled by Monte Carlo (MC) search.

[0094] Inspection reward:

[0095] Therefore, the final network reward calculation formula is as follows:

[0096]

[0097] As a specific example, in step 3, in order to enable the model to better guide further training, the method pre-trains the generator G and the discriminator D instead of randomly initializing the parameters; then the formal training of the model is carried out, the training parameters of each module are set, the network reward is fed back to the generator according to the calculation, and the further generation training is guided, which is as follows:

[0098] Step 3.1, use the maximum likelihood estimation MLE algorithm to pre-train the generator G; then pre-train the discriminator D, and keep the balance with the generator G;

[0099] Step 3.2, formally train the generation model, set the learning rate of G and D to 0.005 and 0.01 respectively, and train G more times than D to increase stability; the formal training is set for 100 rounds, and the step length of G and D is 1 and 5 respectively;

[0100] Step 3.3, feed back the network reward to the generator G to further guide the training, calculate according to the designed identification reward formula, and check whether the generated flow passes the domain knowledge inspection to calculate the inspection reward, then feed back Reward to the generator to guide the next round of generation training;

[0101] Step 3.4, save the formal training network parameters, the generated traffic data samples, and finally save the loss value of each round G and D for subsequent result evaluation.

[0102] As a specific example, in step 4, for the generated data results, the effectiveness of the data is checked and evaluated using domain knowledge; the feature distribution is visualized by kernel density estimation (kde), and the similarity is evaluated by calculating the Wasserstein distance between the actual traffic distribution and the synthetic traffic distribution. In addition, the data label is evaluated by calculating the bias rate of the data label, and finally the qualified samples are screened and integrated to form a new high-quality labeled traffic set, as follows:

[0103] Step 4.1, quality evaluation, domain knowledge check on the generated data stream;

[0104] Step 4.2, similarity evaluation, evaluate similarity by kernel density estimation, calculate Wasserstein distance between actual traffic distribution and synthetic traffic distribution;

[0105] Step 4.3, label evaluation, evaluate data label by calculating the bias rate of the data label;

[0106] Step 4.4, synthetic labeled traffic set, qualified samples are screened by checking each piece of generated data to form a new labeled traffic set.

[0107] The application will be further described in detail below in combination with the drawings and specific embodiments.

[0108] Embodiment

[0109] In combination with Figure 1 , the embodiment of the application is a network traffic generation method based on a generative adversarial network, which includes the following steps:

[0110] Step 1, use the currently publicly available data set and real network flow for preprocessing Use the currently publicly available data set and real network traffic for preprocessing, including traffic data attribute feature evaluation, text conversion to numerical value, missing value processing and feature data normalization, in combination with Figure 2 , as follows:

[0111] Step 1.1, attribute feature evaluation, the method uses two public traffic data sets and real network traffic for traffic data generation experiments, data set one contains more than 2 million network streams with 49 attributes and 9 attack categories, and data set two contains more than 2.8 million network traffic with 80 features. First, remove IP and timestamp attributes that are not suitable for machine learning, and set the dataset_features dictionary.

[0112] Step 1.2, convert text to value, convert protocol type, attack type, etc. in the source file line into digital identification;

[0113] Step 1.3, delete the line where the missing value in the source data is located, for example, there are NaN and Infinity dirty data in the 15th column and the 16th column in the second data set, which need to be removed;

[0114] Step 1.4, normalize the feature data;

[0115] Step 1.5, divide the data set into training set and test set, and preset the model output 20000 samples as the generated set for evaluation.

[0116] Step 2, the method model uses WGAN-GP with gradient penalty, introduces LSTM to capture the time correlation in network traffic sequence, realizes generator and discriminator respectively, and uses network reward mechanism to improve the generation quality, combined with Figure 3 , as follows:

[0117] Step 2.1, the network model uses a variant of generative adversarial network-Wasserstein GAN (WGAN-GP), compared with the classic generative adversarial network, WGAN mainly improves from the perspective of loss function, which can get good performance results even in fully connected layer;

[0118] The method measures the distance between the data distribution and the real data distribution by calculating the Wasserstein distance, and the calculation formula is as follows:

[0119]

[0120] Where inf represents the maximum lower bound, and π(P1, P2) represents all possible joint distributions in distribution P1 and P2. Each joint distribution is used to describe the cost of converting distribution in continuous space, that is, the percentage required to convert x point to y point so that x and y follow the same distribution;

[0121] Step 2.2, modify the objective function of the original generative adversarial network, improve the Lipschitz continuity constraint condition on the basis of WGAN, change the weight pruning strategy to gradient constraint mode, so as to improve the modeling ability of the model, solve the problem of gradient disappearance or gradient explosion; The objective function of improved WGAN-GP is calculated as follows:

[0122]

[0123] Where the first half is the critic loss of the original WGAN, and the second half adds a regularization term, which is the gradient penalty GP;

[0124] Step 2.3, in order to capture the time correlation in the traffic sequence, the long short-term memory network LSTM is innovatively combined into the generator model, and the Attention-LSTM structure is introduced into G to extract the main features of the sample data;

[0125] The calculation formula of each position of the LSTM structure is as follows:

[0126] Input gate: i t = sigma (W i *[h t-1 ,x t ]+b i )

[0127] Forget gate: f t = sigma (W f *[h t-1 ,x t ]+b f )

[0128]

[0129] Output gate: o t = sigma (W o [h t-1 ,x t ]+b o )

[0130] Long memory:

[0131] Short memory: h t = o t *tanh (C t )

[0132] Step 2.4, considering the opposite objectives between G, D and the specific patterns of network flow, the method designs a novel reward mechanism to improve the quality of data generation, and the reward value is divided into two parts, namely the discrimination reward and the inspection reward, and the calculation methods are respectively:

[0133] Discrimination reward:

[0134]

[0135] Where D is the discriminator, is the cumulative value, s is the state, and a is the action, Only complete network flow X 1:tIf the generation work is not completed, the remaining attributes are sampled through a Monte Carlo (MC) search.

[0136] Check reward:

[0137] Therefore, the final network reward calculation formula is as follows:

[0138]

[0139] Step 3, in order to make the model better guide further training, the method pre-trains the generator G and the discriminator D instead of randomly initializing the parameters, and then carries out formal training of the model, sets the training parameters of each module, feeds back the calculated network reward to the generator, and guides further generation training, the method is as follows:

[0140] Step 3.1, pre-train the generator G and the discriminator D, adopt the maximum likelihood estimation MLE algorithm, set the pre-training iteration to 100 rounds, the batch size is 64, and save the pre-trained network parameters of G and D as pre_g. Pth and pre_d. Pth files to the conf file directory;

[0141] Step 3.2, load the network parameters obtained by pre-training to carry out formal training. The generator module adopts two sub-generators, that is, a combination of a multilayer perceptron (MLP) and a long short-term memory network (LSTM), wherein the MLP uses a sigmoid activation function, and a linear function of a pytorch machine learning library is used to define a neural network linear layer for generating a traffic sequence, and the LSTM focuses on long-term and short-term time patterns of the traffic sequence, and captures time sequence features to further guide the generation of the traffic sequence. The training process of the discriminator is alternating and opposite to that of the generator. Since the main purpose of the application is the generation module, the MLP is sufficient for the identification module in the network traffic, so the D adopts the structure design. The formal training iteration is 100 rounds, the steps of G and D are 1 and 5 respectively, the Adam optimizer is used, the learning rate is set to 0.01 and 0.005, and 20000 samples are generated;

[0142] Step 3.3, feed back the network reward to the generator G to further guide the training, calculate according to the designed identification reward formula, and calculate the check reward by checking whether the generated flow passes the domain knowledge check, then feed back the reward to the generator to guide the next round of generation training;

[0143] Step 3.4, save the formal training network parameters g.pth and d.pth to the conf directory, save the generated traffic data samples traffic.csv to the target directory, and finally save the loss values g_losses.csv and d_losses.csv of G and D in each round to the target directory, which are used for subsequent result evaluation.

[0144] Step 4, for the generated data results, use domain knowledge to check and evaluate the effectiveness of the data, visualize the feature distribution through kernel density estimation (kde), and evaluate the similarity by calculating the Wasserstein distance between the actual traffic distribution and the synthetic traffic distribution, in addition, evaluate the data label by calculating the bias rate of the data label, and finally filter the qualified samples to form a new labeled traffic set, as follows:

[0145] Step 4.1, quality evaluation, domain knowledge check is performed on the generated data stream;

[0146] Step 4.2, similarity evaluation, evaluate the similarity by kernel density estimation, and calculate the Wasserstein distance between the actual traffic distribution and the synthetic traffic distribution;

[0147] Step 4.3, label evaluation, evaluate the data label by calculating the bias rate of the data label;

[0148] Step 4.4, synthetic labeled traffic set, qualified samples are filtered by checking the generated data one by one to form a new labeled traffic set.

[0149] In summary, the first, the two data sets selected in the current network security intrusion detection field are relatively complete and reliable for model training and evaluation, which are representative and reliable; the second, the trained WGAN-GP model can solve the problem of traditional model mode collapse, and improves the sample quality; the third, the LSTM network is innovatively introduced into the generator module to capture the time correlation of the traffic sequence, increasing the sample authenticity; the fourth, a targeted network reward mechanism is designed, further improving the generation quality of the model.

Claims

1. A method for generating network traffic based on generative adversarial networks, characterized in that, Includes the following steps: Step 1: Preprocess the dataset, including attribute feature evaluation, text to numerical conversion, missing value handling, and feature data normalization. Step 2: Design the architecture of a generative adversarial network model for network traffic generation, including a generator module, a discriminator module, and a network reward mechanism; Step 3: Train the network model, which is divided into two stages: model pre-training and formal training; Step 4: Evaluate and filter the generated traffic data, including quality evaluation, similarity evaluation, and label evaluation, and select qualified samples to form a labeled traffic set; Step 2 describes the design of a generative adversarial network (GAN) model architecture for network traffic generation, including a generator module, a discriminator module, and a network reward mechanism. The steps are as follows: Step 2.1: The network model uses a variant of generative adversarial network—Wasserstein GAN with gradient penalty, or WGAN-GP. Compared with the classic generative adversarial network, WGAN improves from the perspective of loss function. The Wasserstein distance is used to measure the distance between the data distribution and the true data distribution. The formula is as follows: ； Where inf refers to the largest lower bound; This represents the distribution. and In the context of all possible joint distributions, each joint distribution is used to characterize the cost of the transformation between distributions in a continuous space, that is, the percentage required to move from point x to point y so that x and y follow the same distribution; Step 2.2: Modify the objective function of the original Generative Adversarial Network (WGAN). Improve the Lipschitz continuity constraint on top of WGAN, and change the weight pruning strategy to a gradient constraint approach. This enhances the model's modeling ability and solves the gradient vanishing or exploding problem. The improved objective function of the WGAN-GP is calculated as follows: ； The first part is the original WGAN's critical loss, and the second part adds a regularization term, which is the gradient constraint GP. Step 2.3: In order to capture the temporal correlation in the traffic sequence, the Long Short-Term Memory (LSTM) network is combined with the generator model, and an Attention-LSTM structure is introduced in G to extract the temporal characteristics of the sample data. Step 2.4: Considering the conflicting objectives between G, D, and specific patterns of network flow, a reward mechanism is designed to improve the quality of data generation. The reward value is divided into two parts: an identification reward and an inspection reward, calculated as follows: Identification Rewards: ; Where D is the discriminator. This is a cumulative value. Let 'a' be the state and 'a' be the behavior. Only calculate the complete network flow If the generation work is not completed, the remaining attributes are sampled through Monte Carlo (MC) search; Inspection Rewards: ; Therefore, the final network reward calculation formula is as follows: 。 2. The network traffic generation method based on generative adversarial networks according to claim 1, characterized in that, Step 1 involves preprocessing the dataset, including attribute feature evaluation, text-to-numerical conversion, missing value handling, and feature data normalization. Specifically: Preprocessing is performed using currently publicly available datasets and real network traffic, including attribute feature evaluation of traffic data, text-to-numerical conversion, missing value handling, and feature data normalization.

3. The network traffic generation method based on generative adversarial networks according to claim 2, characterized in that, Step 1 involves preprocessing the dataset, including attribute feature evaluation, text-to-numerical conversion, missing value handling, and feature data normalization. The steps are as follows: Step 1.1, Attribute Feature Evaluation: Conduct traffic data generation experiments using public traffic datasets and real network traffic. Dataset 1 contains more than 2 million network flows with 49 attributes and 9 attack categories, and Dataset 2 contains more than 2.8 million network flows with 80 features. First, remove attribute columns that are not suitable for machine learning by removing timestamps, and set the dataset_features dictionary. Step 1.2: Convert the text into numerical values ​​and convert the attack type in the source file into a numerical identifier; Step 1.3: Delete the rows containing missing values ​​in the source data; Step 1.4: Normalize the feature data.

4. The network traffic generation method based on generative adversarial networks according to claim 1, characterized in that, Step 2 describes the design of a generative adversarial network (GAN) model architecture for network traffic generation, including a generator module, a discriminator module, and a network reward mechanism, specifically: Generative Adversarial Networks (GANs) consist of a generator module and a discriminator module. Through continuous learning and competition between the two neural networks, they generate synthetic data that is difficult for the discriminator to distinguish. The method model uses Wasserstein GAN with gradient penalty, namely WGAN-GP, combined with Long Short-Term Memory (LSTM) network to capture the temporal correlation in network traffic sequences. The generator and discriminator are designed separately, and a network reward mechanism is used to improve the generation quality.

5. The network traffic generation method based on generative adversarial networks according to claim 4, characterized in that, The calculation formulas for each position in the LSTM structure in step 2.3 are as follows: Input Gate: ; Forgotten Gate: ; ； Output gate: ; Long memory: ; Short memory: .

6. The network traffic generation method based on generative adversarial networks according to claim 1, characterized in that, Step 3, which involves training the network model, consists of two stages: model pre-training and formal training. The generator G and discriminator D are pre-trained. Then, the batch size is set to 64, and the network is trained in batches. The training is set to 100 iterations, and 20,000 samples are generated for each dataset.

7. The network traffic generation method based on generative adversarial networks according to claim 6, characterized in that, Step 3 involves training the network model, which is divided into two stages: model pre-training and formal training. The steps are as follows: Step 3.1: Use the Maximum Likelihood Estimation (MLE) algorithm to pre-train the generator G; then pre-train the discriminator D and keep it in balance with the generator G. Step 3.2: Formal training of the generative model, setting the learning rates of G and D to 0.005 and 0.01 respectively, and training G more times than D; the formal training is set to 100 rounds, with step sizes of 1 and 5 for G and D respectively; Step 3.3: Feedback network rewards to the generator G to further guide training. Calculate the reward according to the designed discrimination reward formula, and check whether the generated stream has passed the domain knowledge check to calculate the check reward. Then, feed the reward back to the generator to guide the next round of generation training. Step 3.4: Save the network parameters for formal training, the generated traffic data samples, and finally save the loss values ​​of G and D for each round for subsequent result evaluation.

8. The network traffic generation method based on generative adversarial networks according to claim 1, characterized in that, Step 4 involves evaluating and filtering the generated traffic data, including quality evaluation, similarity evaluation, and labeling evaluation, to select qualified samples and form a labeled traffic set. Specifically: For the generated data results, domain knowledge is used to check and evaluate the validity of the data; the feature distribution is visualized by kernel density estimation (KDE), and the similarity is evaluated by calculating the Wasserstein distance between the actual traffic distribution and the synthetic traffic distribution; the data labeling is evaluated by calculating the bias rate of the data labels; finally, qualified samples are selected and integrated to form a new high-quality labeled traffic set.

9. The network traffic generation method based on generative adversarial networks according to claim 8, characterized in that, Step 4 involves data evaluation and filtering of the generated traffic data, including quality evaluation, similarity evaluation, and label evaluation. Qualified samples are selected to form a labeled traffic set, as detailed below: Step 4.1: Quality assessment, performing domain knowledge checks on the generated data stream; Step 4.2, Similarity assessment: Similarity is assessed by kernel density estimation and calculating the Wasserstein distance between the actual flow distribution and the synthetic flow distribution. Step 4.3, Label Evaluation: The data labels are evaluated by calculating the bias rate of the data labels. Step 4.4: Synthesize labeled flow sets. By checking and filtering qualified samples from each generated data, a new labeled flow set is formed.

Images