Improved method and device for generating adversarial traffic samples using cvae-gan

Abstract

The embodiment of the specification provides a method and equipment for generating improved CVAE-GAN traffic adversarial samples, the method comprising: acquiring an original traffic feature data set; inputting a differentiable feature data sample into an encoder E, mapping the data sample to a first latent variable through an encoder E learning distribution; adding noise to obtain a second latent variable, and inputting the second latent variable into a generator G at the same time as the noise; the generator G generates first traffic data by sampling from the distribution; the first traffic data set is combined with a non-differentiable feature data sample to form a second traffic data set; the second traffic data and a normal traffic data set are respectively input into a discriminator D and a trained black box IDS; the black box IDS classifies the data and outputs a labeled classification result and inputs the labeled classification result into the discriminator D; the discriminator D classifies the data according to the second traffic data and the normal traffic data, and compares the discrimination result with the labeled classification result to determine whether the traffic attribute obtains a sample.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a method and equipment for generating improved CVAE-GAN traffic adversarial samples. BACKGROUND

[0002] With the spread of security threats on the Internet, intrusion detection systems (IDS) have become an important tool for detecting malicious network traffic and defending against cyber attacks. IDS monitors the network by analyzing features extracted from network traffic, and if it identifies unsafe traffic, it issues an alert. The main purpose of IDS is to audit and classify normal and malicious traffic records. As a classification problem, machine learning and deep learning algorithms have been widely used in IDS to classify traffic based on feature records, including KNN, SVM, decision tree, etc. In recent years, deep learning algorithms have helped to further improve IDS in terms of accuracy and simplicity.

[0003] However, deep learning networks are vulnerable to adversarial sample attacks, so in order to improve the robustness of IDS, adversarial sample attacks and defenses of network traffic have been a hot topic in the field of IDS in recent years. For the existing method of generating network traffic adversarial samples, such as the method of generating adversarial traffic records using FGSM and JSMA in the prior art, it can evade the detection of IDS, but it needs to know the parameters and structure of the target IDS model in advance, which is generally not useful in practical applications, and the attack method is relatively traditional, the attack model is limited, and the attack effect is relatively worse than other methods, and it cannot attack complex IDS network models. For example, using GAN to generate traffic adversarial samples, called IDSGAN, where the discriminator of GAN obtains labels from a black-box target classifier, but the biggest defect of this method is that it does not handle data imbalance, so it cannot generate enough traffic adversarial samples, etc. That is, the prior art has the following problems:

[0004] (1) White-box attacks require prior knowledge of the parameters and structure of the IDS model, but in actual attack and defense confrontation, it is difficult for the attacker to know the internal structure of the target IDS model, which is a big problem in the prior art;

[0005] (2) Cannot solve the imbalance problem of adversarial sample data, because in the traffic feature data set and the actual network, normal traffic usually accounts for the majority, and attack traffic accounts for the minority, which leads to a very unbalanced problem of attack traffic and normal traffic;

[0006] (3) Many methods cannot preserve the original feature attributes of traffic;

[0007] (4) The existing methods are all used to generate normal traffic by attack traffic to generate adversarial samples, without considering the generation of adversarial samples of normal traffic to attack traffic, and the generation of traffic adversarial samples between attack traffics.

[0008] Therefore, there is an urgent need to provide a method for solving the problem of network traffic adversarial sample generation in intrusion detection. SUMMARY

[0009] To overcome the problems in the related art, the present disclosure provides an improved CVAE-GAN method and device for generating traffic adversarial samples, to solve the technical problems of low attack success rate, data imbalance, white-box attack, and failure to maintain the original traffic properties in the related existing adversarial sample generation techniques.

[0010] One or more embodiments of the present specification provide an improved CVAE-GAN method for generating traffic adversarial samples, comprising:

[0011] An original traffic feature dataset is obtained, and the dataset is preprocessed; the dataset includes a normal traffic dataset and an attack traffic dataset;

[0012] Each data in the attack traffic dataset is decomposed into a differentiable feature and a non-differentiable feature;

[0013] The differentiable feature data sample is input into an encoder E, and the data sample is mapped to a first latent variable by learning the distribution of the encoder E;

[0014] Noise is added to the first latent variable to obtain a second latent variable, and the noise is input into a generator G at the same time, and the generator G generates first traffic data by sampling from the distribution;

[0015] The first traffic dataset is combined with the non-differentiable feature data sample to form a second traffic dataset;

[0016] The second traffic data and the normal traffic dataset are respectively input into a discriminator D and a trained black-box IDS; the trained black-box IDS classifies the data and outputs a labeled classification result, and inputs the labeled classification result into the discriminator D;

[0017] The discriminator D classifies the data according to the second traffic data and the normal traffic data, compares the discrimination result with the input labeled classification result to determine whether the traffic properties are consistent, if consistent, the discriminator D feeds back the loss function value obtained by calculation and optimizes the generator G, and the training step of adding noise to the first latent variable is executed again, if inconsistent, the training is ended, and the current second traffic dataset is the target adversarial traffic sample; wherein, the differentiable feature is a numerical continuous feature, and the non-differentiable feature is a numerical discrete feature.

[0018] The one or more embodiments of the specification provide a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the improved CVAE-GAN method for generating traffic adversarial samples as described above.

[0019] The one or more embodiments of the specification provide a computer readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the steps of the improved CVAE-GAN method for generating traffic adversarial samples as described above.

[0020] The present application is based on the differentiable feature vector of the input traffic, and can generate corresponding adversarial samples through the CVAE model to attack the target black box IDS. The black box IDS inputs the labeled prediction result to the discriminator network of the GAN model to simulate the learning of the black box IDS, and then inputs the loss to the generator network. The two attack and defend each other until the discrimination result of the discriminator D is inconsistent with the traffic attribute of the label on the traffic output by the black box IDS, and finally generate attack traffic samples with good attack effect. The method can be applied to the network traffic adversarial sample generation task in the intrusion detection field, and can effectively solve the problems of low attack success rate, data imbalance, white box attack and failure to maintain the original traffic attribute in the previous generation technology. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the one or more embodiments of the specification or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the specification, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0022] Figure 1 A flowchart of an improved CVAE-GAN method for generating traffic adversarial samples is provided for the one or more embodiments of the specification.

[0023] Figure 2 An improved CVAE-GAN model diagram in an improved CVAE-GAN method for generating traffic adversarial samples is provided for the one or more embodiments of the specification.

[0024] Figure 3 A structure diagram of a computer device is provided for the one or more embodiments of the specification. DETAILED DESCRIPTION

[0025] In order to make the person skilled in the art better understand the technical solutions in one or more embodiments of the present specification, the technical solutions in one or more embodiments of the present specification will be described clearly and completely in the following in combination with the drawings in one or more embodiments of the present specification. Obviously, the described embodiments are only a part of the embodiments of the present specification, not all. Based on one or more embodiments of the present specification, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present invention.

[0026] The present application will be described in detail below in combination with specific embodiments and drawings.

[0027] Method embodiment

[0028] According to the embodiments of the present application, an improved CVAE-GAN generated traffic adversarial sample method is provided, as shown in Figure 1 The flow chart of the improved CVAE-GAN generated traffic adversarial sample method provided in the present embodiment is shown in Figure 2 The improved CVAE-GAN generated traffic adversarial sample model structure diagram is shown in

[0029] In the present embodiment, the improved CVAE-GAN (Conditional Variational Autoencoder Generative Adversarial Nets) model in the present method is based on the CVAE (Conditional Variational Autoencoder) model and the GAN (Generative Adversarial Network) model, combining the advantages and disadvantages of the two models, and combining the data features of network traffic to propose a model for generating traffic adversarial samples. The structure of the model is shown in Figure 2 The model is mainly divided into two parts, the encoder Encoder (hereinafter referred to as E) and the generator Generator (hereinafter referred to as G) in the first part as E and D in the CVAE model; the generator G and the discriminator Discriminator (hereinafter referred to as D) in the second part as G and D in the GAN model. In order to make the discriminator D realize the simulation of the black box IDS classification, a trained black box IDS is set between the generator G and the discriminator D to realize the black box attack on the discriminator D; wherein,

[0030] The encoder E maps the input sample X to the latent vector Z by learning the distribution P(Z|X,c);

[0031] Generator network G: generates samples X' by sampling from the distribution P(Z|X,c) and learns the real data distribution by passing gradients from other parts;

[0032] The black box IDS discriminates and classifies the input sample data, and outputs a classification result with a prediction label;

[0033] The discriminator network D is a multi-layer neural network that learns and imitates the black box IDS through the classification result with the prediction label output by the black box IDS, and then performs a differential attack or normal sample on the input sample data.

[0034] In an embodiment, the initial black box IDS is trained by the following steps:

[0035] Step S11: oversample the attack traffic in the original traffic feature data set X, undersample the normal traffic, and perform data preprocessing and normalization on the processed traffic data. Since there is a significant size difference in multiple dimensions of the traffic feature data, the normalization method used is the Z-Score normalization method, and the formula is as follows:

[0036]

[0037] Where X is the data value, μ is the average of the data set, and σ is the standard deviation.

[0038] Step S12: input the preprocessed and normalized data into the black box IDS model for training until convergence to obtain a trained black box IDS.

[0039] In an embodiment, based on the improved CVAE-GAN model, the method for generating traffic adversarial samples according to the improved CVAE-GAN of the embodiment of the application comprises:

[0040] Step S21: obtain an original traffic feature data set X, and preprocess the data set X; wherein the data set X includes a normal traffic data set and an attack traffic data set.

[0041] Step S22: decompose each data in the attack traffic data set into differentiable features Xdiff and non-differentiable features Xnon-diff; wherein the non-differentiable features are classification features that maintain the inherent properties of the traffic, so no modification is made, such as "protocol type" and "service type". The differentiable features are features that can be added with perturbations, and the non-differentiable features are features that cannot be added with perturbations. The differentiable features are continuous numerical values, i.e., differentiable, and the non-differentiable features are discrete numerical values, i.e., non-differentiable, and cannot be added with perturbations. Adding perturbations will change the inherent properties of the traffic (such as changing the attack properties of the traffic).

[0042] Step S23, inputting the differentiable feature Xdiff data sample into the encoder E, learning the distribution P(Z|X,c) through the encoder E to map the data sample to the first latent variable Z; wherein, c is the category of the data;

[0043] In step S23, the encoder E is a GoogleNet network, and the category information and the feature are merged in the last FC layer of the encoder E network. Similar to the VAE, for each sample, the encoder G outputs the mean and covariance of the latent vector, i.e. μ and ε. The KL loss is used to reduce the gap between the prior P(Z) and the proposed distribution, as follows:

[0044] L KL =1 / 2(μ T μ+sum(exp(ε)-ε-1)) (1)

[0045] The latent variable Z = μ + r ⊙ exp(ε) can be sampled again, where r ~ N(0, 1) is a random vector, and ⊙ represents element-wise multiplication.

[0046] Step S24, adding noise N to the first latent variable in step 23 to obtain a second latent variable Z', and inputting the noise N and the second latent variable Z' into the generator G at the same time, the generator G generates the first traffic data X' by sampling from the distribution P(X|Z,c); wherein, the elements of the noise part are randomly sampled in the range of [0, 1] uniformly distributed.

[0047] Step S25, combining the first traffic data set X' with the non-differentiable feature Xnon-diff data sample into a second traffic data set X".

[0048] Step S26, inputting the second traffic data X" and the normal traffic data set into the discriminator D and the trained black box IDS respectively; the trained black box IDS classifies the data and outputs the labeled classification result and inputs it into the discriminator D.

[0049] In this embodiment, the generator G has a neural network structure with five linear layers, and the ReLU nonlinear function F = max(0,x) is used to activate the output of the first four linear layers. The loss of the generator G is calculated according to the classification result of the discriminator D, as follows:

[0050]

[0051] Wherein, S attack is the attack traffic distribution, G and D represent the generator and the discriminator respectively, and N represents Noise; in order to train and optimize the generator to deceive the black box IDS, it is necessary to minimize L GThe final purpose of the sample generated by the black-box IDS generator in this embodiment is to deceive the black-box IDS to achieve the purpose of successfully attacking the black-box IDS.

[0052] In step S27, the discriminator D classifies the second traffic data X" according to normal traffic data, and compares the discrimination result with the labeled classification result input by the black-box IDS to determine whether the traffic attribute is consistent. If consistent, the discriminator D feeds back the loss function value obtained by calculation and optimizes the generator G, and goes to step S24. If inconsistent, it means that the black-box IDS attack is successful, and the training is ended. The current second traffic data set X" is the target adversarial traffic sample. The label can be set according to the demand, including the labels of normal traffic and attack traffic.

[0053] In this embodiment, the label in the labeled classification result input by the black-box IDS is a traffic attribute label, indicating the specific type of traffic data.

[0054] In this embodiment, without knowing the structure and parameters in the black-box IDS model, it is assumed that the real-time classification result of the black-box IDS model can be obtained by querying. The discriminator D is a multi-layer neural network for classifying adversarial malicious traffic samples and normal traffic samples. In addition, the discriminator D also learns and imitates the black-box IDS based on the detected samples and their latest labeled prediction results from the black-box IDS. In the adversarial training, the normal traffic samples and the adversarial malicious traffic samples are first classified by the black-box IDS, and the classification result is given to the discriminator D. The discriminator D imitates the black-box IDS according to the labeled classification result, inputs the second traffic data set X" and the output label of the black-box IDS into the discriminator D to train and optimize the discriminator D, as shown in Figure 2 The discriminator D dynamically learns the classification mode of the IDS by using the real-time prediction of the black-box IDS.

[0055] In this embodiment, in order to learn the black-box IDS, the output label of the discriminator D and the prediction label obtained by the black-box IDS are used to calculate the loss of the discriminator. Therefore, the loss function of the discriminator optimization is as follows:

[0056]

[0057] Where s represents the training set of the discriminator D; B normal and B attack respectively represent the normal traffic records and adversarial traffic records with prediction labels in the black-box IDS.

[0058] The method of the embodiment is based on the differentiable feature vector of the input traffic, and can generate a corresponding adversarial sample to attack a target black-box IDS through a CVAE model. The black-box IDS inputs the labeled prediction result to a discriminator network of a GAN model to simulate learning of the black-box IDS, and then inputs the loss of the discriminator network to a generator network, so that the two networks attack and defend each other until the discrimination result of the discriminator D is inconsistent with the traffic attribute of the label on the traffic output by the black-box IDS, and finally an attack traffic sample with good attack effect is generated. The method can be applied to a network traffic adversarial sample generation task in the intrusion detection field, and can effectively solve the problems of low attack success rate, data imbalance, white-box attack, and failure to maintain the original traffic attribute in the previous generation techniques, and has the following beneficial effects:

[0059] 1. The model considers the imbalance of network traffic data, and solves the problem through under-sampling and over-sampling methods, solves the under-fitting problem in model training, and improves the precision of the black-box IDS model;

[0060] 2. The proposed model is a black-box attack, which is more suitable for actual application scenarios;

[0061] 3. The network traffic features are divided into differentiable features and non-differentiable features, only the differentiable features are changed to generate traffic adversarial samples, and the most original traffic attributes are preserved;

[0062] 4. The proposed model can not only generate attack traffic adversarial samples, but also generate normal traffic adversarial samples according to normal traffic training samples, which cannot be realized by other existing methods.

[0063] As shown in Figure 3 The application also provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the method for generating traffic adversarial samples by the improved CVAE-GAN in the above embodiment, or the computer program is executed by the processor to implement the method for generating traffic adversarial samples by the improved CVAE-GAN in the above embodiment, and the computer program is executed by the processor to implement the following method steps:

[0064] Step S21, obtaining original traffic feature data set X, and preprocessing the data set X; wherein the data set X includes a normal traffic data set and an attack traffic data set;

[0065] Step S22, decomposing each data in the attack traffic data set into differentiable features Xdiff and non-differentiable features Xnon-diff;

[0066] Step S23, inputting the differentiable feature Xdiff data sample into an encoder E, and mapping the data sample to a first latent variable Z through the encoder E to learn a distribution P(Z|X,c); wherein c is the category of the data.

[0067] Step S24, add noise N to the first latent variable in step 23 to obtain the second latent variable Z', and input it to the generator G at the same time as the noise N, and the generator G generates the first traffic data X' by sampling from the distribution P(X|Z,c); wherein the elements of the noise part are randomly sampled in the range of [0,1] uniform distribution;

[0068] Step S25, combine the first traffic data set X' with the non-differentiable feature Xnon-diff data sample into the second traffic data set X'';

[0069] Step S26, input the second traffic data X'' and the normal traffic data set to the discriminator D and the trained black box IDS respectively; the trained black box IDS classifies the data and outputs the labeled classification results and inputs them to the discriminator D;

[0070] Step S27, the discriminator D classifies the second traffic data X'' and the normal traffic data, and compares the discrimination results with the labeled classification results of the black box IDS to determine whether the traffic attributes are consistent, if consistent, the discriminator D feeds back the loss function value obtained by calculation and optimizes the generator G, and turns to step S24; if not consistent, it means that the black box IDS attack is successful, then the training is ended, and the current second traffic data set X'' is the target adversarial traffic sample.

[0071] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0072] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the device or system embodiments, since they are basically similar to the method embodiments, they are described more simply, and the relevant parts can be referred to the part of the method embodiments. The above-described device and system embodiments are merely illustrative, and the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiments according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0073] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit it; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and the contents not described in detail in the specification of the present application are the known technology of those skilled in the art.

Claims

1. The improved CVAE-GAN method for generating traffic adversarial samples is characterized by: include: Obtain the original traffic feature data set and preprocess the data set; It contains normal traffic data set and attack traffic data set; Decompose each data in the attack traffic dataset into differentiable features and non-differentiable features; Input the differentiable feature data sample into the encoder E, and map the data sample to the first latent variable through the encoder E learning distribution; Noise is added to the first latent variable to obtain a second latent variable, and the second latent variable is input to the generator G together with the noise. The generator G generates the first flow data by sampling from the distribution. The first traffic data set and the non-differentiable feature data samples are combined into a second traffic data set; The second traffic data and the normal traffic dataset are input to the discriminator D and the trained black box IDS respectively; The trained black box IDS classifies the data and outputs the labeled classification results which are input to the discriminator D; The discriminator D classifies the second traffic data and the normal traffic data, and compares the discrimination result with the labeled classification result to determine whether the traffic attributes are consistent. If they are consistent, the discriminator D will feed back the calculated loss function value and optimize the generator G, and loop again to execute the training steps after adding noise to the first latent variable. If they are inconsistent, the training is terminated, and the current second traffic data set is the target adversarial traffic sample; among them, the differentiable feature is a feature with continuous values, and the non-differentiable feature is a feature with discrete values.

2. The improved CVAE-GAN method for generating traffic adversarial samples according to claim 1, characterized in that: The improved CVAE-GAN model is specifically: The advanced CVAE-GAN model includes a CVAE model composed of an encoder E and a generator G, and a GAN model composed of a generator G and a discriminator D, with a trained black box IDS set between the generator G and the discriminator D; The encoder E maps the sample x to the latent vector by learning the distribution P(Z|X,c); the generator network G: generates the sample X' by sampling from the distribution P(Z|X,c), and learns the real data distribution through the gradient passed by the other parts of the model; Black box IDS discriminates and classifies the input sample data and outputs the classification results with predicted labels; The discriminator network D is a multi-layer neural network that learns and imitates the black-box IDS through the classification results with prediction labels output by the black-box IDS, and then distinguishes attack or normal samples from the input sample data.

3. The improved CVAE-GAN method for generating traffic adversarial samples according to claim 1, characterized in that: The initial black-box IDS is trained by the following steps: Oversample the attack traffic in the original traffic feature dataset X and undersample the normal traffic. Then preprocess and normalize the processed traffic data. The preprocessed and normalized data is input into the black box IDS model for training until convergence to obtain a trained black box IDS.

4. The improved CVAE-GAN method for generating traffic adversarial samples according to claim 1, characterized in that: The encoder E is a GoogleNet network. The category information and features are merged in the last FC layer of the encoder E. For each sample, the encoder G outputs the mean and covariance of the potential vector, i.e., μ and ε. The gap between the prior P(Z) and the proposed distribution is reduced by using the KL loss, as shown in the following formula: L KL =1 / 2(μ T μ+sum(exp(e)-e-1)) (1) The latent variable Z = μ + r⊙exp(ε) can then be sampled, where r~N(0,1) is a random vector and ⊙ represents element-by-element multiplication.

5. The improved CVAE-GAN method for generating traffic adversarial samples according to claim 1, characterized in that: The generator G is a neural network structure with five linear layers. The ReLU nonlinearity F=max(0, x) is used to activate the outputs of the first four linear layers. The loss of the generator G is calculated based on the classification results of the discriminator D, as follows: Among them, S attack is the attack traffic distribution, N represents Noise; in order to train and optimize the generator G to deceive the black box IDS, it is necessary to minimize L G .

6. The improved CVAE-GAN method for generating traffic adversarial samples according to claim 1, characterized in that: The loss function optimized by the discriminator D is as follows: Among them, s represents the training set of the discriminator D; B normal and B attack denote normal traffic records and adversarial traffic records with predicted labels in black-box IDS, respectively.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the improved CVAE-GAN method for generating traffic adversarial samples according to any one of claims 1 to 6 is implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the improved CVAE-GAN method for generating traffic adversarial samples are implemented as described in any one of claims 1 to 6.

Images