Malicious traffic sample generation method, device, electronic equipment and system

Abstract

The present application relates to the technical field of artificial intelligence, and provides a malicious traffic sample generation method, device, electronic equipment and system, the method comprising: obtaining a plurality of data sets; each data set comprises a first data scale parameter, a first data dispersion degree adjustment parameter and a first detection accuracy; determining a second data scale parameter and a second data dispersion degree adjustment parameter based on the plurality of data sets; generating a second malicious traffic sample according to the second data scale parameter, the second data dispersion degree adjustment parameter and the pre-determined abnormal traffic sample of the network security system; wherein the second data scale parameter is used to determine the number of the second malicious traffic sample; and the second data dispersion degree adjustment parameter is used to determine the dispersion degree of the second malicious traffic sample and the abnormal traffic sample. The present application improves the flexibility in the process of generating malicious traffic data in the actual situation, and realizes the dynamic adjustment of the production process of the malicious traffic sample.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, apparatus, electronic device, and system for generating malicious traffic samples. Background Technology

[0002] With the continuous development of network scale, the traffic data carried by various information systems is showing a significant upward trend. Improving network risk management, reducing system risks, and ensuring the normal operation of business are receiving increasing attention from various industries. However, the complex and ever-changing forms of network attacks pose significant challenges to system network security. Current methods for detecting malicious traffic primarily rely on intrusion detection systems (IDS), intrusion prevention systems (IPS), web application firewalls (WAF), and firewalls, supplemented by manual analysis and judgment. These malicious traffic detection systems have undergone years of development and iteration, incorporating certain machine learning capabilities, allowing them to learn patterns in data based on built-in algorithms. However, in actual production environments, the amount of malicious traffic data is far less than normal data, resulting in an extremely unbalanced data sample distribution. Consequently, the machine learning algorithms within these malicious traffic detection systems often fail to fully utilize their performance and cannot effectively detect malicious traffic.

[0003] Sample augmentation techniques can enhance malicious traffic samples, thereby improving their detection. Current research on sample augmentation techniques largely focuses on automated malicious traffic sample processing methods. While these automated methods reduce human intervention and avoid the influence of subjective human factors in model building, they lack flexibility in adapting to real-world scenarios due to varying application environments. In other words, they cannot dynamically adjust the malicious traffic sample generation process. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and system for generating malicious traffic samples, which addresses the shortcomings of existing technologies that cannot dynamically adjust the production process of malicious traffic samples.

[0005] This invention provides a method for generating malicious traffic samples, comprising:

[0006] Acquire multiple datasets; each dataset includes a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy.

[0007] Based on the multiple datasets, determine the second data size parameter and the second data dispersion adjustment parameter;

[0008] A second malicious traffic sample is generated based on the second data size parameter, the second data dispersion adjustment parameter, and the abnormal traffic sample predetermined by the network security system.

[0009] Wherein, the second data size parameter is used to determine the number of the second malicious traffic samples; the second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic samples and the abnormal traffic samples;

[0010] The first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

[0011] According to a method for generating malicious traffic samples provided by the present invention, the step of determining a second data size parameter and a second data dispersion adjustment parameter based on the plurality of datasets includes:

[0012] A target fitting curve is constructed based on the multiple datasets. The target fitting curve represents the first detection accuracy corresponding to the distribution of the first data size parameter and the first data dispersion adjustment parameter.

[0013] The target fitting curve that minimizes the mean square error of the first detection accuracy is solved by the gradient descent method to obtain the second data size parameter and the second data dispersion parameter.

[0014] According to a method for generating a malicious traffic sample provided by the present invention, the step of generating a second malicious traffic sample based on a second data size parameter, a second data dispersion adjustment parameter, and abnormal traffic samples predetermined by a network security system includes:

[0015] Obtain abnormal traffic samples collected by the network security system;

[0016] The abnormal traffic samples are input into a generative adversarial network;

[0017] The second malicious traffic sample is generated by training the abnormal traffic sample using the generative adversarial network based on the second data size parameter and the second data dispersion adjustment parameter.

[0018] According to a method for generating malicious traffic samples provided by the present invention, the step of generating a second malicious traffic sample by training the abnormal traffic sample on the generative adversarial network based on a second data size parameter and a second data dispersion adjustment parameter includes:

[0019] The second malicious traffic sample is generated based on the abnormal traffic sample using a generator of a generative adversarial network;

[0020] The discriminator of the generative adversarial network determines the number of the second malicious traffic samples based on the second data size parameter, and determines the dispersion between the second malicious traffic samples and the abnormal traffic samples based on the second data dispersion adjustment parameter.

[0021] According to a method for generating malicious traffic samples provided by the present invention, the steps of determining the number of second malicious traffic samples based on a second data size parameter using a discriminator of a generative adversarial network, and determining the dispersion between the second malicious traffic samples and the abnormal traffic samples based on a second data dispersion adjustment parameter, include:

[0022] The discriminator of the generative adversarial network determines that the ratio of the number of second malicious traffic samples to the number of abnormal traffic samples conforms to the second data size parameter; the discriminator of the generative adversarial network determines that the cosine similarity between the second malicious traffic samples and the abnormal traffic samples is higher than the second data dispersion adjustment parameter.

[0023] The present invention also provides an apparatus for generating malicious traffic samples, comprising:

[0024] A dataset acquisition module is used to acquire multiple datasets; each dataset includes a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy.

[0025] The parameter acquisition module is used to determine a second data size parameter and a second data dispersion adjustment parameter based on the multiple datasets.

[0026] The malicious sample generation module is used to generate a second malicious traffic sample based on the second data scale parameter, the second data dispersion adjustment parameter, and the abnormal traffic sample predetermined by the network security system.

[0027] Wherein, the second data size parameter is used to determine the number of the second malicious traffic samples; the second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic samples and the abnormal traffic samples;

[0028] The first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

[0029] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method for generating malicious traffic samples as described in any of the preceding claims.

[0030] This invention also provides a system for generating malicious traffic samples, comprising:

[0031] The aforementioned electronic devices; and

[0032] A network security system, wherein the network security system is used to determine a first detection accuracy of a first malicious traffic sample.

[0033] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for generating malicious traffic samples as described above.

[0034] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method for generating malicious traffic samples as described above.

[0035] The present invention provides a method, apparatus, electronic device, and system for generating malicious traffic samples. Based on multiple datasets, it determines a second data size parameter and a second data dispersion adjustment parameter. This allows for the adjustment of the number of generated second malicious traffic samples via the second data size parameter and the adjustment of the dispersion between the second malicious traffic samples and the abnormal traffic samples via the second data dispersion adjustment parameter. This achieves controllability in the malicious traffic sample generation process. Specifically, during malicious traffic sample generation, the newly generated malicious traffic samples are dynamically adjusted based on the second data size parameter and the second data dispersion adjustment parameter. This improves the flexibility of malicious traffic data generation in response to actual situations and enables dynamic adjustment of the malicious traffic sample production process. Furthermore, by adjusting the second data size parameter and the second data dispersion adjustment parameter of the generated second malicious traffic samples based on the first detection accuracy feedback from the network security system, it achieves organic integration with existing detection systems, fully leveraging the abnormal traffic detection and identification capabilities of the network security system. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0037] Figure 1 This is one of the flowcharts illustrating the method for generating malicious traffic samples provided by the present invention;

[0038] Figure 2 This is the second flowchart illustrating the method for generating malicious traffic samples provided by this invention;

[0039] Figure 3 This is the third flowchart illustrating the method for generating malicious traffic samples provided by this invention;

[0040] Figure 4 This is a schematic diagram of the structure of the generative adversarial network generating the second malicious traffic sample according to the present invention;

[0041] Figure 5 This is a schematic diagram of the generated data scale parameters and data dispersion adjustment parameters of the present invention;

[0042] Figure 6 This is a schematic diagram of the structure of the malicious traffic sample generation device provided by the present invention;

[0043] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention;

[0044] Figure 8 This is a schematic diagram of the structure of the malicious traffic sample generation system provided by the present invention;

[0045] Figure 9 This is a schematic diagram illustrating the generation of malicious traffic samples by the malicious traffic sample generation system provided by the present invention.

[0046] Figure label:

[0047] Generator 410; Discriminator 420; Electronic device 810; Network security system 820. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0049] This invention addresses the shortcomings of existing technologies that cannot dynamically adjust the production process of malicious traffic samples.

[0050] The following is combined with Figures 1-3 This invention describes a method for generating malicious traffic samples, which includes:

[0051] Please refer to Figure 1 Step 100: Obtain multiple datasets; each dataset includes a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy.

[0052] Multiple datasets are acquired via electronic devices. The first detection accuracy is determined by the network security system after detecting a first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

[0053] The network security system can be any existing detection system capable of detecting malicious traffic samples. Network security systems can include intrusion detection systems (IDS), intrusion prevention systems (IPS), web application protection systems (WAF), or firewalls, etc.

[0054] The first malicious traffic sample is determined based on an initial first data size parameter and an initial first data dispersion adjustment parameter. The initial first data size parameter represents the pre-defined number of first malicious traffic samples generated; the initial first data dispersion adjustment parameter represents the dispersion of the first malicious traffic sample from the original abnormal traffic sample. It should be noted that abnormal traffic samples can be collected through network security systems during actual detection.

[0055] Understandably, the first malicious traffic sample can be generated in a variety of existing ways, such as through generators of generative adversarial networks.

[0056] The first detection accuracy indicates the effectiveness of detecting the first malicious traffic sample. For example, if there are 100 first malicious traffic samples, and 90 malicious traffic samples are actually detected and identified, then the detection accuracy for the first malicious traffic sample is 90 / 100 = 90%. It should be understood that the first malicious traffic sample can represent one or more malicious traffic samples.

[0057] It should be noted that both the first malicious traffic sample and the second malicious traffic sample mentioned below are malicious traffic samples. In order to distinguish the malicious traffic sample regenerated based on the second data scale parameter, the second data dispersion adjustment parameter, and the abnormal traffic sample from the previous malicious traffic sample, this invention names the malicious traffic sample generated by readjusting the data scale parameter and the data dispersion adjustment parameter as the second malicious traffic sample, and names the malicious traffic sample before the adjustment as the first malicious traffic sample.

[0058] Step 200: Determine the second data size parameter and the second data dispersion adjustment parameter based on the multiple datasets;

[0059] The electronic device determines a second data size parameter and a second data dispersion adjustment parameter based on the multiple datasets.

[0060] Specifically, the first detection accuracy corresponding to the first data size parameter and the first data dispersion adjustment parameter can be determined by sampling multiple pairs of first data size parameters and first data dispersion adjustment parameters. Based on the dataset composed of multiple first data size parameters, first data dispersion adjustment parameters, and first detection accuracy, polynomial fitting is performed to obtain the second data size parameter and the second data dispersion adjustment parameter.

[0061] Step 300: Generate a second malicious traffic sample based on the second data scale parameter, the second data dispersion adjustment parameter, and the abnormal traffic sample predetermined by the network security system.

[0062] The electronic device generates a second malicious traffic sample based on the second data size parameter, the second data dispersion adjustment parameter, and abnormal traffic samples predetermined by the network security system. Specifically, the electronic device can generate the second malicious traffic sample through a generative adversarial network (GAN).

[0063] The second data size parameter is used to determine the number of the second malicious traffic samples; the second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic samples and the abnormal traffic samples. The abnormal traffic samples pre-determined by the network security system refer to various abnormal traffic samples pre-detected and collected by the network security system during traffic data processing.

[0064] The second data scale parameter represents the size of the number of generated second malicious traffic samples. The size of the second malicious traffic sample can be represented in various ways, such as using bits. In this invention, it can be represented by the ratio of the generated second malicious traffic sample to the original abnormal traffic sample. The value of the second data scale parameter ranges from 0% to 300%. When the data scale parameter is 120%, it represents 1.2 times the data size of the original abnormal traffic sample of the generated second malicious traffic sample.

[0065] Furthermore, the second data dispersion adjustment parameter (i.e., the dispersion between the second malicious traffic sample and the original abnormal traffic sample) can be represented by cosine similarity. If there are two traffic sample vectors, X and Y, then the formula for calculating the cosine similarity between these two vectors is:

[0066]

[0067] The cosine similarity value ranges from (0,1). A higher cosine similarity indicates a higher similarity between the second malicious traffic sample and the original abnormal traffic sample, and a smaller degree of dispersion.

[0068] Specifically, the electronic device can control the number of generated second malicious traffic samples to be 120% of the number of abnormal traffic samples, that is, the number of generated second malicious traffic samples is 1.2 times that of the original abnormal traffic samples. The data dispersion of the generated second malicious traffic samples can be controlled by the electronic device to be no less than 30%, that is, the cosine similarity between the generated second malicious traffic samples and the original abnormal traffic samples is no less than 30%. During the generation of second malicious traffic samples, malicious traffic samples with a cosine similarity of less than 30% are filtered out.

[0069] Therefore, this invention determines a second data size parameter and a second data dispersion adjustment parameter based on multiple datasets. The second data size parameter adjusts the number of generated second malicious traffic samples, and the second data dispersion adjustment parameter adjusts the dispersion between the second malicious traffic samples and the abnormal traffic samples. This achieves controllability in the malicious traffic sample generation process. Specifically, during malicious traffic sample generation, the newly generated malicious traffic samples are dynamically adjusted based on the second data size parameter and the second data dispersion adjustment parameter. This improves the flexibility of malicious traffic data generation in response to actual situations and enables dynamic adjustment of the malicious traffic sample production process. Furthermore, by adjusting the second data size parameter and the second data dispersion adjustment parameter of the generated second malicious traffic samples based on the first detection accuracy feedback from the network security system, it achieves organic integration with existing detection systems, fully leveraging the abnormal traffic detection and identification capabilities of the network security system.

[0070] Further, please refer to Figure 2 Step 200, determining the second data size parameter and the second data dispersion adjustment parameter based on the multiple datasets, includes:

[0071] Step 210: Construct a target fitting curve based on the multiple datasets. The target fitting curve represents the first detection accuracy corresponding to the distribution of the first data size parameter and the first data dispersion adjustment parameter.

[0072] Specifically, several pairs of values ​​are randomly selected, consisting of initial values ​​for a first data size parameter and a data dispersion adjustment parameter, and used as parameters to generate a first malicious traffic sample. The generated malicious traffic sample is then processed and input into the network security system to calculate the first detection accuracy of the network security system. Through multiple generation processes, several three-dimensional data sets (i.e., the aforementioned dataset) are obtained. These three-dimensional data sets include (the first data size parameter, the first data dispersion adjustment parameter, and the first detection accuracy). Then, polynomial fitting is performed on multiple datasets to determine the second data size parameter and the second data dispersion adjustment parameter.

[0073] Step 220: Solve the target fitting curve that minimizes the mean square error of the first detection accuracy using the gradient descent method to obtain the second data size parameter and the second data dispersion parameter.

[0074] It should be noted that the initial detection accuracy of the first malicious traffic sample can be tested by multiple network security systems. Depending on the different initial detection accuracy rates reported by different network security systems, the generated second data size parameter and the second data dispersion adjustment parameter will also differ.

[0075] For N network security systems, there will be 2N parameters during the generation of malicious samples: A1, A2, ..., An; B1, B2, ..., Bn. We need to analyze these parameters to obtain the optimal parameters for each network security system in order to achieve the optimal detection efficiency of the entire network security system.

[0076] To obtain the values ​​of these parameters, a correspondence needs to be established:

[0077] A1, B1 → Acc1;

[0078] A2, B2 → Acc2;

[0079] …

[0080] An, Bn→Accn.

[0081] As mentioned earlier, the second data scale parameter A represents the size of the number of second malicious traffic samples generated. It represents the ratio of the number of second malicious traffic samples to the number of abnormal traffic samples, and its value ranges from 0% to 300%. For example, it can take values ​​of 10%, 20%, 30%, ..., 290%, 300%.

[0082] The second data dispersion adjustment parameter B controls the degree of dispersion between the generated second malicious traffic sample and the abnormal traffic sample, and its value range is (0,1).

[0083] In this embodiment of the invention, let the target fitting curve of the generated parameters of the first network security system be x1*A. 1n +x2*B 1n +C=Acc 1n .

[0084] Among them, A 1n B represents the second data size parameter of the first network security system required. 1n C represents the second data dispersion adjustment parameter for the first required network security system, where C is a constant. 1n B 1n In this context, the subscript 1 indicates the first network security system, and the subscript n indicates that n datasets were randomly sampled (i.e., three-dimensional data composed of the first data size parameter, the first data dispersion adjustment parameter, and the first detection accuracy). The meaning of the target fitting curve is to obtain the first detection accuracy of the corresponding network security system by using the distribution of the samples from the first data size parameter and the first data dispersion adjustment parameter.

[0085] For target x1*A 1n +x2*B 1n +C=Acc 1n In this embodiment of the invention, the mean square error minimization method can be used to calculate the second data size parameter and the second data dispersion adjustment parameter.

[0086] Given the mean-square error (MSE):

[0087] MSE(Acc * ) = E(Acc * -Acc) 2

[0088] Among them, Acc * Let represent the estimated first detection accuracy of the network security system, let Acc represent the actual first detection accuracy of the network security system, and let E represent the expectation of both.

[0089] The smaller the mean squared error, the closer the estimated accuracy of the first detection of the network security system is to the actual accuracy. (Target fitting curve x1*A) 1n +x2*B 1n +C=Acc 1n The higher the degree of fit, the better. Therefore, we need to find the A value corresponding to the minimum mean square error. 1n and B 1n The values ​​of these two parameters are the second data scale parameter and the second data dispersion adjustment parameter corresponding to the network security detection system.

[0090] This invention uses the gradient descent method to solve for the target fitting curve that minimizes the mean square error, and obtains the corresponding second data scale parameter A. 1n Second data dispersion adjustment parameter B 1n The value of . The gradient descent method is expressed by the following formula:

[0091]

[0092] Use w i A represents 1n Or B 1n The initial value of w i+1 Indicates the updated A 1n B 1n α represents the learning rate. This represents the partial derivative of the first detection accuracy.

[0093] Using the above formula, A is iterated multiple times. 1n Or B 1n The obtained second data size parameter and second data dispersion adjustment parameter are the optimal parameters corresponding to the first network security system.

[0094] Similarly, the above method can be used to calculate data size parameters and data dispersion adjustment parameters for all network security systems.

[0095] Based on the first detection accuracy of the network security system for the first malicious traffic sample, as well as the first data size parameter and the first data dispersion adjustment parameter, a second data size parameter and a second data dispersion adjustment parameter are generated to adjust the data volume and data dispersion of the second malicious traffic sample. This invention is organically integrated with existing network security systems. It can act as a malicious traffic sample generator to generate training data for training machine learning models in various network security systems, thereby enhancing the resilience of these systems against malicious traffic and gradually improving the detection accuracy of malicious traffic data.

[0096] For other aspects of the invention, please refer to Figure 3 Step 300: Generate a second malicious traffic sample based on the second data size parameter, the second data dispersion adjustment parameter, and the abnormal traffic samples predetermined by the network security system, including:

[0097] Step 310: Obtain abnormal traffic samples collected by the network security system;

[0098] Step 320: Input the abnormal traffic samples into the adversarial network;

[0099] Step 330: Using the generative adversarial network, train the abnormal traffic samples based on the second data size parameter and the second data dispersion adjustment parameter to generate the second malicious traffic sample.

[0100] In this invention, an electronic device acquires abnormal traffic samples collected by a network security system, inputs the abnormal traffic samples into a generative adversarial network (GAN), and trains the abnormal traffic samples based on the second data scale parameter and the second data dispersion adjustment parameter to generate the second malicious traffic sample.

[0101] Specifically, step 330 involves training the abnormal traffic samples using the generative adversarial network based on the second data size parameter and the second data dispersion adjustment parameter to generate the second malicious traffic sample, including:

[0102] Step 331: Generate the second malicious traffic sample based on the abnormal traffic sample using the generator of the generative adversarial network;

[0103] Step 332: Using the discriminator of the generative adversarial network, determine the number of the second malicious traffic samples based on the second data size parameter, and determine the dispersion of the second malicious traffic samples and the abnormal traffic samples based on the second data dispersion adjustment parameter.

[0104] In this embodiment of the invention, a second malicious traffic sample can be generated by a generative adversarial network based on the second data size parameter, the second data dispersion adjustment parameter, and the abnormal traffic samples predetermined by the network security system.

[0105] Specifically, please refer to Figure 4 and Figure 5 The generative adversarial network includes a generator 410 and a discriminator 420. The generator 410 receives abnormal traffic samples from various network security systems 820 and generates a second malicious traffic sample based on the malicious traffic dataset. The second malicious traffic sample generated by the generator 410 is mixed with the original traffic data and then input into the discriminator 420 for judgment.

[0106] The generator 410 can also be represented by G, where G represents the Generative Model generation module, which is used to generate a second malicious traffic sample based on the abnormal traffic sample; G(z) is the second malicious traffic sample generated by the generator 410; the discriminator 420 can also be represented by D, where D represents the Discriminative Model discrimination module, which is used to judge the number and data dispersion of the generated G(z) and feed the discrimination result back to the generator 410.

[0107] In this invention, the objective function of the game-playing process of GAN (Generative Adversarial Networks) is set as follows:

[0108]

[0109] Where G is generator 410, D is discriminator 420, G(z) is the second malicious traffic sample generated by generator 410, and p data (x) represents the data distribution of the actual traffic sample, and z represents random noise.

[0110] The generator 410 and discriminator 420 described above can be implemented using various network structures. Specifically, this invention uses a Deep Convolutional Genetative Network (DCGN) to construct the generator 410. Simultaneously, ResNet from a CNN model is used as the discriminator 420 to construct the GAN network.

[0111] The discriminator can be used to determine the number of the second malicious traffic samples based on the second data size parameter, and to determine the degree of dispersion between the second malicious traffic samples and the abnormal traffic samples based on the second data dispersion adjustment parameter.

[0112] By optimizing the generated malicious traffic samples through the game process between the generator and discriminator in a generative adversarial network, the proportion of malicious traffic data in business data traffic is increased. In the irregular output of malicious traffic data to various network security systems, the detection capability of each network security system against unknown threats is improved.

[0113] Specifically, step 332, which involves using a generative adversarial network (GAN) discriminator to determine the number of the second malicious traffic samples based on the second data size parameter, and to determine the dispersion between the second malicious traffic samples and the abnormal traffic samples based on the second data dispersion adjustment parameter, specifically includes:

[0114] The discriminator of the generative adversarial network determines that the ratio of the number of second malicious traffic samples to the number of abnormal traffic samples conforms to the second data size parameter; the discriminator of the generative adversarial network determines that the cosine similarity between the second malicious traffic samples and the abnormal traffic samples is higher than the second data dispersion adjustment parameter.

[0115] That is, the discriminator of the generative adversarial network is used to determine the ratio of the number of the second malicious traffic samples to the number of the abnormal traffic samples, and to determine the cosine similarity between the second malicious traffic samples and the abnormal traffic samples.

[0116] The second data size parameter represents the ratio of the number of regenerated second malicious traffic samples to the number of anomalous traffic samples. The discriminator of the generative adversarial network (GAN) can control the number of second malicious traffic samples generated by the GAN to conform to the second data size parameter. For example, the discriminator of the GAN can control the number of generated second malicious traffic samples to be 1.2 times the original anomalous traffic samples. The electronic device can control the data dispersion of the generated second malicious traffic samples to be no less than 30%.

[0117] The second data dispersion adjustment parameter represents the cosine similarity between the second malicious traffic sample and the abnormal traffic sample. By using the discriminator of the generative adversarial network (GAN), the GAN can be controlled to generate a second malicious traffic sample whose cosine similarity to the abnormal traffic sample is higher than the data dispersion adjustment parameter. For example, by using the discriminator of the GAN, the electronic device can control the generated second malicious traffic sample to have a cosine similarity to the abnormal traffic sample higher than 30%.

[0118] Generative adversarial networks (GANs) were used to generate a second malicious traffic sample and a malicious traffic dataset containing these samples, mitigating the model performance issues caused by imbalanced data distribution. Furthermore, GANs can automatically determine the number of second malicious samples generated and control the cosine similarity between the second malicious traffic sample and the abnormal traffic sample, generating more realistic malicious traffic samples and optimizing the detection performance and protection effectiveness of the network security system.

[0119] The apparatus for generating malicious traffic samples provided by the present invention will be described below. The apparatus for generating malicious traffic samples described below can be referred to in correspondence with the method for generating malicious traffic samples described above.

[0120] Please refer to Figure 6 A device for generating malicious traffic samples, comprising:

[0121] The dataset acquisition module 601 is used to acquire multiple datasets; each dataset includes a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy.

[0122] Parameter acquisition module 602 is used to determine a second data size parameter and a second data dispersion adjustment parameter based on the multiple datasets;

[0123] The malicious sample generation module 603 is used to generate a second malicious traffic sample based on the second data scale parameter, the second data dispersion adjustment parameter, and the abnormal traffic sample predetermined by the network security system.

[0124] Wherein, the second data size parameter is used to determine the number of the second malicious traffic samples; the second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic samples and the abnormal traffic samples;

[0125] The first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

[0126] The malicious traffic sample generation device of the present invention determines a second data size parameter and a second data dispersion adjustment parameter based on multiple datasets. This allows for the adjustment of the number of generated second malicious traffic samples via the second data size parameter and the adjustment of the dispersion between the second malicious traffic samples and the abnormal traffic samples via the second data dispersion adjustment parameter. This achieves controllability in the malicious traffic sample generation process. Specifically, during malicious traffic sample generation, the newly generated malicious traffic samples are dynamically adjusted based on the second data size parameter and the second data dispersion adjustment parameter. This improves the flexibility of malicious traffic data generation in response to actual situations and enables dynamic adjustment of the malicious traffic sample production process. Furthermore, by adjusting the second data size parameter and the second data dispersion adjustment parameter of the generated second malicious traffic samples based on the first detection accuracy feedback from the network security system, it achieves organic integration with existing detection systems, fully leveraging the abnormal traffic detection and identification capabilities of the network security system.

[0127] Based on the above embodiments, as an optional embodiment, the parameter acquisition module 602 specifically includes:

[0128] The target fitting curve construction module 6021 is used to construct a target fitting curve based on the multiple datasets. The target fitting curve represents the first detection accuracy corresponding to the distribution of the first data size parameter and the first data dispersion adjustment parameter.

[0129] The curve solving module 6022 is used to solve the target fitting curve when the mean square error of the first detection accuracy is minimized by using the gradient descent method, so as to obtain the second data size parameter and the second data dispersion parameter.

[0130] Based on the above embodiments, as an optional embodiment, the malicious sample generation module 603 specifically includes:

[0131] An abnormal traffic sample acquisition module 6031 is used to acquire abnormal traffic samples collected by the network security system.

[0132] Input module 6032 is used to input the abnormal traffic samples into the adversarial network;

[0133] Generative Adversarial Network (GAN) generation module 6033 is used to train the abnormal traffic sample using the GAN based on the second data size parameter and the second data dispersion adjustment parameter to generate the second malicious traffic sample.

[0134] Based on the above embodiments, as an optional embodiment, the generative adversarial network generation module 6033 includes:

[0135] The first generation module 60331 is used to generate the second malicious traffic sample based on the abnormal traffic sample by generating an adversarial network generator.

[0136] The first discrimination module 60332 is used to determine the number of the second malicious traffic samples based on the second data scale parameter by using a discriminator of a generative adversarial network, and to determine the dispersion of the second malicious traffic samples and the abnormal traffic samples based on the second data dispersion adjustment parameter.

[0137] Based on the above embodiments, as an optional embodiment, the first discrimination module 60332 is specifically used for:

[0138] The discriminator of the generative adversarial network determines that the ratio of the number of second malicious traffic samples to the number of abnormal traffic samples conforms to the second data size parameter; the discriminator of the generative adversarial network determines that the cosine similarity between the second malicious traffic samples and the abnormal traffic samples is higher than the second data dispersion adjustment parameter.

[0139] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a method for generating malicious traffic samples. This method includes: acquiring multiple datasets; each dataset including a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy; determining a second data size parameter and a second data dispersion adjustment parameter based on the multiple datasets; generating a second malicious traffic sample according to the second data size parameter, the second data dispersion adjustment parameter, and abnormal traffic samples predetermined by the network security system; wherein the second data size parameter is used to determine the number of second malicious traffic samples; the second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic sample and the abnormal traffic sample; the first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

[0140] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0141] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the malicious traffic sample generation method provided by the above methods. The method includes: acquiring multiple datasets; each dataset including a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy; determining a second data size parameter and a second data dispersion adjustment parameter based on the multiple datasets; generating a second malicious traffic sample according to the second data size parameter, the second data dispersion adjustment parameter, and abnormal traffic samples predetermined by a network security system; wherein, the second data size parameter is used to determine the number of second malicious traffic samples; the second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic sample and the abnormal traffic sample; the first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

[0142] On the other hand, please refer to Figure 8 The present invention also provides a system for generating malicious traffic samples, comprising:

[0143] The electronic device 810; and the network security system 820.

[0144] The network security system 820 is used to determine the first detection accuracy of the first malicious traffic sample.

[0145] Among them, the network security system 820 can be an intrusion detection system (IDS), an intrusion prevention system (IPS), a web application protection system (WAF), or a firewall, etc.

[0146] It should be noted that there is no specific limit to the number of network security systems 820 here, and it can include one or more.

[0147] Electronic device 810 is used to acquire multiple datasets; each dataset includes a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy; a second data size parameter and a second data dispersion adjustment parameter are determined based on the multiple datasets; a second malicious traffic sample is generated according to the second data size parameter, the second data dispersion adjustment parameter, and abnormal traffic samples predetermined by the network security system.

[0148] The second data size parameter is used to determine the number of the second malicious traffic samples; the second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic samples and the abnormal traffic samples.

[0149] The first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

[0150] It should be noted that the electronic device 810 incorporates a generative adversarial network (GAN) structure. Whether the electronic device 810 uses the GAN is controlled via a state toggle button, with two modes: PASS and WORKING.

[0151] The PASS state is a pass-through mode, meaning the generative adversarial network (GAN) is disabled, and all traffic passes through directly without any processing. In pass-through mode, the GAN is completely ineffective and does not alter the original network structure. When business traffic is high, it is recommended to put electronic device 810 in PASS state to avoid impacting business operations.

[0152] The WORKING state indicates that the Generative Adversarial Network (GAN) is enabled. This GAN enhances malicious traffic samples within the traffic data. In working mode, the GAN learns patterns from abnormal traffic samples collected by the network security system 820, constructs new malicious traffic samples, merges them with the previous original data, and uses this as new training data to train various network security defense systems. This improves the detection capabilities of each network security system 820 for unknown malicious samples.

[0153] Please refer to Figure 9 , Figure 9This diagram illustrates the generation of malicious traffic samples by a system. The data in the diagram generally flows from left to right. When a generative adversarial network (GAN) is enabled, business traffic data first passes through the GAN of electronic device 810 and is combined with the data generated by that GAN before flowing to various network security systems 820. During the processing of traffic data, the various network security systems 820 detect anomalous samples. These anomalous samples are collected and stored in an anomalous sample dataset. The anomalous traffic samples in this dataset then flow back to electronic device 810 for analysis, resulting in new malicious traffic samples. Electronic device 810 then obtains the initial detection accuracy of the actual network security systems 820, i.e., it feeds back the initial detection accuracy of each network security system 820 to electronic device 810. Electronic device 810 then adjusts the number of regenerated malicious traffic samples and the dispersion of the data.

[0154] The malicious traffic sample generation system of this invention generates data scale parameters and data dispersion adjustment parameters based on the detection accuracy of a first malicious traffic sample fed back by the network security system. The data scale parameters are used to adjust the number of second malicious traffic samples generated, and the data dispersion adjustment parameters are used to adjust the dispersion between the second malicious traffic sample and the abnormal traffic sample. This achieves controllability in the malicious traffic sample generation process. Specifically, during the malicious traffic sample generation process, the newly generated malicious traffic samples are dynamically adjusted based on the data scale parameters and data dispersion adjustment parameters. This improves the flexibility of malicious traffic data generation in response to actual situations and enables dynamic adjustment of the malicious traffic sample production process. Furthermore, by adjusting the data scale parameters and data dispersion adjustment parameters of the generated malicious traffic samples based on the detection accuracy fed back by the network security system, it achieves organic integration with existing detection systems, fully leveraging the abnormal traffic detection and identification capabilities of the network security system.

[0155] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a method for generating malicious traffic samples provided by the methods described above. This method includes: acquiring multiple datasets; each dataset including a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy; determining a second data size parameter and a second data dispersion adjustment parameter based on the multiple datasets; generating a second malicious traffic sample according to the second data size parameter, the second data dispersion adjustment parameter, and abnormal traffic samples predetermined by a network security system; wherein the second data size parameter is used to determine the number of second malicious traffic samples; the second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic sample and the abnormal traffic sample; the first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; and the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

[0156] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0157] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0158] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating malicious traffic samples, characterized in that, include: Obtain multiple datasets; Each dataset includes a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy; Based on the multiple datasets, determine the second data size parameter and the second data dispersion adjustment parameter; A second malicious traffic sample is generated based on the second data size parameter, the second data dispersion adjustment parameter, and the abnormal traffic sample predetermined by the network security system. The second data scale parameter is used to determine the number of the second malicious traffic samples; The second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic sample and the abnormal traffic sample; The first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

2. The method for generating malicious traffic samples according to claim 1, characterized in that, The determination of the second data size parameter and the second data dispersion adjustment parameter based on the multiple datasets includes: A target fitting curve is constructed based on the multiple datasets. The target fitting curve represents the first detection accuracy corresponding to the distribution of the first data size parameter and the first data dispersion adjustment parameter. The target fitting curve that minimizes the mean square error of the first detection accuracy is solved by the gradient descent method to obtain the second data size parameter and the second data dispersion parameter.

3. The method for generating malicious traffic samples according to claim 1, characterized in that, The step of generating a second malicious traffic sample based on the second data size parameter, the second data dispersion adjustment parameter, and abnormal traffic samples predetermined by the network security system includes: Obtain abnormal traffic samples collected by the network security system; The abnormal traffic samples are input into a generative adversarial network; The second malicious traffic sample is generated by training the abnormal traffic sample using the generative adversarial network based on the second data size parameter and the second data dispersion adjustment parameter.

4. The method for generating malicious traffic samples according to claim 3, characterized in that, The process of generating the second malicious traffic sample by training the abnormal traffic sample using the generative adversarial network based on the second data size parameter and the second data dispersion adjustment parameter includes: The second malicious traffic sample is generated based on the abnormal traffic sample using a generator of a generative adversarial network; The discriminator of the generative adversarial network determines the number of the second malicious traffic samples based on the second data size parameter, and determines the dispersion between the second malicious traffic samples and the abnormal traffic samples based on the second data dispersion adjustment parameter.

5. The method for generating malicious traffic samples according to claim 4, characterized in that, The step of using a generative adversarial network (GAN) discriminator to determine the number of the second malicious traffic samples based on the second data size parameter, and to determine the dispersion between the second malicious traffic samples and the abnormal traffic samples based on the second data dispersion adjustment parameter, includes: The discriminator of the generative adversarial network determines that the ratio of the number of second malicious traffic samples to the number of abnormal traffic samples conforms to the second data size parameter; the discriminator of the generative adversarial network determines that the cosine similarity between the second malicious traffic samples and the abnormal traffic samples is higher than the second data dispersion adjustment parameter.

6. A device for generating malicious traffic samples, characterized in that, include: The dataset acquisition module is used to acquire multiple datasets; Each dataset includes a first data size parameter, a first data dispersion adjustment parameter, and a first detection accuracy; The parameter acquisition module is used to determine a second data size parameter and a second data dispersion adjustment parameter based on the multiple datasets. The malicious sample generation module is used to generate a second malicious traffic sample based on the second data scale parameter, the second data dispersion adjustment parameter, and the abnormal traffic sample predetermined by the network security system. The second data scale parameter is used to determine the number of the second malicious traffic samples; The second data dispersion adjustment parameter is used to determine the dispersion between the second malicious traffic sample and the abnormal traffic sample; The first detection accuracy is determined by the network security system after detecting the first malicious traffic sample; the first malicious traffic sample is determined based on the first data size parameter and the first data dispersion adjustment parameter.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method for generating malicious traffic samples as described in any one of claims 1 to 5.

8. A system for generating malicious traffic samples, characterized in that, include: The electronic device of claim 7; as well as A network security system, wherein the network security system is used to determine a first detection accuracy of a first malicious traffic sample.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method for generating malicious traffic samples as described in any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method for generating malicious traffic samples as described in any one of claims 1 to 5.

Images