Method for constructing an enhanced network threat detection model based on adversarial learning

Abstract

The application discloses a method for constructing an enhanced network threat detection model based on adversarial learning, comprising the steps of constructing a network threat detection model, constructing a threat traffic generation model, and combining the trained threat traffic generation model and the network threat detection model to obtain an enhanced network threat detection model. The application has the following beneficial effects: 1) for the emerging variant adversarial attack threat, the network threat detection model is enhanced through the adversarial training method, and the network threat detection model can better adapt to the real network environment; 2) based on WGAN, the variant attack traffic sample is generated, and the traffic sample closest to the to-be-detected traffic is screened out and replaced, so that the sample can meet the existing traffic distribution and can avoid the escape risk caused by the variant attack sample; 3) the black-box adversarial attack can be effectively coped with without assuming the variant adversarial path in advance.

Description

Technical Field

[0001] This invention relates to the field of malicious network threat detection technology, and in particular to a method for constructing an enhanced network threat detection model based on adversarial learning. Background Technology

[0002] Network threat detection is a crucial means of ensuring cyberspace security. With the continuous development of network technology, the number of devices connected to the network and the scale of users are constantly increasing. At the same time, network attack techniques and methods are also constantly evolving, making network attack detection increasingly difficult. Among these, new variant attacks bypass existing threat detection models by making minor adjustments to existing attack methods, achieving their targets and posing a significant challenge to network security.

[0003] Existing threat detection models are based on existing attack data, involving feature extraction and model training. The fitted results form the detection model for subsequent threat detection. Current machine learning methods, such as deep learning, utilize massive amounts of data to build threat detection models, possessing existing threat detection capabilities and a certain degree of generalization ability against variant threats. However, limited by existing model training methods, these models have limited generalization ability and cannot effectively cope with the large number of emerging variant threats. The application of adversarial attacks further accelerates the evolution of variant attacks, increasing the risk of escape during network threat detection, which is a pressing problem that existing network threat detection models need to address.

[0004] The problem is currently facing the following challenges: (1) new variants of network attacks are constantly emerging, and existing attack detection models are unable to make effective detections; (2) existing network threat detection models have insufficient generalization ability and cannot effectively deal with variant threats, posing a significant risk of adversarial escape. Summary of the Invention

[0005] The purpose of this invention is to provide a method for constructing an enhanced network threat detection model based on adversarial learning. The enhanced network threat detection model constructed by this invention utilizes adversarial training techniques to improve the generalization effect of the threat detection model, enabling it to have a better defense against variant threats.

[0006] The technical solution to achieve the objective of this invention is as follows: a method for constructing an enhanced network threat detection model based on adversarial learning, wherein the enhanced network threat detection model includes a network threat detection model and a threat traffic generation model; including,

[0007] Step 1: Build a network threat detection model;

[0008] 1.1 Collect network flows with network threats as training data;

[0009] 1.2 Extract the traffic characteristics of the data samples from the training data, normalize the traffic characteristics to obtain feature vectors, and then arrange the feature vectors to form a feature matrix;

[0010] 1.3 A 10-fold crossover method is used to divide the training data into a training set and a validation set;

[0011] 1.4 Input the feature matrix of the data samples in the training set into the neural network for training to obtain the initial network threat detection model;

[0012] 1.5 Input the feature matrix of the data samples in the validation set into the initial network threat detection model for validation, and select the model with the best accuracy as the network threat detection model;

[0013] Step 2, construct a threat traffic generation model; the threat traffic generation model includes a random number generator and a traffic generator;

[0014] 2.1 Use a random seed to call a random number generator to generate random numbers, and use a flow generator to generate feature vectors with the same dimension as the training data samples;

[0015] 2.2 Using the nearest neighbor method, the feature vector that is closest to the data sample in the training data is selected as the generated traffic sample;

[0016] 2.3 Train the traffic generator using generated traffic samples;

[0017] 2.4 The WGAN training algorithm is used to further counter the training traffic generator;

[0018] Step 3: Combine the trained threat traffic generation model and network threat detection model to obtain an enhanced network threat detection model; the output data of the threat traffic generation model is the input data of the network threat detection model.

[0019] In a further technical solution, the neural network is a DNN, CNN, or LSTM.

[0020] A further technical solution involves collecting network flows posing network threats, specifically by collecting bidirectional network flows at the network card interface and aggregating them into a network flow through flow reconstruction.

[0021] Compared with existing technologies, the beneficial effects of this invention are: 1) In response to the ever-emerging variant adversarial attack threats, the network threat detection model is enhanced through adversarial training methods, which can better adapt to the real network environment; 2) Variant attack traffic samples are generated based on WGAN, and traffic samples that are closest to the traffic to be tested are selected for replacement, so that the samples can meet the existing traffic distribution and avoid the escape risk caused by variant attack samples; 3) It can effectively deal with black-box adversarial attacks without having to assume variant adversarial paths in advance. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of using CNN as a network threat detection model.

[0023] Figure 2 This is a schematic diagram illustrating how adversarial learning enhances a network threat detection model.

[0024] Figure 3 This is a flowchart of the training phase of the network threat detection model and threat traffic generation model.

[0025] Figure 4 This is a flowchart of the enhanced network threat detection model obtained by combining the network threat detection model and the threat traffic generation model during the testing phase (or usage phase). Detailed Implementation

[0026] This invention targets the enhancement of traffic-oriented network threat detection models, specifically flow-feature-based network attack detection models. The method enhances existing attack detection models through adversarial training, thereby improving their effectiveness.

[0027] The present invention provides a method for constructing an enhanced network threat detection model based on adversarial learning, comprising the following steps:

[0028] Step 1: Extract network threat traffic features based on network traffic behavior.

[0029] Step 2: Train a network threat detection model based on deep learning.

[0030] Step 3: Enhance the network threat detection model based on adversarial methods.

[0031] Step 1 involves extracting features from network traffic data based on the behavior of network threats on the network; Step 2 involves training a network threat detection model based on deep learning methods, building upon Step 1; and Step 3 involves enhancing the network threat detection model using adversarial methods to enable it to perform threat detection better, thus achieving an adversarially enhanced network threat detection model.

[0032] According to the above scheme, step 1 specifically includes:

[0033] Data packets are collected at the network interface card (NIC) and aggregated into network flows through flow reconstruction. A network flow represents a single, completed interaction between two network host entities, representing an ordered set of packets from the first to the last during the network connection process. Data packets within a network flow share the same 5-tuple: <source IP, destination IP, source port, destination port, protocol>. This network flow is bidirectional, meaning the source and destination IPs and ports can be interchanged. A maximum flow duration and maximum flow interval are defined for each network data flow; here, the maximum flow duration is defined as 30 minutes, and the maximum flow interval as 15 seconds. Network traffic features are extracted for each network flow, including basic network traffic features, network behavior features, and network content-related features.

[0034] Step 1 specifically includes:

[0035] 1.1 Network data flow aggregation based on 5-tuples. A hash map (HashMap) is constructed using <source IP, destination IP, source port, destination port, protocol> as the key.<K,V> The hash map is initialized to empty. Here, K is the key, used to identify each data stream, and V is the value used to store data packets within the stream. For each newly arriving packet, a key-value pair matching the key is searched in the HashMap. If a matching key-value pair exists, proceed to step 1.2 to update the key-value pair. Otherwise, a new key-value pair is created, where K is the data packet <source IP, destination IP, source port, destination port, protocol>, and V is the packet's meta-attributes, such as packet length, time, and flags.

[0036] 1.2 Key-value pair update. Search for the key-value pair corresponding to the package in the HashMap, keeping K unchanged, and add the meta-attribute of the new package to V. Check the stream truncation condition according to 1.3. If the stream truncation condition is met, truncate the network stream, export the stream data according to 1.4, and delete the corresponding element in the hash map.

[0037] 1.3 Flow Truncation Conditions. Currently, three flow truncation conditions are considered: 1) Flow duration exceeds 30 minutes, meaning the time difference between the first and last packets of the flow is greater than 30 minutes. 2) Flow waiting time exceeds 15 seconds, meaning the time interval between two adjacent packets within the flow is greater than 15 seconds. 3) Connection termination flags: For TCP traffic, the presence of the FIN or RST flags indicates the connection has ended.

[0038] 1.4 Stream Data Export. Data packets within the stream are sorted chronologically. Meta-features such as time, packet length, and flags are extracted from each data packet. These meta-features are then aggregated to obtain statistical characteristics of the entire network stream. The stream identifier and stream characteristics are output.

[0039] The specific traffic features extracted include:

[0040]

[0041]

[0042]

[0043] After stream reconstruction, a characteristic representation of network threat traffic can be obtained.

[0044] According to the above plan, step 2 is as follows:

[0045] Step 2.1 Flow Feature Normalization. The flow features are normalized using the Z-score method. Each dimension of the flow feature is processed according to the following formula.

[0046]

[0047] Where x represents the traffic feature to be processed, which is the result of the traffic after processing in step 1, u represents the feature mean, and σ represents the feature variance. After normalization, the feature mean is guaranteed to be 0 and the feature variance is 1.

[0048] Step 2.2 defines the neural network structure. The model structure can be, but is not limited to, commonly used structures such as DNN, CNN, and LSTM. Here, CNN is used as a representative to illustrate the detection model structure. The network threat detection model designed here consists of three parts: an input layer, a feature encoding layer, and a decision layer. The input layer is used to receive input features. The feature encoding layer uses the CNN method to further extract features from the original features, forming a more powerful feature representation. The decision layer consists of multiple deep fully connected networks, used to fit the target category and predict subsequent attacks.

[0049] The overall structure of the model is as follows Figure 1 As shown, for a 75-dimensional feature input, 6 zero-dimensional features are first padded to the end, forming a total of 81-dimensional features. This feature vector is then rearranged to form a 9×9 feature matrix. Based on this, operations such as convolution and pooling are used to abstract and combine the features to obtain a more abstract representation of network traffic behavior features.

[0050] Step 2.3 Network Threat Detection Model Training. Traffic data is divided into training and testing data, and features are extracted and normalized for each. A 10-fold cross-validation method is used to partition the data, dividing the training data into a training set and a validation set. The model with the best accuracy on the validation set is selected as the final attack detection model.

[0051]

[0052] Accuracy is calculated as shown in formula (2), where correct represents the number of samples correctly classified and total represents the total number of samples.

[0053] According to the above scheme, the main objective of step 3 is to enhance the original threat detection model to effectively cope with the impact of variant adversarial attacks. The goal is to correctly classify adversarial variant attacks and place them back into their original categories. For example, if the initial attack is a DDoS attack, the attacker may adjust their attack behavior by changing the attack frequency, attempting to evade the threat detection system. The detector system should identify this attack as accurately as possible and classify it as a DDoS attack. In a real network environment, it is generally assumed that the attacker is a black box to the defender, meaning the defender does not know what strategies the attacker will use to adjust their attack. To better counter attackers, the defender can assume that the attacker is a white box to the attacker, meaning the attacker may know the design details of the defense model and thus make targeted adjustments.

[0054] Based on the above assumptions and requirements, step 3 is as follows:

[0055] Step 3.1 Train the Generative Adversarial Network (GAN) based on existing data, enabling it to generate sample data that conforms to the training data distribution. Since the attacker's adjustment strategy is unknown, we cannot directly provide the attacker-adjusted traffic data samples. To simulate this black-box defense environment, we start with random noise, generate a series of suitable sample data using a generator, and train the generator to generate traffic samples that conform to the training data distribution.

[0056] The process is as follows Figure 2 As shown, firstly, a series of random numbers are generated using the system's random number generator with a random seed. Then, a feature vector with the same dimension as the sample x is generated based on the generator. The nearest neighbor method is used to select the generated sample z* closest to x, which is then used as the input to train the generator. Here, a training step decomposition method similar to expectation maximization is adopted, separating the selection of generated samples from the generator optimization. The process iterates between the sample selection and generator optimization steps to find a sample that is relatively close to x in the training distribution for each sample x.

[0057] Figure 2 In this context, the classifier module represents the classification result obtained through training in step 2. Figure 2 The main goal of the generator is to generate samples G(z) using a random vector z.

[0058] Step 3.2 Generator Training. To better fit the target distribution, in addition to selecting samples, the generator needs continuous iteration to better cover variant attack traffic samples. Here, WGAN is used for generator training, which largely solves the jitter problem of GAN during training.

[0059] The WGAN training algorithm is as follows:

[0060]

[0061] The training processes for network threat detection models and adversarial generative networks can be referenced. Figure 3 As shown.

[0062] After obtaining the network threat detection model and threat traffic generation model in steps 2 and 3, they are combined into an enhanced network threat detection model.

[0063] When testing or using the enhanced network threat detection model, the process is as follows: Figure 4 As shown.

[0064] For traffic sample defense, a threat traffic generation model is first used. Based on the generator, R seeds are randomly sampled for each input traffic sample, and the generator is used to generate traffic samples. The generated samples at this time are samples that satisfy the distribution of the training data, which can effectively maintain the distribution characteristics of the traffic data. For each test sample, based on the traffic sample generated by the generator and its calculated distance, the generated sample that is closest to the test sample is found, and its selection objective function is shown in formula (8). In this way, traffic that can maintain the sample distribution characteristics and effectively resist variant attacks is obtained:

[0065]

[0066] Where, p data Represents the original data sample distribution

[0067] Then, a network threat detection model is used to identify threats and obtain the final threat classification result.

Claims

1. A method for constructing an enhanced network threat detection model based on adversarial learning, characterized in that the enhanced network threat detection model includes a network threat detection model and a threat traffic generation model; including, Step 1: Build a network threat detection model; 1.1 Collect network flows with network threats as training data; 1.2 Extract the traffic characteristics of the data samples from the training data, normalize the traffic characteristics to obtain feature vectors, and then arrange the feature vectors to form a feature matrix; 1.3 A 10-fold crossover method is used to divide the training data into a training set and a validation set; 1.4 Input the feature matrix of the data samples in the training set into the neural network for training to obtain the initial network threat detection model; 1.5 Input the feature matrix of the data samples in the validation set into the initial network threat detection model for validation, and select the model with the best accuracy as the network threat detection model; Step 2, construct a threat traffic generation model; the threat traffic generation model includes a random number generator and a traffic generator; 2.1 Use a random seed to call a random number generator to generate random numbers, and use a flow generator to generate feature vectors with the same dimension as the training data samples; 2.2 Using the nearest neighbor method, the feature vector that is closest to the data sample in the training data is selected as the generated traffic sample; 2.3 Train the traffic generator using generated traffic samples; 2.4 The WGAN training algorithm is used to further counter the training traffic generator; Step 3: Combine the trained threat traffic generation model and network threat detection model to obtain an enhanced network threat detection model; the output data of the threat traffic generation model is the input data of the network threat detection model.

2. The method for constructing an enhanced network threat detection model based on adversarial learning as described in claim 1, characterized in that, The neural network is a DNN, CNN, or LSTM.

3. The method for constructing an enhanced network threat detection model based on adversarial learning as described in claim 1, characterized in that, The collection of network flows posing a network threat specifically involves: collecting bidirectional network flows at the network card interface and aggregating them into a network flow through flow reconstruction.

Images