Network anomaly-oriented causal diffusion model detection method and system

Abstract

The invention discloses a network anomaly-oriented causal diffusion model detection method and system. The method comprises the following steps: executing a causal generation diffusion process of sample training, and learning a model (belonging to 1) which predicts noise and enables characteristics to be mutually independent; learning feature weights G of causal effects between samples and performing feature screening; learning a model (belonging to 2) which predicts noise so that the features of the samples are mutually independent and have no noise features; generating a balance sample and training a detector; noise is added to detection data through the feature weight G and a model (belonging to 1), and a detection result is obtained through a detector. The invention aims to solve the problem that the stability and mobility of an IOT network anomaly detection model are affected due to the confusion of the corresponding relation between tags and features such as network attacks caused by inconsistent distribution of training samples and detection samples in an IOT network scene and the confusion of the corresponding relation between the tags and the features due to the fact that the samples contain a large amount of false correlation and noise information.

Description

Technical Field

[0001] The present invention belongs to the technical field of IOT network security, and in particular relates to a causal diffusion model detection method and system for network anomalies. Background Art

[0002] With the application and popularization of various smart devices, IOT has become more and more a trend, which has profoundly affected human production and life. However, due to the large number of IOT devices, as well as their openness and distributed characteristics, hundreds of millions of interconnected IOT devices are becoming a stage for hackers to show off their skills and have introduced a large number of potential cyber crimes, and may even trigger global physical world disasters at any time. Compared with traditional computers and other devices, the biggest difference between IOT devices is their small size, and their interconnected nature allows them to connect to multiple devices, so there are more ways to be attacked. In particular, the threat of rare attacks is growing and difficult to prevent, and is becoming one of the most serious threats to IOT security.

[0003] In the past few years, machine learning and other technologies have shown great potential in the field of IoT network anomaly detection due to their inherent learning and reasoning capabilities. However, with the increase in IoT connected devices, network traffic has increased significantly, and the feature information contained in it has also increased. However, this information is also mixed with more noise and redundant information. This information is expressed differently in different environments and devices, resulting in different probability distributions of training data and detection data. However, existing machine learning methods are all based on the assumption of independent and identical distribution of data, which will greatly damage the stability of existing methods. At the same time, these noise and redundant information are inextricably linked to useful information, which not only increases the computational complexity and time consumption of attack detection training, but also results in the deletion of useful information while retaining some noise and redundant information during feature dimensionality reduction, which brings serious challenges to attack detection technology [5]. Secondly, the existing detection data sets have a small number of instances due to the difficulty in collecting samples of some attack types, and there are generally problems such as data imbalance. However, the previous sample generation method cannot effectively learn the useful information of minority samples, resulting in the inability to effectively improve the detection balance of the detection model.

[0004] Combined with previous research on causal reasoning, it is assumed that causal information in all environments is stable and unchanged. Therefore, the main reason for the above problems is that the training and test samples contain a lot of noise information, and the noise information varies greatly due to the differences in IoT devices and deployment environments. Because the previous detection method based on association reasoning would fit the noise information, the false associations contained in the samples in different environments and devices are different, which makes the information redundant, the samples are not independent and identically distributed, and the generated samples cannot learn useful information. For example, there are many reasons for the correlation between two variables A and B, not just the causal relationship such as A→B or B→A. A very common possibility for the correlation is that A and B are caused by the same reason: C→A and C→B, then A and B will also show obvious correlation, but it cannot be said that A→B or B→A. Therefore, the existence of C leads to the establishment of a false association between A and B, but this false association is not a causal relationship. Therefore, this not only leads to the fitting and lack of stability of noise information in machine learning, but also brings a serious problem that the detection model based on association reasoning lacks causal interpretability. For example, in IoT intrusion detection, machine learning and other methods identify security threats based on the correlation between traffic anomalies and attack types, and discover some non-causal features in correlation mining, such as the relationship between various risk factors (such as mass network activities) and traffic anomalies, and use this strong false correlation to make predictions. This prediction method without causal explainability cannot provide a reliable basis for decision-making.

[0005] A spurious association (Definition 1) is usually defined as a relationship that appears to exist as a causal relationship but does not actually exist. In causal reasoning, it generally refers to the situation where a causal relationship is inferred between two events that have no causal relationship due to confounding factors or unobserved exogenous latent variables. Figure 1 In the formula, R represents risk factor, A represents 1 ~A n-1 represents network attack, and F represents feature. Figure 1 As shown, network attack A 1 ~A n-1 This will cause feature F to be abnormal. Assume that network attack A 1 ~A n-1 The risk factor R has not been observed or counted in previous data, but it will inevitably lead to cyber attack A. k and the appearance of feature F, if only the calculation is based on the association reasoning, it will be concluded that a certain network attack A k The completely wrong conclusion is that characteristic F is the cause.

[0006] Structural causal model (Definition 2), referred to as SCM, is a formalized mathematical model language, which consists of a graphical model representing causal knowledge, causal intervention and counterfactual reasoning that explain causal knowledge, and structural equations that connect the two semantically. Each node in SCM corresponds to a variable, and the arrows between variables represent the causal relationship from cause to effect. Figure 2 In the formula, R represents risk factor, A represents 1 and A 2 represents network attack and F represents feature. Figure 2 Medium, F 1 ,F 2 ,F 3 It is a stable feature and is related to network attack A 1 and A 2 There is a causal relationship between them, F 4 is a noise feature (unstable feature), which is related to the network attack A 1 and A 2 There is a false correlation between them. Figure 2 (a) in the figure is a structural causal model under an ideal state. In this scenario, the causal relationship between network attacks and abnormal features can be established quickly and effectively. Assuming that ∮ represents the mapping function between the traffic feature set F and the network attack A, we have:

[0007] ∮(F)=∮(F 1 ,F 2 ,F 3 ,F 4 )=∮(F 1 ,F 2 ,F 3 );

[0008] Figure 2 (b) in the figure is a structural causal model in the actual state. Since there are various false associations between features (shown by the dotted line at the bottom of the figure), there are also false associations between cyber attacks and noise features. The existence of multiple false associations will confuse the correspondence between cyber attacks and abnormal features, and may mislead the machine learning model to learn the wrong rules, thereby reducing the performance and interpretability of the model. Therefore, there are:

[0009] Pr(∮(F 1 ,F 2 ,F 3 ,F 4 )) <Pr(∮(F 1 ,F 2 ,F 3 )),

[0010] In the above formula, Pr represents the detection accuracy, Pr(∮(F 1 ,F 2 ,F3 F in )) 1 ⊥F 2 ⊥F 3 , where “⊥” indicates that there is no correlation between features. From this, we can conclude that the problem 1 of the existing technology: the traditional anomaly detection method may lead to low accuracy and unexplainable detection results because it does not distinguish between causal associations and false associations.

[0011] An unbalanced dataset (Definition 3) means that there are more normal traffic and less malicious traffic, and different types of malicious traffic have significant differences in the number of samples. Figure 3 As shown in the figure, in the unbalanced detection NSL-KDD dataset, there are normal samples, Neptune attack samples, IP attack samples, ipsweep, port attack samples, teardrop attack samples, network mapping attack samples, nmap, SATAN attack samples, satan, and Smurf attack samples. The majority class is composed of normal samples and frequent attack samples, neptune, and the minority class is composed of infrequent and rare attack samples, such as teardro and nmap. In the NSL-KDD detection set, teardro and nmap are often given detection results with large errors, resulting in teardro and nmap not being detected or being misclassified as normal and neptune, which seriously affects the robustness of the detection and classification system. Assume Figure 2 A 1 is the majority class sample, A 2 For minority class samples, we have:

[0012] Pr(A 1 )>>Pr(A 2 ),

[0013] In the above formula, Pr represents the detection accuracy. From this, we can conclude that the problem 2 of the existing technology is that the sample imbalance will cause the attack detection method to overfit to the majority class samples and underfit to the minority class samples, which will cause the detection algorithm to be unable to effectively detect the anomaly type with a small number of instances.

[0014] Samples are not independent and identically distributed (Definition 4), referred to as N-IID, which means that the data in a system or data set do not satisfy the same probability distribution or data generation process. This means that different data samples may have different probability distribution characteristics, such as the statistical characteristics, distribution form, and data generation method of the data. Figure 4As shown in Figure 1, existing intrusion detection methods all rely on the assumption of independent and identical distribution of data, that is, the probability distribution of training data and detection data is completely consistent. However, when the detection system is applied to various actual network environments, due to factors such as noise and environmental configuration, the actual input detection data may be N-IID with the training data, which may cause the accuracy of the detection system to drop sharply to an extremely low level, namely:

[0015] D Pr (∮(F 1 ,F 2 ,F 3 ,F 4 ))<<T Pr (∮(F 1 ,F 2 ,F 3 ,F 4 )),

[0016] In the above formula, D Pr Indicates the detection accuracy, T Pr It indicates the training accuracy. Therefore, we can conclude that the problem 3 of the prior art is that N-IID will greatly damage the stability of the detection model, resulting in the inability of the detection model with high training accuracy to effectively adapt to different environmental detection requirements. Summary of the invention

[0017] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a causal diffusion model detection method and system for network anomalies are provided. The present invention aims to solve the problem that the distribution of training samples and detection samples in IOT network scenarios is inconsistent, and the samples contain a large amount of false associations and noise information, which leads to confusion in the correspondence between labels and features such as network attacks, thereby affecting the stability and mobility of the IOT network anomaly detection model.

[0018] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0019] A causal diffusion model detection method for network anomalies includes the following steps:

[0020] S1, execute the causal generative diffusion process of sample training, including: adding noise to the samples in the original training data through the causal generative diffusion model so that the features of the samples are independent of each other and the probability distribution remains unchanged, and learning a model model (∈ 1); The independent features are trained through the potential result model to obtain the feature weights G of the causal effects between samples and perform feature screening; the samples after feature screening are subjected to noise addition and denoising to make the features of the samples independent of each other, the probability distribution remains unchanged and there is no noise feature, and the model model (∈ 2 );

[0021] S2, executes the generation process of balanced samples, including: adding noise to the sample after feature screening to obtain the noisy sample between the feature weight G and the model model (∈ 2 ) is used to generate minority class samples under the guidance of the , and then merge them with samples whose features are independent, the probability distribution remains unchanged and there is no noise feature to obtain balanced samples, and use the balanced samples to train the detector;

[0022] S3, executes the causal diffusion process of the detection sample, including: for the original network attack detection data, through the feature weight G and model model (∈ 1 ) is used as a guide to generate detection samples with independent features by adding noise, which are input into the detector to obtain the network attack detection results.

[0023] Optionally, in step S1, the samples in the original training data are denoised by the causal generative diffusion model so that the features of the samples are independent of each other and the probability distribution remains unchanged, and a model model (∈ 1 )include:

[0024] S101, obtain the sample X={A,F} label A and its feature vector F={F 1 ,F 2 ,…,F p}, where F 1 ~F p Initialize loop variable i for p features in feature vector F;

[0025] S102, keep the label A unchanged, and add noise to the feature vector F of each sample C according to the following formula:

[0026] F→F+ε i ,

[0027] In the above formula, F represents the feature vector, “→” represents the noise adding process, ε i is the i-th noise;

[0028] S103, adjust the i-th noise ε i This makes the following probability distribution remain unchanged:

[0029] P(A|F)=P(A|(F+∑ε i )),

[0030] In the above formula, P(A|F) is the probability distribution of label A with respect to feature vector F, P(A|(F+∑ε i )) is the feature vector F+∑ε after label A adds noise to feature vector F i The probability distribution of

[0031] S104, judging whether the features of sample X are independent of each other according to the following formula:

[0032] (F 1 +∑ε i )⊥(F 2 +∑ε i )⊥…⊥(F p +∑ε i ),

[0033] In the above formula, “⊥” means mutual independence, and the mutual independence means that the correlation coefficient of the features is less than the preset threshold; if the above formula is established, a sample X and a noise ∈ that makes the features of sample X independent and the probability distribution remains unchanged are obtained. 1 =∑ε i ;

[0034] S105, each sample X and the noise ∈ that makes the features of sample X independent of each other and the probability distribution remains unchanged 1 To train the machine learning model, so as to learn a model that predicts noise so that features are independent of each other and the probability distribution remains unchanged

[0035] model(∈ 1 ).

[0036] Optionally, in step S1, the independent features are trained and learned through a potential result model to obtain feature weights G of causal effects between samples and perform feature screening, including:

[0037] S201, the independent features are trained and learned through the potential result model to obtain the causal effect between samples and the effect value of the causal effect of each feature is calculated as the feature weight G according to the following formula, and its function expression is shown in the following formula:

[0038]

[0039] In the above formula, the feature weight G is a 1×p-dimensional vector, p is the number of features of sample X, E is the expected value, g is the diagonal matrix composed of the elements in the causal weight G, ∈ is the noise of independent features, ∈+x t,i and∈+x t,I-i is a noise feature with label A and no causal effect, xy,i represents the i-th feature of sample X, x t,I-i represents the Ii-th feature of sample X, I represents all features of sample X, (∈+x t,i ) 0 Indicates that except for the i-th feature which is set to normal by intervention, the values ​​of other features remain unchanged, (∈+x t,I-i ) 0 It means that except for the value of the i-th feature which remains unchanged, the other features are set to normal by intervention;

[0040] S202, eliminating features whose feature weight G is 0, and selecting remaining features whose feature weight G is not 0.

[0041] Optionally, in step S1, the sample after feature screening is subjected to noise addition and denoising so that the features of the sample are independent of each other, the probability distribution remains unchanged, and there is no noise feature, and a model model (∈ 2 )include:

[0042] S301, obtain the sample X={A,F} label A and its feature vector F={F 1 ,F 2 ,…,F p}, where F 1 ~F p Initialize loop variable i for p features in feature vector F;

[0043] S302, judging whether the features of the sample X after feature screening are independent of each other according to the following formula:

[0044] F 1 ⊥F 2 ⊥…⊥F p ,

[0045] In the above formula, “⊥” means mutual independence, which means that the correlation coefficient of the features is less than the preset threshold; if it is established, the noise of sample X is determined to be 2 If it is 0, jump to step S305; otherwise, jump to step S303;

[0046] S303, keeping the label A unchanged, adding noise to the feature vector F of each sample X according to the following formula:

[0047] F→F+ε i ,

[0048] In the above formula, F represents the feature vector, “→” represents the noise adding process, ε i is the i-th noise;

[0049] S304, determining whether the noise sample obtained by adding noise satisfies the following formula and whether the features are not independent of each other:

[0050] P(A|F)≠P(A|(F+∑ε i )),

[0051] In the above formula, P(A|F) is the probability distribution of label A with respect to feature vector F, P(A|(F+∑ε i )) is the feature vector F+∑ε after label A adds noise to feature vector F i The probability distribution of sample X is determined if the noise ∈ 2 =∑ε i , jump to step S305;

[0052] S305, each sample X and the noise ∈ that makes the features of sample X independent of each other, the probability distribution remains unchanged and has no noise features 2 To train the machine learning model, so as to learn the model model (∈ 2 );

[0053] S306, using the model model(∈ 2 ) is the sample X prediction noise ∈ 2 , and subtract the noise ∈ from the feature vector F of sample X 2 , jump to step S302.

[0054] Optionally, in step S2, the noise-added sample obtained by adding noise to the sample after feature screening is added to the feature weight G and the model model (∈ 2 ) under the guidance of generating minority class samples includes: randomly generating a noise sample X noise ={A noise ,F noise}, the noise sample X noise Tag A noise It is a minority attack in network attacks. The attack types of network attacks are divided into frequent attacks and minority attacks according to their frequency of occurrence. The noise sample X noise The eigenvector F noise The dimension is the same as the feature dimension of sample X, through the model model(∈ 2 ) adds noise ∈ to the noise sample 2 Then use the feature weight G to perform feature screening, so as to obtain a 2 ) is used to generate minority class samples under the guidance of

[0055] Optionally, the detector in step S2 is an autoencoder as shown in the following formula:

[0056]

[0057] In the above formula, is the output of the autoencoder, σ is the activation function, φ(X i ) is the sample X i The result obtained by inputting the encoder function, W AE is a weight parameter, β is a bias parameter; and the loss function used by the autoencoder during training is:

[0058]

[0059] In the above formula, L pre is the loss function, Min is the minimum value, n is the number of training samples, W i is the noise∈ 1 The weight given to the i-th sample, Y i is the label of the i-th sample.

[0060] Optionally, in step S2, the original network attack detection data is analyzed by the feature weight G and the model model (∈ 1 ) is used to generate independent detection samples with noise, including: the original network attack detection data is used to generate independent detection samples with noise, including: 1 ) generates noise∈ 1 , add noise ∈ 1 The feature weight G is then used to perform feature screening to generate detection samples with independent features for input into the detector.

[0061] In addition, the present invention also provides a causal diffusion model detection system for network anomalies, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the causal diffusion model detection method for network anomalies.

[0062] In addition, the present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the causal diffusion model detection method for network anomalies through a processor.

[0063] In addition, the present invention also provides a computer program product, including a computer program or instructions, wherein the computer program or instructions are programmed or configured to execute the causal diffusion model detection method for network anomalies through a processor.

[0064] Compared with the prior art, the present invention mainly has the following advantages: the present invention can solve the problem that the distribution of training samples and detection samples in IOT network scenarios is inconsistent, and the samples contain a large amount of false associations and noise information, which leads to confusion in the correspondence between labels and features such as network attacks, thus affecting the stability and mobility of the IOT network anomaly detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 The figure is a schematic diagram of an example of false association in the prior art.

[0066] Figure 2 The figure is a schematic diagram of an example of a structural causal model of a network attack in the prior art.

[0067] Figure 3 The sample quantity distribution of each type in the NSL-KDD dataset in the prior art.

[0068] Figure 4 Schematic diagram of the principle that the performance of the detection method in the prior art depends on the independent and identical distribution of samples.

[0069] Figure 5 Schematic diagram of the basic flow of the method of the embodiment of the present invention.

[0070] Figure 6 In the embodiment of the present invention, the sample is denoised and the model model (∈ 1 ) flow chart.

[0071] Figure 7 Schematic diagram of the principle of sample independent weight learning based on the diffusion model in an embodiment of the present invention.

[0072] Figure 8 In the embodiment of the present invention, the sample is denoised and the model model (∈ 2 ) flow chart.

[0073] Fig. 9 The figure is a flow chart of generating balanced samples in an embodiment of the present invention.

[0074] Fig.10 This is the Pearson correlation before and after decoupling of the CICIDS2019 dataset in an embodiment of the present invention.

[0075] Fig.11 It is the Pearson correlation before and after decoupling of the MalMem data set in an embodiment of the present invention.

[0076] Fig.12 It is the Pearson correlation of the NSL_KDD dataset before and after decoupling in the embodiment of the present invention.

[0077] Fig.13The figure is a comparison of detection accuracy before and after the feature weight G is applied in the embodiment of the present invention.

[0078] Fig.14 This is a comparison of the detection accuracy of the data after FSBCE processing before and after sample weighting in an embodiment of the present invention.

[0079] Fig.15 The performance of each detection algorithm after feature selection for each data set in the embodiment of the present invention.

[0080] Fig.16 This is the balance of each detection method in the MalMem dataset in the embodiments of the present invention.

[0081] Fig.17 This is the balance of each detection method in the embodiments of the present invention in the CICDDoS2019 dataset.

[0082] Fig.18 It is the balance of each detection method in the NSL_KDD dataset in the embodiment of the present invention.

[0083] Fig.19 It is the detection rate of different methods in the embodiments of the present invention in the actual IOT network environment. DETAILED DESCRIPTION

[0084] like Figure 5 As shown, the causal diffusion model detection method for network anomalies in this embodiment includes the following steps:

[0085] S1, execute the causal generative diffusion process of sample training, including: adding noise to the samples in the original training data through the causal generative diffusion model so that the features of the samples are independent of each other and the probability distribution remains unchanged, and learning a model model (∈ 1 ); The independent features are trained through the potential result model to obtain the feature weights G of the causal effects between samples and perform feature screening; the samples after feature screening are subjected to noise addition and denoising to make the features of the samples independent of each other, the probability distribution remains unchanged and there is no noise feature, and the model model (∈ 2 );

[0086] S2, executes the generation process of balanced samples, including: adding noise to the sample after feature screening to obtain the noisy sample between the feature weight G and the model model (∈ 2 ) is used to generate minority class samples under the guidance of the , and then merge them with samples whose features are independent, the probability distribution remains unchanged and there is no noise feature to obtain balanced samples, and use the balanced samples to train the detector;

[0087] S3, executes the causal diffusion process of the detection sample, including: for the original network attack detection data, through the feature weight G and model model (∈ 1 ) is used as a guide to generate detection samples with independent features by adding noise, which are input into the detector to obtain the network attack detection results.

[0088] like Figure 6 As shown, in step S1 of this embodiment, the causal generative diffusion model is used to add noise to the samples in the original training data so that the features of the samples are independent of each other and the probability distribution remains unchanged, and a model model (∈ 1 )include:

[0089] S101, obtain the sample X={A,F} label A and its feature vector F={F 1 ,F 2 ,…,F p}, where F 1 ~F p Initialize the loop variable i for the p features in the feature vector F (the CICDDoS2019 dataset contains 78-dimensional features, the MalMem dataset contains 51-dimensional features, and the NSL_KDD dataset contains 41-dimensional features);

[0090] S102, keep the label A unchanged, and add noise to the feature vector F of each sample X according to the following formula:

[0091] F→F+ε i ,

[0092] In the above formula, F represents the feature vector, “→” represents the noise adding process, ε i is the i-th noise;

[0093] S103, adjust the i-th noise ε i This makes the following probability distribution remain unchanged:

[0094] P(A|F)=P(A|(F+∑ε i )),

[0095] In the above formula, P(A|F) is the probability distribution of label A with respect to feature vector F, P(A|(F+∑ε i )) is the feature vector F+∑ε after label A adds noise to feature vector F i The probability distribution of

[0096] S104, judging whether the features of sample X are independent of each other according to the following formula:

[0097] (F 1 +∑εi )⊥(F 2 +∑ε i )⊥…⊥(F p +∑ε i ),

[0098] In the above formula, “⊥” means mutual independence, and the mutual independence means that the correlation coefficient of the features is less than the preset threshold; if the above formula is established, a sample X and a noise ∈ that makes the features of sample X independent and the probability distribution remains unchanged are obtained. 1 =∑ε i ;

[0099] S105, each sample X and the noise ∈ that makes the features of sample X independent of each other and the probability distribution remains unchanged 1 To train the machine learning model, so as to learn a model that predicts noise so that features are independent of each other and the probability distribution remains unchanged

[0100] model(∈ 1 ).

[0101] Due to factors such as noise, there are correlations of different dimensions between features, which can lead to false correlations and thus destroy the stability of the detection model. In order to solve the problem of false correlations, such as Figure 7 As shown, in this embodiment, the dependency between features is eliminated by learning sample weights of a diffusion model, which helps the detection model get rid of the negative impact of false associations and pay more attention to the true causal relationship between discriminant features and network attacks. Figure 7 In, X 0 ~X T To represent the noise result of sample X, F 1 ⊥F 2 ⊥…⊥F p is the p features F in the feature vector F of the sample 1 ~F p Independent of each other, D KL represents the Kullback-Leibler divergence, P(A|X T ) represents the sample X after the first noise addition is completed T The distribution of label A under the condition, P(A|X t ) represents the sample X after the tth noise addition r The distribution of label A under the condition, p(A|X t-1 ) represents the sample X after the t-1th noise addition t-1 The distribution of label A under the condition, q(X t |X t-1 ) represents the sample X after the t-1th noise addition t-1 Sample X after the t-th noise addition under the conditiont The distribution of P θ (X t-1 |X t ) represents the sample X after the tth noise addition t Sample X after t-1 times of noise addition under the condition t-1 The distribution of X 0 To X T The process of gradual noise addition can be expressed as:

[0102]

[0103] In the above formula, is the parameter of the tth step, T is the total number of steps, ∈ is the noise, β i is a parameter, and noise∈~N(0,I),β i ∈(0,1). In order to verify that the features gradually become independent of each other during the noise addition process, the Pearson coefficient is introduced here:

[0104]

[0105] In the above formula, For X t,i and X t,j The Pearson coefficient, X t,i and X t,j is the sample X at time t t The i-th and j-th dimension features of the t-th dimension, cov represents the covariance. In order to keep the features independent of each other, it is necessary to learn a model (∈) so that That is, the model model (∈ 1 ). By adding noise using the diffusion model, there is at least one noise ∈ = {w 1 ,w 2 ,...,w n}It makes the features of the samples independent of each other while ensuring that the probability distribution remains unchanged.

[0106] In step S1 of this embodiment, independent features are trained and learned through a potential result model to obtain feature weights G of causal effects between samples and feature screening includes:

[0107] S201, the independent features are trained and learned through the potential result model to obtain the causal effect between samples and the effect value of the causal effect of each feature is calculated as the feature weight G according to the following formula, and its function expression is shown in the following formula:

[0108]

[0109] In the above formula, the feature weight G is a 1×p-dimensional vector, p is the number of features of sample X, E is the expected value, g is the diagonal matrix composed of the elements in the causal weight G, ∈ is the noise of independent features, ∈+x t,i and∈+x t,I-i is a noise feature with label A and no causal effect, x t,u represents the i-th feature of sample X, x t,I-i represents the Ii-th feature of sample X, I represents all features of sample X, (∈+x t,i ) 0 Indicates that except for the i-th feature which is set to normal by intervention, the values ​​of other features remain unchanged, (∈+x t,I-i ) 0 It means that except for the value of the i-th feature which remains unchanged, the other features are set to normal by intervention;

[0110] S202, eliminating features whose feature weight G is 0, and selecting remaining features whose feature weight G is not 0.

[0111] The effect value of the causal effect is the causal effect weight. According to the causal effect between each network attack or abnormal label and the feature, each feature is given a corresponding weight G, which represents the causal influence of the feature on the label. Such a weight is called the causal effect weight. According to the definition of non-independent and identically distributed (N-IID) samples (Definition 4), assuming that the causal feature x t,c and noise characteristics x t,n are independent of each other, then:

[0112] E(A|x t,c ,x t,n )=E(A|x t,c )E(A|,x t,n ),

[0113] In the above formula, E(A|x t,c ,x t,n ) represents the causal feature x t,c and noise characteristics, x t,n The expected value of label A under the condition, E(A|x t,c ) represents the causal feature x t,c The expected value of label A under the condition, E(A|,x t,n ) represents the noise characteristics, x t,n The expected value of label A under the condition. After the causal diffusion model is used to add noise, the features are independent of each other, and the causal effects of each feature and the network attack do not affect each other, so:

[0114] E((∈+x t,c ),(∈+x t,n )|A)=E((∈+x t,c)|A)E((∈+x t,n )|A),

[0115] In the above formula,

[0116] E((∈+x t,c ),(∈+x t,n )|A) represents the causal feature x after adding noise under label A t,c and noise characteristics x t,n The expected value of E((∈+x t,c )|A) represents the causal feature x after adding noise under label A t,c The expected value of E((∈+x t,n )|A) represents the noise feature x after adding noise under label A t,n The expected value of ∈+x t,c For x t,c Causal features after adding noise ∈, ∈+x t,n For x t,n The noise feature after adding noise ∈ can be simplified as follows because the label A is known:

[0117] E(∈+x t,c ,∈+x t,n )=E(∈+x t,c )E(∈+x t,n ),

[0118] However, in actual sample data, we do not know in advance which feature sets are causal or noise. Therefore, in order to filter out noise features and make the above formula valid in real samples, we add causal effect weight G to the features according to Definition 4:

[0119] E((∈+x t,c )∑g(∈+x t,n ) T )=E((∈+x t,c )G)E(G T (∈+x t,n )),

[0120] In the above formula, G=(G 1 ,G 2 ,…,G p ) is the p×1-dimensional causal effect weight, ∑g is diag(G 1 ,G 2 ,…,G p ), T is the transpose function.

[0121] The "do operation" in the causal effect is used to solve the causal intervention problem. The distribution after intervention caused by the action do(X=x) is given by the following formula:

[0122] PrM (A=a|do(X=x))=Pr M (A=a│X x ),

[0123] In the above formula, Pr M (A = a|do(X = x)) represents the probability distribution of A under the causal intervention setting X = x, Pr M (A=a│X x ) represents the probability distribution of A under the causal intervention setting X = x, X x Represents a causal intervention setting

[0124] X=x.

[0125] At the same time, understanding causal intervention requires distinguishing between statistical (Seeing) reasoning and intervention (Doing) reasoning, namely:

[0126] Pr(A=a|X=x)≠Pr(A=a|X x ),

[0127] In the above formula, Pr(A=a|X=x) represents the probability distribution of A=a under the condition of X=x, and Pr(A=a|X x ) represents the probability distribution of A = a under the condition of causal intervention setting X = x. For example, a website often experiences server crashes when launching a popular drama. This is mainly because hackers take advantage of the large traffic on the website at this time to launch network attacks and hide the attack traffic in normal traffic, making the attack difficult to detect. If we only analyze the statistical data area, we may mistakenly believe that the excessive number of viewers caused the server crash. However, when we perform intervention operations to limit the number of viewers, hackers are unaware of this change, and they will still launch attacks as usual, causing the problem of server crashes. In order to consistently estimate causal effects, most equilibrium methods use moments to describe the distribution, and through the do operation, the average difference between intervention and non-intervention can be compared to estimate the causal effect of features on network attacks. Therefore, in order to accurately obtain causal features and noise features, the weight G can be learned through the do operation in this embodiment, and the specific function expression is shown in step S201. The causal weight can enhance the influence of causal features on labels, decouple the false association between noise features and abnormal labels, and improve the stability of the model. For example, with label A and noise features without causal effects (∈ + x t,n ), its causal weight should be 0, regardless of the noise feature (∈+x t,n ) changes, the impact of the re-weighted judgment on the result label is

[0128] ∮(∈+x t,n )*0=0. Therefore, in this embodiment, each flow characteristic x is sequentiallyt,i All features are considered as treatment variables, and all features are causally re-weighted through causal intervention to improve the stability of the detection system.

[0129] like Figure 8 As shown, in step S1 of this embodiment, the samples after feature screening are subjected to noise addition and denoising so that the features of the samples are independent of each other, the probability distribution remains unchanged, and there is no noise feature, and a model model (∈ 2 )include:

[0130] S301, obtain the sample X={A,A} label A and its feature vector F={F 1 ,F 2 ,…,F p}, where F 1 ~F p Initialize loop variable i for p features in feature vector F;

[0131] S302, judging whether the features of the sample X after feature screening are independent of each other according to the following formula:

[0132] F 1 ⊥F 2 ⊥…⊥F p ,

[0133] In the above formula, “⊥” means mutual independence, which means that the correlation coefficient of the features is less than the preset threshold; if it is established, the noise of sample X is determined to be 2 If it is 0, jump to step S305; otherwise, jump to step S303;

[0134] S303, keeping the label A unchanged, adding noise to the feature vector F of each sample X according to the following formula:

[0135] F→F+ε i ,

[0136] In the above formula, F represents the feature vector, “→” represents the noise adding process, ε i is the i-th noise;

[0137] S304, determining whether the noise sample obtained by adding noise satisfies the following formula and whether the features are not independent of each other:

[0138] P(A|F)≠P(A|(F+∑ε i )),

[0139] In the above formula, P(A|F) is the probability distribution of label A with respect to feature vector F, P(A|(F+∑ε i)) is the feature vector F+∑ε after label A adds noise to feature vector F i The probability distribution of sample X is determined if the noise ∈ 2 =∑ε i , jump to step S305;

[0140] S305, each sample X and the noise ∈ that makes the features of sample X independent of each other, the probability distribution remains unchanged and has no noise features 2 To train the machine learning model, so as to learn the model model (∈ 2 );

[0141] S306, using the model model(∈ 2 ) is the sample X prediction noise ∈ 2 , and subtract the noise ∈ from the feature vector F of sample X 2 , jump to step S302.

[0142] like Fig. 9 As shown in the figure, in step S2, the noise-added samples obtained by adding noise to the samples after feature screening are added to the feature weight G and the model model (∈ 2 ) under the guidance of generating minority class samples includes: randomly generating a noise sample X noise ={A noise ,F noise}, the noise sample X noise Tag A noise It is a minority attack in network attacks. The attack types of network attacks are divided into frequent attacks and minority attacks according to their frequency of occurrence. The noise sample X noise The eigenvector F noise The dimension is the same as the feature dimension of sample X, through the model model(∈ 2 ) adds noise ∈ to the noise sample 2 Then use the feature weight G to perform feature screening, so as to obtain a 2 ). On this basis, the generated minority class samples are then compared with samples with independent features, unchanged probability distribution and no noise features (adding noise ∈ 1 The samples X) are merged to obtain balanced samples, and the balanced samples are used to train the detector.

[0143] As an optional implementation, the detector in step S2 of this embodiment is an autoencoder shown in the following formula:

[0144]

[0145] In the above formula, is the output of the autoencoder, σ is the activation function, φ(X i ) is the sample X i The result obtained by inputting the encoder function, W AE is a weight parameter, β is a bias parameter; and the loss function used by the autoencoder during training is:

[0146]

[0147] In the above formula, L pre is the loss function, Min is the minimum value, n is the number of training samples, W i is the noise∈ 1 The weight given to the i-th sample, Y i is the label of the i-th sample.

[0148] In addition, in step S2 of this embodiment, the original network attack detection data is processed by the feature weight G and the model model (∈ 1 ) is used to generate independent detection samples with noise, including: the original network attack detection data is used to generate independent detection samples with noise, including: 1 ) generates noise∈ 1 , add noise ∈ 1 The feature weight G is then used to perform feature screening, thereby generating detection samples with independent features for input into the detector. The feature screening using the feature weight G can be seen in step S202, including eliminating features with a feature weight G of 0 and selecting the remaining features with a feature weight G not being 0.

[0149] In order to verify the causal diffusion model detection method for network anomalies in this embodiment, the experiment in this embodiment uses three widely used data sets CICIDS2019, MalMem and NSL_KDD in the field of IOT anomaly detection as benchmark data sets, among which CICIDS2019 extracts more than 80 features from the traffic based on timestamps, source and target IPs, source and target ports, protocols and attack tag flows according to the characteristics of DDoS attacks, providing a new classification method for DDoS attacks. The MalMem data set simulates the real network environment training and detection of fuzzy malware by using malware that is prevalent in today's network systems, and includes three types of attacks: Ransomware, Spyware and Trojan. The NSL_KDD data set overcomes the classifier's preference for repeated records, and is more suitable for the study of network attack detection systems than data sets such as KDD99. In order to use various algorithms more effectively, this experiment uses python to implement SCM-based network attack detection, and the hardware and software specifications used are shown in Table 1.

[0150] Table 1. Hardware and software specifications

[0151]

[0152] In this embodiment, the network anomaly labels Benign:DrDoS_DNS(DNS):DrDoS_LDAP(LDAP):DrDoS_MSSQ(MSSQ):DrDoS_NetBIOS(NetBIOS):DrDoS_NTP(NTP):DrDoS_SNMP(SNMP):DrDoS_SSDP(SSDP):DrDoS_UDP(UDP):Syn:TFTP:UDP-lag(lag) in the CICIDS2019 dataset are 56863:4631:23333:13636:13636:15565:13636:13636:673:579:13636:13636. The network anomaly labels Benign:Ransomware:Spyware:Trojan in MalMem are 30897:10023:9578:9578. The abnormal labels of each network in NSL_KDD Ipsweep:Neptune:Nmap:Normal:Portsweep:Satan Smurf:Teardrop are 3599:41214:1493:67342:2931:3633:2646:892.

[0153] The CICIDS2019, MalMem, and NSL_KDD datasets are trained to learn a sample weight that makes the features independent of each other, and then the Pearson correlation of each dataset before and after the sample weight learning is compared. The results are as follows: Fig.10 , Fig.11 and Fig.12 As shown in , (a) is the Pearson correlation before decoupling, and (b) is the Pearson correlation after decoupling. Figure 10-12 As shown in (a) in the figure, before learning the sample weights, there is a large correlation between the features of each data set. For example, in the CICIDS2019 data set, there is a large correlation between the 1st-20th dimension and the 28th-46th dimension features; in MalMem, except for the 28th dimension, there is a large correlation between the other features; in NSL_KDD, there is a certain correlation between the 15th-35th dimensions. These correlations are likely to confuse the correspondence between network attack labels and causal features (such as the A→B causal relationship, the correlation between the B→C features, resulting in a false association of A→C), resulting in poor robustness and stability of the detection model. After the causal diffusion model is used to add noise to make the features independent (Independent Features, IFs), as shown in Figure 10-12 As shown in (b), the correlation between the features in the three major datasets has been greatly improved, especially the MalMem dataset has eliminated the most false correlations.

[0154] In order to verify the sample weighting (SW) of applying the causal sample weight W, that is, using the model model (∈ 1 ) generates noise∈ 1 The detection accuracy of detection models such as KNN (K-nearest neighbor), Xgboost (gradient boosting tree), SVM (support vector machine), CNN (convolutional neural network), LSTM (long short-term memory network), RNN (recurrent neural network), and RL (reinforcement learning) on ​​the three major data sets CICIDS2019, MalMem, and NSL_KDD with or without the application of feature weight G is compared. The results are as follows: Fig.13 As shown in the figure, CICIDS2019old, MalMem old and NSL_KDD old are the detection accuracies without applying the feature weight G, and CICIDS2019SW, MalMem SW and NSL_KDD SW are the detection accuracies after applying the feature weight. Fig.13 It can be seen that after making the features independent through weight learning, the detection accuracy of the three data sets is greater than or equal to the accuracy before weight learning. In particular, in the MalMem data set, the average improvement is 2.5%, which also verifies Fig.11The MalMem dataset shown in (b) in Figure 1 has the most feature correlations eliminated. Only in the NSL_KDD dataset did the CNN and LSTM methods show no improvement, which is also consistent with the Fig.12 The feature correlation shown in (a) is consistent with that in the original NSL_KDD dataset, because the correlation of each feature in the original NSL_KDD dataset is also the weakest among the three datasets, so its improvement is also the least. Fig.13 Experiments have shown that the sample weighting (SW) of the causal diffusion model can indeed interrupt the connection between features, reduce the impact of false associations on the detection model, and thus improve its detection performance.

[0155] In order to verify the role of sample weighting (SW) and feature selection based on causal effects FSBCE in eliminating false correlations and noise features, this part of the experiment is conducted on Fig.13 Based on the experiments, the KNN and other detection models were analyzed on three major data sets as shown in Table 2 and Fig.14 The experiment shown. Fig.14 In the figure, CICIDS2019length represents the feature length of the CICIDS2019 dataset after screening, MalMem length represents the feature length of the MalMem dataset after screening, NSLKDD length represents the feature length of the NSLKDD dataset after screening, CICIDS2019SW+FSBCE means that the CICIDS2019 dataset uses SW weighting to make the features independent and then applies causal feature weights for feature screening, MalMem SW+FSBCE means that the MalMem dataset uses SW weighting to make the features independent and then applies causal feature weights for feature screening, and NSLKDD SW+FSBCE means that the NSLKDD dataset uses SW weighting to make the features independent and then applies causal feature weights for feature screening.

[0156] Table 2. Feature dimensions after sample weighting and FSBCE processing

[0157]

[0158] Among them, FSBCE directly screens causal features from the original data (∈=0), and SW+FSBCE screens causal features through FSBCE after sample weighting (∈≠0). As can be seen from Table 2, after sample weighting makes the features independent to eliminate false correlations, the mutual interference between features can be eliminated, and the causal effect of each feature can be calculated more effectively through FSBCE. Therefore, the feature dimension reduction of SW+FSBCE of the three major data sets is greater than that of FSBCE. Especially in the CICIDS2019 data set, the reduction is as high as 53%. Fig.14 It can be seen that compared with FSBCE, SW+FSBCE Fig.13The original data without data processing has been improved to a certain extent. At the same time, the method after feature weighting and then FSBCE has higher detection accuracy than the method of only FSBCE feature screening. It can be seen that after sample weighting and then causal feature screening, it can not only effectively eliminate false correlations to eliminate mutual interference between features to effectively calculate the causal effect between each feature and label to screen features, but also improve the detection accuracy of the detection model. At the same time, through the analysis of the causal correlation relationship between causal features and labels, a certain causal explainability can be provided for network anomaly detection. In order to verify that SW+FSBCE does remove noise features and retain causal features, such as Fig.15 As shown, CICIDS2019F1 represents the F1 score on the CICIDS2019 dataset, MalMemF1 represents the F1 score on the MalMem dataset, and NSL_KDD F1 represents the F1 score on the NSL_KDD dataset. The RF detection method without feature selection, GWO+RF and causal intervention (CIT)+RF with feature screening, as well as PCA+RF, Simplene+RF, Transformer+RF, CNN+RF and SW+FSBCE+RF in this embodiment are compared on the three major datasets. Fig.15 It is known that in the three major datasets, compared with RF without dimensionality reduction or feature screening, except for Transfomer in CICIDS2019 and GWO in MalMem, the detection accuracy (F1) of other methods such as ECSO, CIT, PCA, Simplenet and CNN has shown a downward trend in F1 scores after feature dimensionality reduction in the three major datasets. However, SW+FSBCE has the highest F1 score on the three major datasets, and its F1 improvement is larger than that of RF without feature screening. Compared with the best methods in the past, FSBCE has an F1 score improvement of >1.2% in CICIDS2019, >5.9% in MalMem, and >1.4% in NSL-KDD.

[0159] In order to verify the detection balance of the causal diffusion model, Fig.16 , Fig.17 and Fig.18 As shown in the figure, this part of the experiment compares and analyzes the performance of DCGAN, WGAN, CWGAN, Intelligent attack detection based on DNA computing (ADDC), Transformer, GMGWO, BRS, DD-GCN and the method of this embodiment (CDM) on the three major datasets CICIDS2019, MalMem and NSL_KDD. Fig.16As shown in Figure 2, CDM maintains the best overall accuracy in the CICIDS2019 dataset. Fig.15 The SW+FSBCE of the CNN is improved, and the detection accuracy of DNS, UD, Syn and lag with a small number of samples is maintained at a high level (all > 85%). However, algorithms such as DCGAN cannot effectively detect UDP attacks. Fig.17 As shown in the figure, although the attack types in the MalMem dataset are relatively few and balanced (the number of four attacks is 30:10:9:9), the existing algorithms such as DCGAN have low accuracy in Spyware and Trojan detection, all below 80%. However, the method in this embodiment (CDM) maintains the best overall accuracy and has a detection accuracy of >90% for Spyware and Trojan. Fig.18 As shown in the figure, in NSL_KDD, except for ADDC, DD-GCN and CDM, the detection accuracy of one or more attack types is lower than 60%, but the method in this embodiment (CDM) is the best among the three in terms of overall accuracy and detection accuracy of each attack type. Figure 13-18 The analysis shows that the balanced samples generated by the causal diffusion model can not only effectively learn the distribution of causal features to eliminate the interference of noise features and improve the effective detection of minority samples, but also eliminate false associations to improve the overall accuracy of the detection model.

[0160] In order to compare the adversarial performance of the method proposed in this embodiment with other classical machine learning methods, this part of the experiment adds random noise to all data sets starting from the first feature according to the following formula:

[0161] X ij ′=X ij * + random.normal(0,σ),

[0162] In the above formula, X ij ′ and X ij * are the added random noise and original features respectively. random.normal(0,1) is a random noise that obeys the standard normal distribution with mean 0 and variance σ.

[0163] This experiment verifies and compares the adversarial performance of the method in this embodiment (CDM) and other existing methods, including IDWCDL, LR, RNN, Conditional Variational Autoencoder, CVAE, CNN, KNN, DCT, RF, SVM and other 10 methods in three datasets: CICIDS2019, MalMem and NSL-KDD. The indicators are the average, minimum F1 score and comprehensive indicator StbErr , among which the comprehensive index Stb Err The calculation function expression is:

[0164]

[0165] In the above formula, p represents the dimension of the feature, F1 j It represents the total j-dimensional feature contaminated detection F1 score, F1 Mean It represents the average detection F1 score after randomly adding noise to the 1- to p-dimensional traffic features. Table 3 shows the average, minimum F1 score and comprehensive index Stb of the 10 methods when σ = 1. Err The experimental results.

[0166] Table 3 Average F1 scores and variances of different methods in different datasets

[0167]

[0168] As can be seen from Table 3, some existing detection methods cannot eliminate the negative impact of false associations and noise information on the detection model during the training process, resulting in a sharp drop in detection accuracy after the detection samples are noisy. For example, the DCT method is as high as 100% when there is no feature pollution in CICDDoS2019, but when the number of noisy features is large, its detection accuracy is <51%, a drop of up to 49%. At the same time, the migration performance of traditional machine learning methods is also poor. For example, KNN, CNN and DCT, etc., have high detection accuracy when the features are noise-free in the CICIDS2019 dataset, but when they are switched to the NSL_KDD dataset, their detection accuracy is <60%, especially when the features are noisy, the detection accuracy drops sharply. The method (CDM) and CDL of this embodiment delete the noise features through causal reasoning and other methods. Although the detection accuracy of the method (CDM) and CDL of this embodiment is not the highest in the training set of pollution-free features, when the features are contaminated by noise, their detection accuracy basically maintains the highest level. Therefore, these two types of methods basically maintain a smooth downward curve in the three datasets, with little fluctuation. However, since CDL has not gone through the step of feature independence, the influence of false associations on the detection model has not been completely eliminated, resulting in its detection adversarial and migration properties being significantly weaker than the method (CDM) of this embodiment. For example, in the MalMem data set, the stability performance of the method (CDM) of this embodiment is twice that of CDL, and other performances are the highest among all methods. In summary, the adversarial performance of traditional machine learning and other methods is poor and does not have good migration performance. This is because the data set contains a large amount of false associations and noise information, which confuses the correspondence between network attacks and causal features, resulting in the detection results in training being determined by false associations and noise information. The false associations and noise information in different environments and devices are different, which leads to the instability of the detection results, making the detection model not mobile and adversarial. However, after removing the false associations and noise information through causal reasoning, it is ensured that the result labels are detected through causal features during model training, which greatly enhances the migration and adversarial performance of the detection model.

[0169] In order to verify the adversarial and stability performance of the experiments in Table 3 in the actual deployment environment, this part of the experiment deploys the 10 methods in Table 3 on smart door locks, smart cars, smart refrigerators and laptops to compare with Kaspersky's detection results. The results are as follows Fig.19 As shown. Fig.19It can be seen that the detection accuracy of the method (CDM) in this embodiment is the highest in the actual deployment environment, and even exceeds the detection rate of software such as Ahnlab and avast on laptops. The detection accuracy of machine learning and deep learning methods based on association reasoning is unstable. For example, the detection accuracy of LR on laptops is >97%, while the detection accuracy on smart cars is <90%. It can be seen that the causal diffusion model can remove the negative effects of false associations and noise information, can effectively learn the causal feature distribution of samples, and experiment with stable detection of different IOT devices, with good migration and stability.

[0170] The results of the causal interpretability analysis of the causal diffusion model in this embodiment are shown in Tables 4 to 6.

[0171] Table 4. Causal effects between attack types and features in the CICIDS2019 dataset

[0172] Label Benign DNS LDAP MSSQ NetBIOS NTP SNMP SSDP Total Fwd Packets 0.99 0.00 0.11 0.00 0.00 0.00 0.33 0.26 Total Backward Packets 0.99 0.00 0.00 0.00 0.00 0.00 0.41 0.52 Fwd Packet Length Std 0.99 0.00 0.00 0.00 0.08 0.02 0.40 0.35 Bwd Packet Length Max 0.99 0.13 0.37 0.10 0.01 0.13 0.52 0.71 Bwd Packet Length Min 0.99 0.00 0.00 0.00 0.00 0.00 0.07 0.00 Bwd Packet Length Mean 0.99 0.25 0.00 0.00 0.04 0.15 0.15 0.00 Bwd Packet Length Std 0.99 0.00 0.00 0.00 0.02 0.07 0.05 0.07 Fwd Header Length 0.99 0.24 0.00 0.13 0.22 0.01 0.11 0.21 Bwd Header Length 0.96 0.24 0.09 0.06 0.27 0.14 0.12 0.00 Fwd Packets / s 0.95 0.24 0.32 0.07 0.05 0.20 0.11 0.11 Bwd Packets / s 0.97 0.24 0.31 0.16 0.06 0.10 0.19 0.10 Min Packet Length 0.99 0.00 0.00 0.00 0.05 0.06 0.04 0.75 Max Packet Length 0.95 0.00 0.00 0.07 0.11 0.07 0.11 0.10 Packet Length Mean 0.97 0.00 0.01 0.00 0.10 0.14 0.03 0.00 Packet Length Std 0.99 0.00 0.10 0.00 0.05 0.05 0.04 0.00 SYN Flag Count 0.98 0.00 0.00 0.07 0.08 0.07 0.00 0.09 PSH Flag Count 0.99 0.00 0.00 0.04 0.01 0.01 0.00 0.00 ACK Flag Count 0.99 0.00 0.00 0.08 0.01 0.04 0.00 0.00 URG Flag Count 0.99 0.00 0.00 0.00 0.09 0.01 0.00 0.00 ECE Flag Count 0.99 0.00 0.00 0.00 0.09 0.00 0.00 0.00 Down / Up Ratio 0.99 0.00 0.00 0.26 0.38 0.00 0.11 0.00

[0173] Table 4 is a correspondence table of causal effect values ​​between 12 categories of labels and 21-dimensional causal features of the CICIDS2019 dataset. In Table 4, although there are 12 categories of labels, the causal effects between different result labels and features are quite different, which can explain the detection results well. For example, when all causal feature values ​​are "abnormal", the detection result can be explained as Benign based on the fact that all features have a very strong causal relationship with Benign. When only the Bwd Packet Length Max and Bwd Header Length values ​​are abnormal, it can explain why the detection result is TFTP. Because the causal relationship between different result labels and causal features is relatively clear, CICIDS2019 has a detection accuracy of more than 98% under both the method of this embodiment (CDM) and CDL.

[0174] Table 5. Causal effects between attack types and features in the MalMem dataset

[0175]

[0176]

[0177] Table 5 shows the causal effect values ​​between the four types of labels and the 21-dimensional causal features of MalMem. From Table 5, we can see that there is a certain causal relationship between the four types of labels and the 21-dimensional features, which is also the reason for Figures 9 to 15The reason why the detection accuracy of CDL and CDM is difficult to exceed 90%. However, the subtle differences in the causal effects between the features and different labels can also be used to identify the causes of different detection results and make them explainable. For example, handles.nfile, handles.avg_handles_per_proc, handles.nevent and handles.ndesktop corresponding to Benign are obviously different from the other three labels.

[0178] Table 6. Causal effects between attack types and features in the NSL_KDD dataset

[0179] Label normal neptune ipsweep portsweep teardrop nmap satan smurf Duration 0.64 0.00 0.00 0.20 0.21 0.42 0.37 0.26 Src Bytes 0.69 0.00 0.00 0.00 0.00 0.22 0.00 0.14 Wrong Fragment 0.72 0.00 0.37 0.00 0.00 0.27 0.00 0.28 Number of Failed Logins 0.97 0.00 0.47 0.00 0.00 0.48 0.00 0.61 Logged In 0.50 0.03 0.00 0.21 0.12 0.13 0.13 0.00 Num Compromised 0.46 0.52 0.00 0.80 0.60 0.72 0.52 0.00 Hot 0.59 0.05 0.00 0.32 0.23 0.18 0.14 0.00 Num Shells 0.31 0.37 0.00 0.60 0.49 0.44 0.44 0.00 Srv Count 0.25 0.50 0.00 0.57 0.54 0.66 0.66 0.00 Srv Serror Rate 0.31 0.48 0.05 0.61 0.55 0.77 0.74 0.54 Dst Host Count 0.24 0.24 0.05 0.48 0.37 0.31 0.33 0.37 Dst Host Srv Count 0.03 0.12 0.00 0.41 0.14 0.16 0.40 0.00 Num File Creations 0.38 0.09 0.00 0.24 0.27 0.18 0.21 0.00 Dst Host Srv Rate 0.18 0.14 0.32 0.35 0.23 0.29 0.00 0.00 Class 0.17 0.25 0.31 0.52 0.31 0.32 0.00 0.27 Difficulty Level 0.03 0.01 0.00 0.25 0.42 0.20 0.00 0.14

[0180] Table 6 shows the causal effect values ​​between the 8-category labels of NSL_KDD and the 16-dimensional causal features. From Table 6, we can see that the causal effects of neptune, ipsweep, satan, and smurf on the 16-dimensional features are quite different, so the corresponding Fig.14 The detection results of the above labels are all 100% detection rate, but the causal effect values ​​of other attack labels such as teardrop and portsweep have certain similarities, so their detection rates are the lowest among all labels.

[0181] As shown in Tables 4 to 6, in this embodiment, after the causal diffusion model is noised, the causal effect weights between each label and each feature are calculated through the causal effect, and all causal effects are normalized to a size of 0 to 1. The larger the weight, the stronger the causal effect between the label and the feature, and vice versa. If it is lower than a preset threshold, the feature can be considered as a noise feature. Therefore, the causal effect value between the label and different features can be used to explain why the label value A=a is given when such a feature value combination F=f appears, so that the detection result has causal interpretability. It can be seen that the method (CDM) of this embodiment can not only improve the accuracy of the detection method by assigning feature weights through causal effects, but also analyze why some attack types have high detection accuracy and some have low detection accuracy based on the causal effects between different attack types and different features. For a certain feature, if its causal effect with a certain type of attack is obviously different from other attack types, it can be quickly causally attributed to it according to the abnormal situation of the feature, providing a certain causal interpretability for the abnormal detection result.

[0182] In summary, in the actual IOT interconnection scenario, due to the different configuration scenarios and devices, the distribution of training samples and test samples is inconsistent, and these samples contain a large amount of false associations and noise information, which leads to confusion in the correspondence between labels and features such as network attacks, affecting the stability and mobility of the model. At the same time, due to the difficulty of labeling samples in IOT, rare samples for training cannot be effectively detected. Due to the low tolerance of IOT security, even if the detection accuracy is extremely high, it faces thousands of network attacks. As long as there are a few attacks, the network may be paralyzed. In order to solve these problems, the causal diffusion model detection method for network anomalies in this embodiment proposes to solve these problems through a causal diffusion model. Experiments have proved that the causal diffusion model can enhance the independence between features and solve the problem of false associations, especially in the MalMem data set, the average accuracy is improved by >2.5%. Secondly, the causal relationship between features and result labels can be effectively removed by learning the causal effect, which can effectively remove noise features, reduce feature dimensions and improve detection accuracy. For example, in the CICIDS2019 data set, the feature reduction is as high as 53%, and the detection accuracy is improved by >1.5%. At the same time, the causal diffusion model is used to generate rare samples for training, which can effectively improve the detection rate of the detection model for rare samples. For example, in the NSL_KDD sample, rare attack types such as DNS and UD can be effectively detected. Finally, through noise addition and actual environment deployment verification, the causal diffusion model has good adversarial and migration properties, and maintains the highest detection rate and stability in all data sets and environments.

[0183] In addition, this embodiment also provides a causal diffusion model detection system for network anomalies, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the causal diffusion model detection method for network anomalies.

[0184] In addition, this embodiment also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the causal diffusion model detection method for network anomalies through a processor.

[0185] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the causal diffusion model detection method for network anomalies through a processor.

[0186] Those skilled in the art will appreciate that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0187] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A causal diffusion model detection method for network anomalies, characterized in that: The steps include: S1, execute the causal generative diffusion process of sample training, including: adding noise to the samples in the original training data through the causal generative diffusion model so that the features of the samples are independent of each other and the probability distribution remains unchanged, and learning a model model (∈1) that predicts the noise so that the features are independent of each other and the probability distribution remains unchanged; learning the feature weights G of the causal effects between samples through the potential result model training of the independent features and performing feature screening; adding noise and denoising the samples after feature screening so that the features of the samples are independent of each other, the probability distribution remains unchanged and there is no noise feature, and learning a model model (∈2) that predicts the noise so that the features of the samples are independent of each other, the probability distribution remains unchanged and there is no noise feature; S2, executing the balanced sample generation process, including: generating minority class samples by adding noise to the samples after feature screening under the guidance of feature weight G and model model(∈2), and then merging the samples with independent features, unchanged probability distribution and noise-free features to obtain balanced samples, and using the balanced samples to train the detector; S3, executes the causal diffusion process of the detection sample, including: generating detection samples with independent features through noise addition under the guidance of feature weight G and model model(∈1) for the original network attack detection data, and inputting the samples into the detector to obtain the network attack detection results.

2. The causal diffusion model detection method for network anomalies according to claim 1 is characterized in that: In step S1, the samples in the original training data are denoised by the causal generative diffusion model so that the features of the samples are independent of each other and the probability distribution remains unchanged, and the model model (∈1) that predicts the noise so that the features are independent of each other and the probability distribution remains unchanged is learned, including: S101, obtain the sample X={A,F} label A and its feature vector F={F1,F2,…,F p }, where F1~F p Initialize loop variable i for p features in feature vector F; S102, keep the label A unchanged, and add noise to the feature vector F of each sample X according to the following formula: F→F+e i , In the above formula, F represents the feature vector, "→" represents the noise adding process, ε i is the i-th noise; S103, adjust the i-th noise ε i This makes the following probability distribution remain unchanged: P(A|F)=P(A|(F+∑ε i )), In the above formula, P(A|F) is the probability distribution of label A with respect to feature vector F, P(A|(F+∑ε i )) is the feature vector F+∑ε after label A adds noise to feature vector F i The probability distribution of S104, judging whether the features of sample X are independent of each other according to the following formula: (F1+∑ε i )⊥(F2+∑ε i )⊥…⊥(F p +∑ε i ), In the above formula, "⊥" means mutual independence, and the mutual independence means that the correlation coefficient of the features is less than the preset threshold; if the above formula is established, a sample X and a noise ∈1=∑ε that makes the features of sample X independent and the probability distribution remain unchanged are obtained. i ; S105, train the machine learning model with each sample X and the noise ∩1 that makes the features of the sample X independent of each other and the probability distribution remains unchanged, so as to learn the model model (∈1) with the prediction noise that makes the features independent of each other and the probability distribution remains unchanged.

3. The causal diffusion model detection method for network anomalies according to claim 1 is characterized in that: In step S1, the independent features are trained and learned through the potential result model to obtain the feature weight G of the causal effect between samples and perform feature screening, including: S201, the independent features are trained and learned through the potential result model to obtain the causal effect between samples and the effect value of the causal effect of each feature is calculated as the feature weight G according to the following formula, and its function expression is shown in the following formula: In the above formula, the feature weight G is a 1×p-dimensional vector, p is the number of features of sample X, E is the expected value, g is the diagonal matrix composed of the elements in the causal weight G, ∩ is the noise of independent features, ∩+x t,i and ∩+x t,I-i is a noise feature with label A and no causal effect, x t,i represents the i-th feature of sample X, x t,I-i represents the Ii-th feature of sample X, I represents all features of sample X, (∈+x t,i ) 0 Indicates that except for the i-th feature which is set to normal by intervention, the values ​​of other features remain unchanged, (∈+x t,I-i ) 0 It means that except for the value of the i-th feature which remains unchanged, the other features are set to normal by intervention; S202, eliminating features whose feature weight G is 0, and selecting remaining features whose feature weight G is not 0.

4. The causal diffusion model detection method for network anomalies according to claim 1 is characterized in that: In step S1, the samples after feature screening are subjected to noise addition and denoising so that the features of the samples are independent of each other, the probability distribution remains unchanged and there is no noise feature, and the model model (∈2) that predicts the noise so that the features of the samples are independent of each other, the probability distribution remains unchanged and there is no noise feature is learned, including: S301, obtain the sample X={A,F} label A and its feature vector F={F1,F2,…,F p }, where F1~F p Initialize loop variable i for p features in feature vector F; S302, judging whether the features of the sample X after feature screening are independent of each other according to the following formula: F1⊥F2⊥…⊥F p , In the above formula, "⊥" indicates mutual independence, and the mutual independence means that the correlation coefficient of the features is less than a preset threshold; if it is established, it is determined that the noise ∈2 of the sample X is 0, and the process jumps to step S305; otherwise, the process jumps to step S303; S303, keeping the label A unchanged, adding noise to the feature vector F of each sample X according to the following formula: F→F+e i , In the above formula, F represents the feature vector, "→" represents the noise adding process, ε i is the i-th noise; S304, determining whether the noise sample obtained by adding noise satisfies the following formula and whether the features are not independent of each other: P(A|F)≠P(A|(F+∑ε i )), In the above formula, P(A|F) is the probability distribution of label A with respect to feature vector F, P(A|(F+∑ε i )) is the feature vector F+∑ε after label A adds noise to feature vector F i The probability distribution of sample X is determined if the noise ∈ a =∑ε i , jump to step S305; S305, training the machine learning model with each sample X and the noise ∈2 that makes the features of the sample X independent of each other, the probability distribution remains unchanged, and has no noise features, so as to learn and obtain the model model (∈2) that predicts the noise so that the features of the samples are independent of each other, the probability distribution remains unchanged, and has no noise features; S306, using the model model(∈2) to predict the noise ∈2 for the sample X, and subtracting the noise ∈2 from the feature vector F of the sample X, and jumping to step S302.

5. The causal diffusion model detection method for network anomalies according to claim 1 is characterized in that: In step S2, the noise-added sample obtained by adding noise to the sample after feature screening generates minority class samples under the guidance of feature weight G and model model(∈2), including: randomly generating a noise sample X noise ={A noise ,F noise }, the noise sample X noise Tag A noise It is a minority attack in network attacks. The attack types of network attacks are divided into frequent attacks and minority attacks according to their frequency of occurrence. The noise sample X noise The eigenvector F noise The dimension of is the same as the dimension of the feature of sample X. Noise ∈2 is added to the noise sample through the model model(∈2) and then the feature weight G is used for feature screening, so as to obtain a minority class sample generated under the guidance of the feature weight G and the model model(∈2).

6. The causal diffusion model detection method for network anomalies according to claim 1 is characterized in that: The detector in step S2 is an autoencoder as shown below: In the above formula, is the output of the autoencoder, σ is the activation function, φ(X i ) is the sample X i The result obtained by inputting the encoder function, W AE is a weight parameter, β is a bias parameter; and the loss function used by the autoencoder during training is: In the above formula, L pre is the loss function, Min is the minimum value, n is the number of training samples, W i is the weight given to the i-th sample in the noise ∈ 1, Y i is the label of the i-th sample.

7. The causal diffusion model detection method for network anomalies according to claim 1 is characterized in that: In step S2, the original network attack detection data is denoised under the guidance of the feature weight G and the model model(∈1) to generate detection samples with independent features, including: the original network attack detection data is subjected to noise ∈1 by using the model model(∈1), the feature vector F in the original network attack detection data is subjected to noise ∈1 and then feature screening is performed using the feature weight G, thereby generating detection samples with independent features for input into the detector.

8. A causal diffusion model detection system for network anomalies, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the causal diffusion model detection method for network anomalies as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the causal diffusion model detection method for network anomalies described in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the causal diffusion model detection method for network anomalies described in any one of claims 1 to 7 through a processor.

Images