Data link network flow generation method based on generative adversarial network

Abstract

The invention discloses a data link network flow generation method based on a generative adversarial network, and belongs to the technical field of data link networks. According to the method, the GAI model can be utilized to learn the distribution and behavior characteristics of the historical traffic data, and the comprehensive traffic conforming to the real network characteristics is generated. The framework supports infinite traffic generation without the need to deploy real network services. According to the method, an improved IP2Vece + CGAN network model is used for generating data link network flow, an embedding-based method is introduced, and a continuous vector is used for representing a flow quintuple in the method. The invention provides an integrated network flow generation model based on a CGAN (Common Gateway Access Network). The CGAN model is trained by using the vector representation of the flow quintuple, the statistical characteristics of the network flow and the flow type. And after the flow is generated, the flow is converted from the generation state to the original space, and is further used for describing network behaviors between Internet of Things equipment or users.

Description

Technical Field

[0001] The present invention belongs to the technical field of data link networks, and in particular relates to a method for generating data link network traffic based on a generative adversarial network. Background Art

[0002] Tactical Data Link (TDL) is a wireless communication system used for communication. It allows information and data to be shared between different platforms (such as aircraft, ships, land vehicles, etc.) to achieve fast and reliable information exchange in the environment. As a network system, data link has extremely high requirements for reliability. The development and testing of the entire system requires extensive and comprehensive evaluation to prove its reliability and ensure the effectiveness of application in the environment. In order to evaluate the connection, performance bottleneck and security of the network, real traffic must be injected into the network system. However, due to the sensitivity of real data, it is highly confidential before the system is proven to be reliable, which limits the progress of system development. Even if the incompletely developed system is approved for testing and use, organizing system testing requires the coordination of multiple devices and multiple regions, which requires a lot of manpower, material and financial resources. Summary of the invention

[0003] Aiming at the difficulty of testing in remote and diverse environments, this paper provides a comprehensive traffic analysis and performance evaluation. The framework includes an embedding-based model for representing network traffic attributes and a conditional generative adversarial network (CGAN) for generating traffic.

[0004] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme: a data link network traffic generation method based on a generative adversarial network, the overall step flow and input and output are as follows: Figure 1 As shown, the method comprises the following steps:

[0005] Step 1: Traffic data preparation;

[0006] Capture traffic data from the physical network. This data includes the five-tuple of network flows and statistical attributes of traffic. The five-tuple also records the labels of the captured traffic data. The five-tuple includes: source IP, destination IP, source port, destination port, and protocol.

[0007] Step 2: Extract context from the data, treat the five-tuple in the data as a whole and extract them in pairs to obtain extracted samples;

[0008] Step 3: Embed the extracted samples into the improved IP2Vec model, so that it can predict other elements (such as destination IP or port) based on one element in the traffic (such as source IP), capture the relationship between traffic attributes, and obtain an embedding vector;

[0009] Step 4: Build the conditional generative adversarial network (CGAN) architecture and train the CGAN model;

[0010] The conditional generative adversarial network (CGAN) consists of two parts: the generator (G) and the discriminator (D). The generator (G) network generates synthetic traffic from random noise and traffic type labels; the discriminator (D) network distinguishes the generated traffic from the real traffic. The overall model architecture is as follows: Figure 1 As shown in the figure; the CGAN model is trained using real traffic data with traffic type labels, including combining the embedding vector obtained in step 3 with the statistical properties of the traffic as training data; through adversarial training, the generator learns to generate traffic with specified characteristics, while the discriminator learns how to distinguish between real traffic and generated traffic;

[0011] Step 5: Use the trained generator network to generate synthetic traffic according to the specified traffic type labels; these synthetic traffics statistically mimic the distribution of real traffic; map the embedding attributes of the generated synthetic traffic back to the original five-tuple space, add it to the total training sample, and further use it for network behavior analysis; find the most similar vocabulary to map back to the corresponding field of the synthetic traffic by calculating the cosine similarity between the synthetic embedding attributes and all the embedding results stored in the training phase;

[0012] Furthermore, in step 3, the extracted vector obtained in step 2 is firstly one-hot encoded, and then input into the improved IP2Vec model; the improved IP2Vec model comprises: an input layer, a single hidden layer and an output layer, such as Figure 3 As shown in Figure 1. The neurons in the hidden layer are fully connected to the neurons in the input layer and the output layer. The input layer of the improved IP2Vec model is the target word to be predicted, and the output layer is the context word. The input layer and the output layer are connected through an s voc ×s emb and emb ×s voc The weight matrix is ​​connected to the hidden layer, where s voc Indicates the size of the vocabulary, s emb Represents the embedding dimension of the Word2Vec model; the output layer uses the Softmax function to indicate the probability that the input and output words appear in the same context. Figure 3It shows the state of the network model when two training samples (192.168.130.41, port 54981) and (192.168.130.41, TCP) are input. Given the target word 192.168.130.41, the context words are port 54981 and TCP. Figure 3 The neural network in is used Figure 2 The Skip-Gram structure is trained based on the training samples in . The goal of Skip-Gram is to train the network to predict the probability that a randomly selected word in the vocabulary is a neighboring word (i.e., context) of a given word. However, input / output neurons are not used in the classification task, and only the weights of the hidden layer are extracted as word vectors. Considering Figure 2 For the generated training samples, we set the window size to 2. The improvement of IP2Vec model training process specifically includes:

[0013] Step 3A: The One-Hot vector of w(t) represents the word-context pair that enters it. Given a word w, use Indicates that the embedding vector of x(t) is calculated as follows:

[0014]

[0015] Where V is the input word matrix, s emb is the size of the embedding space;

[0016] Step 3B: The score vector is derived from the output word matrix It is calculated by multiplying by v(t) and is expressed as

[0017]

[0018] Step 3C: Softmax is then used to calculate the probability; the predicted probability of the context word is expressed as:

[0019]

[0020] The one-hot representation vector of the context word is expressed as formula (4), which matches the predicted probability vector, s win The length of the context boundary;

[0021] y(ts win ),...,y(t-1),y(t+1),...y(t+s win )(4) Step 3D: Consider feature x in X with clusters c1 and c2 rea and X syn The distribution in is expressed as and represents the mean value of the ith cluster, represents the distribution score of the ith cluster; let D = [d ij ] is the ground distance matrix, where d ij express and The ground distance between them; assuming f ij yes and The purpose is to find the flow with the minimum total cost F = [f ij ];

[0022]

[0023] After obtaining the optimal flow, EMD is defined as the power consumption normalized by the total flow as follows:

[0024]

[0025] The probabilities of using the central word to predict the context words are independent of each other, and the conditional probability is shown in formula (7):

[0026]

[0027] Among them, AveEMD represents X real and X syn The average EMD of all features between them; the goal of the model is to minimize this probability:

[0028]

[0029] Where T is the length of the sentence, that is, the length of the five-tuple in this article; the probability of calculating the context word w(o) using the given central word w(c) is expressed as:

[0030]

[0031] Among them, v c is the word vector of the central word, i.e., the cth column vector of V; u o is the word vector of the context word, i.e., the o-th column vector of U. The computational cost of ▽logP(w(o)|w(c)) is proportional to the size of the vocabulary.

[0032] Furthermore, during the training, samples are selectively included in the training of the improved IP2Vec model; then:

[0033] The target logP(w(o)|w(c)) is replaced by:

[0034]

[0035] Then, for each target word w(c), the task is transformed and the context word w(o) is correlated with the target word w(c) from the noise distribution P using logistic regression. n The loss of the target word is calculated as the classification problem between the context word w(o) and the k negative samples.

[0036] The selection probability corresponding to the sample is:

[0037]

[0038] Among them, f(w) is the occurrence time of word w, P n (w) is the probability of choosing word w as a negative sample.

[0039] Furthermore, the input of the generator used in step 4 consists of two parts, the first of which is the prior noise p z (z), its role is to increase the diversity of generated samples; since the noise vector is randomly generated, each generated sample will be different, which enables the generator to produce diverse outputs; the second part is the application type of traffic, which is used to mark the data for input model training;

[0040] The generator G is a neural network that transforms the prior noise distribution p z (z) is mapped to the real traffic space G(z,θ g ), and learn a real The distribution on p g , the training goal of G is to minimize log(1-D(G(z))); the discriminator D is a neural network that outputs a value to measure the probability that the sample belongs to the real stream; the discriminator D and the generator G are trained simultaneously to minimize log(D(x)). The objective function of the training process of the generator and the discriminator is to minimize a maximum value, which is defined as follows:

[0041]

[0042] For the model training process, general GAN ​​models are trained using unlabeled data. Therefore, they can only generate random and unpredictable samples. The type of synthetic samples cannot be controlled or manipulated to mimic the traffic patterns of different applications in the data link network; therefore, Mirza et al.

[28] proposed CGAN, which is an extension of the GAN model that provides prior information c to both the generator and the discriminator.

[0043] The information c can be multimodal, such as the class information of the sample or the action information of the person in the image. Considering the dynamics in the squared loss training helps to achieve better performance. In this paper, c is defined as the application type of the traffic, such as drone traffic.

[0044] The generator network receives randomly generated noise vectors and labels of training samples and generates labeled samples; the training samples, the output of the generator, and their respective labels are input to the discriminator together; in addition to the noise z, CGAN also introduces conditional information to the generator network, which is combined in a joint hidden representation; this information is also input to the discriminator network together with the real X real ; By adding additional conditional information c, the objective function of CGAN is transformed into a two-person game with minimum and maximum conditional probability, expressed as:

[0045]

[0046] The discriminator not only determines whether the input sample is consistent with the real X real , and also judge whether the input sample meets the conditions restricted by c; the discriminator determines that the generated sample is true only when the label represented by c matches the sample; after training with c, the generator generates synthetic traffic with the specified label, corresponding to the application type specified in this paper. In addition to the additional auxiliary information, the training method of CGAN is the same as that of VGAN. The discriminator and the generator are trained alternately through a two-person game, and they reinforce each other until a Nash equilibrium state is reached.

[0047] Furthermore, the specific method of step 5 is:

[0048] After the CGAN model generates the synthetic embedding attributes, they need to be transformed back to the original space, i.e., the stream quintuple; the nearest neighbors of the synthetic embedding attributes are selected in the existing embedding space; to achieve this, all embeddings of the vocabulary are first calculated using the well-trained improved IP2Vec model; all correspondences between the vocabulary and the embeddings are stored for further search; after generating the synthetic stream, the embedding of the stream quintuple is extracted.

[0049] Each one is used to calculate the cosine similarity between it and all previously stored embedding results. The words with the largest cosine similarity between the trained embedding and the generated synthetic embedding are mapped to the corresponding fields of the synthetic flow. Then the flow quintuple is converted back to the address space instead of the embedding space; the generated traffic can be further utilized in various downstream tasks of the data link network; the cosine similarity is calculated as follows:

[0050]

[0051] Data links have extremely high requirements for reliability. The development and testing of the entire system requires extensive and comprehensive evaluation to prove its reliability and ensure the effectiveness of practical applications. To evaluate the connection, performance bottleneck and security of the network, real traffic must be injected into the network system. However, due to the sensitivity of real data, it is highly confidential before the system is proven to be reliable, which limits the progress of system development. The present invention introduces GAI technology to provide an innovative method for testing and evaluating TDL, which improves the efficiency and accuracy of testing while reducing costs. GAI technology can generate traffic patterns similar to the real environment, including normal operations and potential attack behaviors, making the test closer to the actual application scenario and improving the reliability and accuracy of the test results. Through the diversified traffic generated by GAI, the data link can be fully stressed and loaded to ensure that the performance of the system under various conditions can be verified. GAI technology allows accurate measurement of the delay and throughput of the data link, which is crucial for evaluating the performance of the system. In addition, the attack traffic pattern generated by GAI can be used to train IDS and anomaly detection systems, thereby improving the security of the data link. Compared with traditional testing methods, GAI technology can reduce the demand for actual equipment and resources and significantly reduce testing costs. GAI technology can simulate a large number of devices, adapt to different network conditions, and perform customized tests, providing great flexibility and scalability. The present invention also helps to test new technologies and disaster recovery solutions, ensuring the robustness and efficiency of data link networks in the face of various challenges. In summary, the present invention not only improves the efficiency and effectiveness of data link testing through the application of GAI technology, but also enhances the security and reliability of the system, while reducing costs, bringing significant technological progress to the field of communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a schematic diagram of the overall process and data input and output of the method proposed in the present invention.

[0053] Figure 2 This is a schematic diagram of the composition of the training samples proposed in the present invention.

[0054] Figure 3 Schematic diagram of the neural network structure of the improved IP2Vec embedding proposed in the present invention.

[0055] Figure 4 Schematic diagram of the model structure of CGAN used in the present invention.

[0056] Figure 5 This is a schematic diagram of the average EMD between the synthetic flow generated by the model adopted in the specific embodiment of the present invention and the real flow.

[0057] Figure 6This is a visualization diagram of the t-SNE distribution of the model adopted in a specific embodiment of the present invention when the perplexity is 150.

[0058] Figure 7 This is a visualization diagram of the t-SNE distribution of the model adopted in a specific embodiment of the present invention when the perplexity is 175.

[0059] Figure 8 This is a visualization diagram of the t-SNE distribution of the model adopted in a specific embodiment of the present invention when the perplexity is 200.

[0060] Fig. 9 Schematic diagram of the statistical distribution of the average data packet size of the model generation traffic adopted in the specific embodiment of the present invention; (A) is image / VAE, (B) is image / VGAN, (C) is image / WGAN, and (D) is image / CGAN.

[0061] Fig.10 Schematic diagram of the statistical distribution of the IAT average value of the model generated traffic adopted in the specific embodiment of the present invention; (A) is voice / VAE, (B) is voice / VGAN, (C) is voice / WGAN, and (D) is voice / CGAN. DETAILED DESCRIPTION

[0062] Traffic generation technology based on Generative Artificial Intelligence (GAI) provides realistic and diverse traffic simulations to improve network performance, security, and management. It can accurately model data link network behavior, enable comprehensive stress and load testing, and accurately measure latency and throughput. By generating normal and attack traffic patterns, GAI can support the training of intrusion detection systems (IDS) and anomaly detection to improve security. It also reduces testing costs, scales to simulate a large number of devices, and adapts to different network conditions for customized testing. This approach helps with capacity planning, quality of service (QoS) benchmarking, service level agreement (SLA) verification, and helps test new technologies and disaster recovery scenarios, ultimately ensuring robust, efficient, and secure data link network operations. In systems that rely on satellite, airborne, and other space-based communication systems, simulating realistic traffic is beneficial for evaluating and applying performance under various conditions. Traffic generation helps understand the bandwidth requirements of each device, latency, and network reliability, ensuring that data link network solutions are robust and efficient.

[0063] This patent uses an improved IP2Vec traffic five-tuple embedding representation, and uses CGAN to generate traffic for multiple applications. First, a context and corpus are built for the system to train the improved IP2Vec model and train the GAN model with labeled data. The method is based on structured network flows, which contain flow identifiers (i.e., five-tuples) and statistical attributes. Therefore, it can only generate network traffic in an offline manner, but not real-time traffic. The traffic captured from the physical network is converted into a network flow and then input into the generation model. The flow five-tuple attributes are embedded as vectors and can be directly processed and learned by the CGAN model. The remaining statistical features of the network flow are also preprocessed and input into the CGAN model. At the same time, CGAN also takes the traffic application type as input to generate labeled traffic. The generator is responsible for generating synthetic traffic from random noise and traffic type labels, while the discriminator distinguishes between generated traffic and real traffic. Finally, post-processing and mapping are performed to convert the embedded attributes of the synthetic traffic back to the original five-tuple space for network behavior analysis. The process of the specific embodiment is as follows Figure 1 The specific steps are as follows:

[0064] Step 1: Collection and preparation of traffic data;

[0065] A traffic dataset containing 75 data link applications (such as media, video streaming, and file sharing services) at different time periods within a week was obtained. The dataset records the network activities of each application at different time periods, providing a rich source of information for model training. When processing the data, duplicate records in the dataset are first deleted, incorrect data entries are corrected, and missing information is filled. Then the application type (such as text, video) is converted into a numerical label. For example, text may be encoded as 1 and video as 2 so that the model can process it. Next, the Min-Max scaling method is used to standardize all numerical attributes to the range of 0 to 1 to ensure that model training will not be biased due to differences in numerical scales.

[0066] Step 2: Definition of context extraction rules;

[0067] The context is obtained through a sliding window, which involves selecting words within a certain range around the target word; the present invention optimizes the context extraction rules to adapt to this special data structure; in network traffic data, even non-continuous fields may have important semantic connections; the quintuple of traffic is regarded as a whole, that is, a "sentence", added to the flow direction and the context is defined based on the intrinsic connection between the fields rather than their order in the quintuple; the context extraction rules in step 2 are optimized according to the characteristics of network traffic data; the context extraction method proposed in the present invention regards the quintuple of traffic as a whole, similar to a sentence in natural language processing, while taking into account the semantic relationship between fields, especially the relationship between non-adjacent fields; context extraction is not only based on the linear order of fields, but also considers the nonlinear relationship between them, such as the association between source IP and destination IP, which is used to distinguish different traffic types; Figure 2 As shown in the figure, the present invention extends the improved IP2Vec model to adapt to more complex network traffic characteristics; the characteristics of the input traffic include source IP address, source port number, destination IP address, destination port number and transmission protocol; in the upper part of the figure, the process of how to construct training samples from these attributes is shown; each traffic is converted into six training samples, in which the input words are marked with a colored background and the context is displayed in gray; the lower part of the figure further shows in detail how these training samples are constructed; each traffic flow actually generates nine training samples, in which each source IP and destination IP corresponds to three word-context pairs; the remaining three samples involve ports and protocols as input words; the creation of samples starts with the pairing of source IP and destination IP, followed by the pairing of destination IP and source IP; since server-side applications usually use ports in a fixed or specific range, the IP address is combined with the port to form a context; at the same time, the protocol is associated with both the source IP and the destination IP; Figure 2 A specific example clearly shows how these training samples are constructed.

[0068] A sliding window technique is used to extract context information. The traffic quintuple is considered as a whole. Training samples are constructed by converting each traffic flow into multiple samples, where the input words are marked with a colored background and the context is displayed in gray, thus generating nine training samples, each of which involves a port and a protocol as input words. Sample creation begins with the pairing of source IP and destination IP, followed by the pairing of destination IP and source IP, combining the IP address with the port to form a context, and establishing an association between the protocol and the source IP and destination IP. The random forest algorithm is used to analyze the data and select 20 attributes that best represent the traffic characteristics, such as transmission rate, packet size, session duration, etc. These attributes are used to distinguish traffic patterns of different network applications.

[0069] Step 3: Embedding representation of traffic attributes;

[0070] The improved IP2Vec model inspired by Word2Vec is used. This model can learn the similarities between IP addresses, ports, and protocols and convert IP addresses into vector form. The improved IP2Vec model is trained to predict other elements (such as the destination IP address or port) based on one element in the traffic (such as the source IP address), thereby capturing the relationship between traffic attributes. Figure 2 For example, for the target-context pair ("192.168.130.41", "10.200.7.8"), when the input is "10.200.7.8", the output probability is expected to be 1, otherwise it is 0. The problem with the original skipping model is that it involves a four-class classification task, that is, maximizing the probability of P("10.200.7.8"|"192.168.130.41") and minimizing other probabilities. During the back-propagation process, the word vectors of "54981", "3128" and "6" need to be updated, which brings a 5×s emb times the amount of computation. In negative sampling, a word is randomly selected from ("54981", "3128", "6") to determine the probability of its neighboring words. Since only the weights of "192.168.130.41", "10.200.7.8" and the selected negative word need to be updated, this selection method reduces the computation time from 5×s to emb Reduced to 3×s emb Through the above negative sampling, the training cost is greatly reduced.

[0071] Step 4: Construction and training of CGAN model;

[0072] The improved IP2Vec and CGAN models were built and trained using the Python programming language and the PyTorch deep learning framework on a computer with a high-performance processor and an advanced graphics processing unit.

[0073] CGAN is an extension of the traditional generative adversarial network (GAN), which controls the type of generated samples by introducing conditional information. The goal of CGAN is to generate samples related to specific conditions, ensuring that the generated samples can not only reflect the distribution characteristics of the training data, but also generate samples of specific categories according to given conditions. CGAN consists of two parts: a generator (G) and a discriminator (D). In the present invention, the generator (G) is able to generate synthetic traffic from random noise and traffic type labels, while the discriminator (D) is able to distinguish between generated traffic and real traffic. During the model training process, real traffic data with traffic type labels are used to train the CGAN model, and the embedding vector obtained in step 3 is combined with statistical properties as training data. Through adversarial training, the generator learns to generate traffic with specified characteristics, while the discriminator learns how to distinguish between real traffic and generated traffic.

[0074] Step 5: Post-processing and attribute mapping;

[0075] Using the trained generator network, synthetic traffic is generated according to the specified traffic type labels. These synthetic traffics mimic the distribution of real traffic in terms of statistical characteristics. The embedding attributes of the generated synthetic traffic are mapped back to the original five-tuple space so that they can be further used for network behavior analysis. By calculating the cosine similarity between the synthetic embedding attributes and all the embedding results stored during the training phase, the most similar vocabulary is found to map back to the corresponding field of the synthetic traffic.

[0076] Step 6: Performance Evaluation

[0077] The traffic samples generated by the improved IP2Vec and CGAN are compared with those produced by other generative models (such as VAE, VGAN, WGAN), and statistical tests and visualization tools are used to evaluate the quality and authenticity of the samples.

[0078] Figure 5 The EMD comparison results of different methods in five applications are shown. According to the observation, the EMD value of CGAN is smaller than that of other methods, which means that the distribution of synthetic traffic generated by CGAN is more consistent with the real traffic. The EMD of file, text, and video traffic generated by VGAN is close to that of CGAN, but still larger than that of CGAN. VAE and WGAN perform poorly on multiple traffic types. The comparative experiments on EMD prove that CGAN better learns the distribution characteristics of various traffic types. Therefore, the generated traffic is more consistent with the data distribution of various application traffic.

[0079] In order to intuitively show how the model embeds different characteristics of network traffic into the vector space, the t-SNE technology is used to reduce the high-dimensional embedding vector to a two-dimensional plane, and the perplexity parameter is adjusted to obtain the best visualization effect.

[0080] Assume that the original distribution of the stream quintuple is P emb , the goal of t-SNE is to find a emb The new distribution of low-dimensional data Q. t-SNE uses a Student distribution with a single degree of freedom to create a low-dimensional space, expressed as

[0081]

[0082] Introduce KL divergence to measure P emb The distance from Q is as follows:

[0083]

[0084] One of the most important parameters of t-SNE is the perplexity (prep) that captures the different scales in the data, defined as:

[0085]

[0086] In the formula For data point x i Select x j As the probability of its neighbor, H(P emb ) is Shannon entropy, and the calculation formula is as follows:

[0087] H(P emb )=-∑ i P i emb log(P i emb )

[0088] H(P emb )=-∑ i P i emb log(P i emb ) (18)

[0089] Figure 6-8 t-SNE visualization of flow quintuples at different complexity. After the improved IP2Vec neural network model was trained and converged, its embedding performance was evaluated experimentally. In this experiment, vector representations of network flow quintuples of different applications were calculated. The vectors were then reassembled and input into the t-SNE algorithm with a specified perplexity value to obtain a two-dimensional representation. The dimensionality reduction results of flows from different applications were compared pairwise to evaluate whether they can be clearly distinguished. Figure 6 As shown, when the perplexity increases to 150, the internal aggregation level of the data distribution of each application also increases, resulting in one or two clusters.

[0090] However, most data points still have relatively scattered distributions, with significant overlaps between them. When the perplexity increases to 175, except for text and images, there are obvious differences in data distribution between applications, such as Figure 7 Finally, when the perplexity is set to 200, there is a clear gap between every two applications, as shown in Figure 8 As shown. In addition, the distributions between certain application pairs, such as images and files, images and text, and files and text, can be easily distinguished using a linear regression algorithm. From the above analysis, it can be inferred that the embedding method based on the improved IP2Vec can effectively generate a vector representation of the flow quintuple in the input traffic. This method extracts and expresses the similarities within a single application flow and the differences between each two application flows.

[0091] In order to evaluate the quality of synthetic traffic, the present invention analyzes the distribution of various network flow attributes of real traffic and synthetically generated traffic. Fig. 9 and Fig.10 The distribution of 20,000 real traffic flows and 20,000 synthetic traffic flows generated by VAE, VGAN, WGAN and CGAN are shown respectively. Two statistical flow attributes are selected for analysis: average packet size and average forward packet interval. The attribute "average packet size" refers to the average size of each packet in the flow. The mean flow IAT represents the average inter-arrival time (IAT) in the flow.

[0092] Fig. 9 (A) to (D) show the distribution of image traffic created by four different methods. The blue curve and bar chart show the statistical distribution of the average packet size characteristics of real traffic used to train the improved IP2Vec model and CGAN. Red represents the synthetic traffic generated by various generative adversarial network (GAN) methods. Sub-figures (A) to (D) show the distribution comparison of image traffic. It is worth noting that compared with real traffic, VAE and VGAN generate less traffic and smaller average packet size. WGAN generates more samples with average packet sizes between 30 bytes and 100 bytes than real traffic. The traffic generated by CGAN shows the trend closest to real traffic.

[0093] Fig.10The comparison of the IAT mean attribute distribution of synthetic traffic and real traffic flows is shown. The blue curve and bar chart show the statistical distribution of the flow IAT mean features of the real traffic used to train the improved IP2Vec model and CGAN. Red represents the synthetic traffic generated by various GAN methods. Sub-figures (A) to (D) show the distribution comparison of voice traffic. This study will take voice as an example. The worst performance was observed on the voice volume, and the deviation of the fitting curve was the largest. VAE and CGAN performed similarly in these two applications. Based on the previous analysis results, it is concluded that CGAN outperforms the other three methods in the traffic generation task. The synthetic traffic flow generated by CGAN exhibits similar behavior to the real traffic flow. In addition, the traffic generated by VAE, VGAN and WGAN uses different models. New types of traffic require training new models. Compared with other methods, CGAN has significantly lower training and storage costs when generating the same number of traffic types. The other GAN models mentioned in this article cannot generate a specific type of traffic unless they are trained with only one type of traffic, so multiple training models are required to generate multiple types of traffic. The experiments of the present invention have proved that using CGAN to generate network traffic flows is a feasible and effective method.

Claims

1. A method for generating data link network traffic based on a generative adversarial network, the method comprising the following steps: Step 1: Traffic data preparation; Capture traffic data from the physical network. This data includes the five-tuple of network flows and statistical attributes of traffic. The five-tuple also records the labels of the captured traffic data. The five-tuple includes: source IP, destination IP, source port, destination port, and protocol. Step 2: Extract context from the data, treat the five-tuple in the data as a whole and extract them in pairs to obtain extracted samples; Step 3: Embed the extracted samples into the improved IP2Vec model, so that it can predict other elements based on one element in the traffic, capture the relationship between traffic attributes, and obtain an embedding vector; Step 4: Build the conditional generative adversarial network (CGAN) architecture and train the CGAN model; The conditional generative adversarial network (CGAN) consists of two parts: a generator G and a discriminator D. The generator G network generates synthetic traffic from random noise and traffic type labels. The discriminator D network distinguishes the generated traffic from the real traffic. The CGAN model is trained using real traffic data with traffic type labels, including combining the embedding vector obtained in step 3 with the statistical properties of the traffic as training data. Through adversarial training, the generator learns to generate traffic with specified characteristics, while the discriminator learns how to distinguish between real traffic and generated traffic. Step 5: Use the trained generator network to generate synthetic traffic according to the specified traffic type labels; these synthetic traffics statistically mimic the distribution of real traffic; map the embedding attributes of the generated synthetic traffic back to the original five-tuple space, add it to the total training sample, and further use it for network behavior analysis; find the most similar vocabulary by calculating the cosine similarity between the synthetic embedding attributes and all the embedding results stored in the training phase to map back to the corresponding fields of the synthetic traffic.

2. A method for generating data link network traffic based on a generative adversarial network as claimed in claim 1, characterized in that: In step 3, the extracted vector obtained in step 2 is firstly one-hot encoded, and then input into the improved IP2Vec model; the improved IP2Vec model comprises: an input layer, a separate hidden layer and an output layer, and the neurons in the hidden layer are fully connected with the neurons in the input layer and the output layer; the input layer of the improved IP2Vec model is the target word to be predicted, and the output layer is the context word; the input layer and the output layer are respectively connected through an s voc ×s emb and emb ×s voc The weight matrix is ​​connected to the hidden layer, where s voc Indicates the size of the vocabulary, s emb Represents the embedding dimension of the Word2Vec model; the output layer uses the Softmax function to indicate the probability that the input and output words appear in the same context; Improving the IP2Vec model training process specifically includes: Step 3A: The One-Hot vector of w(t) represents the word-context pair that enters it. Given a word w, use Indicates that the embedding vector of x(t) is calculated as follows: Where V is the input word matrix, s emb is the size of the embedding space; Step 3B: The score vector is derived from the output word matrix It is calculated by multiplying by v(t) and is expressed as Step 3C: Softmax is then used to calculate the probability; the predicted probability of the context word is expressed as: The one-hot representation vector of the context word is expressed as formula (4), which matches the predicted probability vector, s win The length of the context boundary; y(t-s win ),...,y(t-1),y(t+1),...y(t+s win )(4) Step 3D: Consider feature x in X with clusters c1 and c2 rea and X syn The distribution in is expressed as and represents the mean value of the ith cluster, represents the distribution score of the ith cluster; let D = [d ij ] is the ground distance matrix, where d ij express and The ground distance between them; assuming f ij yes and The purpose is to find the flow with the minimum total cost F = [f ij ]; After obtaining the optimal flow, EMD is defined as the power consumption normalized by the total flow as follows: The probabilities of using the central word to predict the context words are independent of each other, and the conditional probability is shown in formula (7): Among them, AveEMD represents X real and X syn The average EMD of all features between them; the goal of the model is to minimize this probability: Where T is the length of the sentence, that is, the length of the five-tuple in this article; the probability of calculating the context word w(o) using the given central word w(c) is expressed as: Among them, v c is the word vector of the central word, i.e., the cth column vector of V; u o is the word vector of the context word, i.e., the o-th column vector of U. The computational cost of ▽logP(w(o)|w(c)) is proportional to the size of the vocabulary.

3. A method for generating data link network traffic based on a generative adversarial network as claimed in claim 1, characterized in that: The input of the generator used in step 4 consists of two parts, the first of which is the prior noise p z (z); The second part is the application type of the traffic; The generator G is a neural network that transforms the prior noise distribution p z (z) is mapped to the real traffic space G(z,θ g ), and learn a real The distribution on p g , the training goal of G is to minimize log(1-D(G(z))); the discriminator D is a neural network that outputs a value to measure the probability that the sample belongs to the real stream; the discriminator D and the generator G are trained simultaneously to minimize log(D(x)). The objective function of the training process of the generator and the discriminator is to minimize a maximum value, which is defined as follows: The generator network receives randomly generated noise vectors and labels of training samples and generates labeled samples; the training samples, the output of the generator, and their respective labels are input to the discriminator together; in addition to the noise z, CGAN also introduces conditional information to the generator network, which is combined in a joint hidden representation; this information is also input to the discriminator network together with the real X real ; By adding additional conditional information c, the objective function of CGAN is transformed into a two-person game with minimum and maximum conditional probability, expressed as: The discriminator not only determines whether the input sample is consistent with the real X real , and also judge whether the input sample meets the conditions restricted by c; the discriminator determines that the generated sample is true only when the label represented by c matches the sample; after training with c, the generator generates synthetic traffic with the specified label, corresponding to the application type specified in this paper. In addition to the additional auxiliary information, the training method of CGAN is the same as that of VGAN. The discriminator and the generator are trained alternately through a two-person game, and they reinforce each other until a Nash equilibrium state is reached.

4. The method for generating data link network traffic based on a generative adversarial network according to claim 1, characterized in that: The specific method of step 5 is: After the CGAN model generates the synthetic embedding attributes, they need to be transformed back to the original space, i.e., the stream quintuple; the nearest neighbors of the synthetic embedding attributes are selected in the existing embedding space; to achieve this, all embeddings of the vocabulary are first calculated using the well-trained improved IP2Vec model; all correspondences between the vocabulary and the embeddings are stored for further search; after generating the synthetic stream, the embedding of the stream quintuple is extracted. Each one is used to calculate the cosine similarity between it and all previously stored embedding results. The words with the largest cosine similarity between the trained embedding and the generated synthetic embedding are mapped to the corresponding fields of the synthetic flow. Then the flow quintuple is converted back to the address space instead of the embedding space; the generated traffic can be further utilized in various downstream tasks of the data link network; the cosine similarity is calculated as follows:

5. A method for generating data link network traffic based on a generative adversarial network as claimed in claim 2, characterized in that: During the training, samples are selectively included in the training of the improved IP2Vec model; then: The target logP(w(o)|w(c)) is replaced by: Then, for each target word w(c), the task is transformed and the context word w(o) is correlated with the target word w(c) from the noise distribution P using logistic regression. n The loss of the target word is calculated as the classification problem between the context word w(o) and the k negative samples. The selection probability corresponding to the sample is: Among them, f(w) is the occurrence time of word w, P n (w) is the probability of choosing word w as a negative sample.

Images