A Data Link Network Traffic Generation Method Based on Generative Adversarial Networks

Abstract

This invention discloses a data link network traffic generation method based on Generative Adversarial Networks (GAI), belonging to the field of data link network technology. This invention can utilize a GAI model to learn the distribution and behavioral characteristics of historical traffic data, generating comprehensive traffic that conforms to real network characteristics. This framework supports unlimited traffic generation without deploying real network services. This invention employs an improved IP2Vec+CGAN network model for data link network traffic generation, introducing an embedding-based method that uses continuous vectors to represent flow quintuples. A comprehensive network traffic generation model based on CGAN is proposed. We use the vector representation of flow quintuples, statistical characteristics of network traffic, and traffic types to train the CGAN model. After traffic generation, it is transformed back from the generated state to its original space, which is then used to describe network behavior between IoT devices or users.

Description

Technical Field

[0001] This invention belongs to the field of data link network technology, and in particular relates to a method for generating data link network traffic based on generative adversarial networks. Background Technology

[0002] Tactical Data Link (TDL) is a wireless communication system that allows information and data to be shared between different platforms (such as aircraft, ships, and land vehicles), enabling fast and reliable information exchange in various environments. As a network system, data links have extremely high reliability requirements. The development and testing of the entire system requires extensive and comprehensive evaluation to prove its reliability and ensure its effectiveness in the environment. To evaluate network connectivity, performance bottlenecks, and security, real traffic must be injected into the network system. However, due to the sensitivity of real data, it is highly confidential before the system is proven reliable, which limits the progress of system development. Even if an incomplete system is approved for testing, organizing system testing requires coordination among multiple devices and regions, consuming significant human, material, and financial resources. Summary of the Invention

[0003] To address the challenges of testing in remote and diverse environments and to provide comprehensive traffic analysis and performance evaluation, this invention offers a GAI-based synthetic traffic generation framework. This framework includes an embedding-based model for representing network traffic attributes and a Conditional Generative Adversarial Network (CGAN) for generating traffic.

[0004] To achieve the above objectives, the present invention adopts the following technical solution: a data link network traffic generation method based on generative adversarial networks, the overall steps and input / output of which are as follows. Figure 1 As shown, the method includes the following steps:

[0005] Step 1: Prepare traffic data;

[0006] Capture traffic data from the physical network, including the network flow's 5-tuple and traffic statistics, and record the tags of the captured traffic data. The 5-tuple includes: source IP, destination IP, source port, destination port, and protocol.

[0007] Step 2: Context extraction of the data, treating the quintuples in the data as a whole and extracting them pairwise to obtain the extracted samples;

[0008] Step 3: Embed the extracted samples into the improved IP2Vec model so that it can predict other elements (such as destination IP or port) based on one element in the traffic (such as source IP), capture the relationship between traffic attributes, and obtain the embedding vector;

[0009] Step 4: Construct the Conditional Generative Adversarial Network (CGAN) architecture and train the CGAN model;

[0010] The Conditional Generative Adversarial Network (CGAN) consists of two parts: a generator (G) and a discriminator (D). The generator (G) network generates synthetic traffic from random noise and traffic type labels; the discriminator (D) network distinguishes between generated traffic and real traffic. Its overall model architecture is as follows: Figure 1 As shown; the CGAN model is trained using real traffic data with traffic type labels, including combining the embedding vectors obtained in step 3 with the statistical properties of the traffic as training data; through adversarial training, the generator learns to generate traffic with specified features, while the discriminator learns how to distinguish between real traffic and generated traffic.

[0011] Step 5: Using the trained generator network, generate synthetic traffic based on the specified traffic type labels; these synthetic traffic statistically mimic the distribution of real traffic; map the embedding attributes of the generated synthetic traffic back to the original quintuple space, add it to the total training samples, and further use it for network behavior analysis; find the most similar words and map them back to the corresponding fields of the synthetic traffic by calculating the cosine similarity between the synthetic embedding attributes and all embedding results stored in the training phase.

[0012] Furthermore, in step 3, the extracted vector obtained in step 2 is first one-hot encoded, and then input into the improved IP2Vec model; the improved IP2Vec model includes: an input layer, a single hidden layer, and an output layer, as follows: Figure 3 As shown. Neurons in the hidden layer are fully connected to neurons in the input and output layers; the input layer of the improved IP2Vec model is the target word to be predicted, and the output layer is the context word; the input and output layers are each connected through a single s... voc ×s emb and s emb ×s voc The weight matrix is ​​connected to the hidden layer, where s voc Indicates the size of the dictionary, s emb This represents the embedding dimension of the Word2Vec model; the output layer uses the Softmax function to indicate the probability that input and output words appear in the same context. Figure 3This demonstrates the state of the network model when two training samples (192.168.130.41, port 54981) and (192.168.130.41, TCP) are input. Given the target word 192.168.130.41, the context words are port 54981 and TCP. Figure 3 The neural network in it uses Figure 2 The training samples are trained using a Skip-Gram structure. The goal of Skip-Gram is to train the network to predict the probability that randomly selected words in the vocabulary are neighbors (i.e., context) of a given word. However, in classification tasks, input / output neurons are not used; only the weights of the hidden layers are extracted as word vectors. Considering... Figure 2 For the generated training samples, we set the window size to 2. The improved IP2Vec model training process specifically includes:

[0013] Step 3A: The One-Hot vector of w(t) represents the word-context pairs that enter it. Given a word w, use... The embedding vector of x(t) is calculated as follows:

[0014]

[0015] Where V is the input word matrix, s emb It is the size of the embedded space;

[0016] Step 3B: The score vector is composed of the output word matrix. The result, calculated by multiplying by v(t), is expressed as:

[0017]

[0018] Step 3C: Then use Softmax to calculate the probability; the predicted probability of context words is expressed as:

[0019]

[0020] The One-Hot representation vector of the context words is expressed as Equation (4), which matches the predicted probability vector, s win The length of the context boundary;

[0021] y(ts win ),...,y(t-1),y(t+1),...y(t+s win (4) Step 3D: Consider feature x in X with c1 and c2 clusters rea and X syn The distributions in the data are represented as follows: and This represents the average value of the i-th cluster. Let D represent the distribution score of the i-th cluster; let D = [d ij ] is the ground distance matrix, where d ij express and The ground distance between them; assuming f ij yes and The goal is to find the flow between [f], where the total cost is minimized by F = [f]. ij ];

[0022]

[0023] After obtaining the optimal flow rate, EMD is defined as the power consumption normalized to the total flow rate, as shown below:

[0024]

[0025] The probabilities of predicting context words using the head word are independent of each other, and the conditional probabilities are shown in formula (7):

[0026]

[0027] Where AveEMD represents X real and X syn The average EMD of all features between them; the goal of this model is to minimize this probability:

[0028]

[0029] Where T is the length of the sentence, i.e., the length of the quintuple in this paper; the probability of the context word w(o) calculated using the given head word w(c) is expressed as follows:

[0030]

[0031] Among them, v c It is the word vector of the center word, that is, the c-th column vector of V; u o It is the word vector of the context words, that is, the o-th column vector of U. The computational cost of ▽logP(w(o)|w(c)) is proportional to the size of the vocabulary.

[0032] Furthermore, during training, samples are selectively incorporated into the training of the improved IP2Vec model; then:

[0033] The target logP(w(o)|w(c)) is replaced with:

[0034]

[0035] Then, the task for each target word w(c) is transformed, and logistic regression is used to connect the context word w(o) with the noise distribution P. n The k negative samples extracted from (w) are distinguished; the loss of the target word is calculated as a classification problem between the context word w(o) and the k negative samples;

[0036] The selection probability corresponding to the sample is:

[0037]

[0038] Where f(w) is the occurrence time of word w, and P n (w) is the probability of selecting word w as a negative sample.

[0039] Furthermore, the input to the generator used in step 4 consists of two parts, the first part being prior noise p. z (z) serves to increase the diversity of generated samples; since the noise vector is generated randomly, each generated sample will be different, which enables the generator to produce diverse outputs; the second part is the application type of the flow, which is used to label the data input to the model training.

[0040] The generator G is a neural network that generates a prior noise distribution p. z (z) is mapped to the real flow space G(z,θ) g ), and learn a way in real space X real Distribution p on g The training objective of G is to minimize log(1-D(G(z))); the discriminator D is a neural network that outputs a value to measure the probability that a sample belongs to the true stream; the discriminator D and the generator G are trained simultaneously to minimize log(D(x)), and the objective function during the training of the generator and discriminator is to minimize a maximum value, defined as follows:

[0041]

[0042] For the training process of the model, GAN models are generally trained using unlabeled data. Therefore, they can only generate random and unpredictable samples. The type of synthetic samples cannot be controlled or manipulated to mimic the traffic patterns of different applications in data link networks; therefore, Mirza et al.

[28] proposed CGAN, which is an extension of the GAN model that provides prior information c to both the generator and the discriminator.

[0043] Information c can be various multimodal, such as class information of samples or action information of people in images. Considering the dynamics in squared loss training helps to obtain better performance. This paper defines c as the application type of traffic, such as drone traffic.

[0044] The generator network receives a randomly generated noise vector and the labels of the training samples, and generates labeled samples. The training samples, the generator's output, and their respective labels are fed into the discriminator. In addition to the noise z, CGAN also introduces conditional information into the generator network, which is combined in a joint hidden representation. This information is also fed into the discriminator network and compared with the real X. real By adding additional conditional information c, the objective function of CGAN is transformed into a two-player game with the conditional probability of minimax, expressed as:

[0045]

[0046] The discriminator must not only determine whether the input sample matches the true X real Furthermore, it is necessary to determine whether the input sample meets the conditions restricted by c; the discriminator only determines that the generated sample is true when the label represented by c matches the sample; after training with c, the generator generates synthetic traffic with specified labels, corresponding to the application type specified in this paper. Apart from additional auxiliary information, the training method of CGAN is the same as that of VGAN. The discriminator and generator are trained alternately through a two-player game, mutually reinforcing each other until a Nash equilibrium is reached.

[0047] Furthermore, the specific method for step 5 is as follows:

[0048] After the CGAN model generates synthetic embedding attributes, the synthetic embedding attributes need to be transformed back to the original space, i.e., the stream quintuple. The nearest neighbor of the synthetic embedding attribute is selected in the existing embedding space. To achieve this, all embeddings of the vocabulary are first computed using a well-trained improved IP2Vec model. All correspondences between the vocabulary and embeddings are stored for further searching. After generating the synthetic stream, the embeddings of the stream quintuple are extracted.

[0049] Each embedding is used to calculate its cosine similarity with all previously stored embedding results. The word with the highest cosine similarity between the trained embedding and the generated synthetic embedding is mapped to the corresponding field in the synthetic stream. Then, the stream quintuple is transformed back into the address space instead of the embedding space. The generated stream can be further utilized in various downstream tasks of the datalink network. The cosine similarity is calculated as follows:

[0050]

[0051] Data links have extremely high reliability requirements. The development and testing of the entire system requires extensive and comprehensive evaluation to prove its reliability and ensure its effectiveness in practical applications. To assess network connectivity, performance bottlenecks, and security, real traffic must be injected into the network system. However, due to the sensitivity of real data, it is highly confidential until the system is proven reliable, which limits the progress of system development. This invention provides an innovative method for testing and evaluating TDL (Data Link Detection and Analysis) by introducing GAI (Gas Interactive Algorithm) technology. This method improves testing efficiency and accuracy while reducing costs. GAI technology can generate traffic patterns similar to real-world environments, including normal operation and potential attack behaviors, making testing closer to real-world application scenarios and improving the reliability and accuracy of test results. The diverse traffic generated by GAI allows for comprehensive stress and load testing of the data link, ensuring that the system's performance can be verified under various conditions. GAI technology allows for precise measurement of data link latency and throughput, which is crucial for evaluating system performance. Furthermore, the attack traffic patterns generated by GAI can be used to train IDS (Intrusion Detection Systems) and anomaly detection systems, thereby improving data link security. Compared to traditional testing methods, GAI technology reduces the need for actual equipment and resources, significantly lowering testing costs. GAI technology can simulate a large number of devices, adapt to different network conditions, and perform customized testing, providing great flexibility and scalability. This invention also helps test new technologies and disaster recovery solutions, ensuring the robustness and efficiency of data link networks in the face of various challenges. In summary, this invention, through the application of GAI technology, not only improves the efficiency and effectiveness of data link testing but also enhances system security and reliability while reducing costs, bringing significant technological advancements to the communications field. Attached Figure Description

[0052] Figure 1 This is a schematic diagram illustrating the overall process and data input / output of the method proposed in this invention.

[0053] Figure 2 This is a schematic diagram illustrating the composition of the training samples proposed in this invention.

[0054] Figure 3 This is a schematic diagram of the improved IP2Vec embedding neural network structure proposed in this invention.

[0055] Figure 4 This is a schematic diagram of the CGAN model structure used in this invention.

[0056] Figure 5 This is a schematic diagram of the average EMD between the synthetic stream generated by the model and the real stream in a specific embodiment of the present invention.

[0057] Figure 6This is a visualization diagram of the t-SNE distribution of the model used in a specific embodiment of the present invention when the perplexity is 150.

[0058] Figure 7 This is a visualization of the t-SNE distribution of the model used in a specific embodiment of the present invention when the perplexity is 175.

[0059] Figure 8 This is a visualization of the t-SNE distribution of the model used in a specific embodiment of the present invention when the perplexity is 200.

[0060] Figure 9 This is a statistical distribution diagram of the average data packet size of the model-generated traffic in a specific embodiment of the present invention; where (A) is image / VAE, (B) is image / VGAN, (C) is image / WGAN, and (D) is image / CGAN.

[0061] Figure 10 This is a schematic diagram of the statistical distribution of the average IAT of the model-generated traffic in a specific embodiment of the present invention; where (A) is voice / VAE, (B) is voice / VGAN, (C) is voice / WGAN, and (D) is voice / CGAN. Detailed Implementation

[0062] Traffic generation technology based on Generative Artificial Intelligence (GAI) provides realistic and diverse traffic simulations, thereby improving network performance, security, and management. It can accurately model datalink network behavior, enabling comprehensive stress and load testing, and precise measurement of latency and throughput. By generating normal and attack traffic patterns, GAI supports the training of Intrusion Detection Systems (IDS) and anomaly detection, thus improving security. It also reduces testing costs, scales up to simulate a large number of devices, and adapts to different network conditions for customized testing. This approach aids in capacity planning, Quality of Service (QoS) benchmarking, Service-Level Agreement (SLA) verification, and helps test new technologies and disaster recovery scenarios, ultimately ensuring the robustness, efficiency, and security of datalink network operations. In systems relying on satellite, airborne, and other space-based communication systems, simulating realistic traffic is beneficial for evaluating and applying performance under various conditions. Traffic generation helps understand the bandwidth requirements, latency, and network reliability of individual devices, ensuring the robustness and efficiency of datalink network solutions.

[0063] This patent utilizes an improved IP2Vec traffic quintuple embedding representation and CGAN to generate traffic for multiple applications. First, a context and corpus are built for the system to train the improved IP2Vec model and a GAN model with labeled data. This method is based on structured network flows, which contain flow identifiers (i.e., quintuples) and statistical attributes. Therefore, it can only generate network traffic offline, not real-time traffic. Traffic captured from the physical network is converted into network flows and then input into the generative model. The flow quintuple attributes are embedded as vectors, which can be directly processed and learned by the CGAN model. The remaining statistical features of the network flows are also preprocessed and input into the CGAN model. Simultaneously, the CGAN also takes the traffic application type as input to generate labeled traffic. The generator is responsible for generating synthetic traffic from random noise and traffic type labels, while the discriminator distinguishes generated traffic from real traffic. Finally, post-processing and mapping are performed to transform the embedded attributes of the synthetic traffic back into the original quintuple space for use in network behavior analysis. The specific implementation flow is as follows... Figure 1 As shown. The specific steps are as follows:

[0064] Step 1: Collection and preparation of traffic data;

[0065] A traffic dataset containing traffic data from 75 data chain applications (such as media, video streaming, and file sharing services) across different time periods within a week was acquired. This dataset records the network activity of each application at different times, providing a rich source of information for model training. When processing the data, duplicate records were first removed, erroneous data entries were corrected, and missing information was filled in. Then, application types (such as text and video) were converted to numerical labels; for example, text might be encoded as 1 and video as 2, so that the model could process them. Next, the Min-Max scaling method was used to normalize all numerical attributes to the range of 0 to 1, ensuring that model training was not biased by differences in numerical scale.

[0066] Step 2: Define the context extraction rules;

[0067] Context is obtained through a sliding window, a method involving selecting a range of words around the target word. This invention optimizes the context extraction rules to adapt to this special data structure. In network traffic data, even non-contiguous fields may have important semantic connections. The five-tuple of traffic is treated as a whole, i.e., a "sentence," added to the flow direction, and the context is defined based on the inherent connections between fields rather than their order in the five-tuple. The context extraction rules in step 2 are optimized according to the characteristics of network traffic data. The context extraction method proposed in this invention treats the five-tuple of traffic as a whole, similar to a sentence in natural language processing, while considering the semantic relationships between fields, especially the relationships between non-adjacent fields. Context extraction is not only based on the linear order of fields but also considers the non-linear relationships between them, such as the association between source IP and destination IP, to distinguish different traffic types. Figure 2 As shown, this invention extends the improved IP2Vec model to accommodate more complex network traffic characteristics. The characteristics of the input traffic include source IP address, source port number, destination IP address, destination port number, and transport protocol. The upper part of the figure illustrates how training samples are constructed from these attributes. Each traffic flow is transformed into six training samples, where input words are highlighted with a colored background, while the context is shown in gray. The lower part of the figure further details how these training samples are constructed. Each traffic flow actually generates nine training samples, where each source IP and destination IP corresponds to three word-context pairs. The remaining three samples involve the port and protocol as input words. Sample creation begins with pairing source IP and destination IP, followed by pairing destination IP and source IP. Since server-side applications typically use fixed or specific ranges of ports, IP addresses are combined with ports to form context. Simultaneously, protocols are associated with both source and destination IPs. Figure 2 A concrete example clearly illustrates how these training samples are constructed.

[0068] A sliding window technique is employed to extract contextual information. The traffic quintuple is treated as a whole. Training samples are constructed by transforming each traffic flow into multiple samples, where input words are highlighted with a colored background and context is displayed in gray, generating nine training samples. Each sample involves port and protocol as input words. Sample creation begins with pairing source and destination IPs, followed by pairing destination and source IPs, combining IP addresses with ports to form context, and establishing associations between protocols and source and destination IPs. A random forest algorithm is used to analyze the data, selecting 20 attributes that best represent traffic characteristics, such as transmission rate, packet size, and session duration. These attributes are used to distinguish traffic patterns for different network applications.

[0069] Step 3: Embedded representation of traffic attributes;

[0070] An improved IP2Vec model, inspired by Word2Vec, is employed. This model learns the similarity between IP addresses, ports, and protocols, and converts IP addresses into vector form. By training this improved IP2Vec model, it can predict other elements (e.g., destination IP address or port) based on one element in the traffic (e.g., source IP address), thereby capturing the interrelationships between traffic attributes. Figure 2 Taking the training samples as an example, for the target-context pair ("192.168.130.41", "10.200.7.8"), when the input is "10.200.7.8", the output probability is expected to be 1, otherwise 0. The problem with the original hopscotch model is that it involves a four-class classification task, namely maximizing the probability of P("10.200.7.8"|"192.168.130.41") and minimizing other probabilities. During backpropagation, the word vectors of "54981", "3128", and "6" need to be updated, which brings a 5×s... emb The computational cost is reduced by a factor of 5. In negative sampling, a word is randomly selected from ("54981", "3128", "6") to determine the probability of its neighboring words. Since only the weights of "192.168.130.41", "10.200.7.8" and the selected negative word need to be updated, this selection method reduces the computation time from 5×s. emb Reduced to 3×s emb By employing the aforementioned negative sampling, training costs are significantly reduced.

[0071] Step 4: Construction and training of the CGAN model;

[0072] On a computer equipped with a high-performance processor and advanced graphics processing unit, the improved IP2Vec and CGAN models are built and trained using the Python programming language and the PyTorch deep learning framework.

[0073] CGAN is an extension of the traditional Generative Adversarial Network (GAN) by introducing conditional information to control the type of generated samples. The goal of CGAN is to generate samples that are relevant to specific conditions, ensuring that the generated samples not only reflect the distribution characteristics of the training data but also generate samples of a specific category based on given conditions. CGAN consists of a generator (G) and a discriminator (D). In this invention, the generator (G) generates synthetic traffic from random noise and traffic type labels, while the discriminator (D) distinguishes between generated traffic and real traffic. During model training, real traffic data with traffic type labels is used to train the CGAN model, combining the embedding vectors obtained in step 3 with statistical attributes as training data. Through adversarial training, the generator learns to generate traffic with specified features, while the discriminator learns how to distinguish between real and generated traffic.

[0074] Step 5: Post-processing and attribute mapping;

[0075] Using a trained generator network, synthetic traffic is generated based on specified traffic type labels. This synthetic traffic statistically mimics the distribution of real traffic. The embedding attributes of the generated synthetic traffic are mapped back to the original quintuple space so they can be further used for network behavior analysis. By calculating the cosine similarity between the synthetic embedding attributes and all embedding results stored during training, the most similar words are mapped back to the corresponding fields in the synthetic traffic.

[0076] Step 6: Performance Evaluation

[0077] The traffic samples generated by the improved IP2Vec and CGAN were compared with those generated by other generative models (such as VAE, VGAN, WGAN), and statistical testing and visualization tools were used to evaluate the quality and authenticity of the samples.

[0078] Figure 5 The results show a comparison of EMD (Effective Mobility Distributed) values ​​for different methods across five applications. Based on observations, CGAN's EMD value is lower than other methods, meaning that the synthetic traffic distribution generated by CGAN matches real traffic distribution more closely. VGAN's EMD values ​​for file, text, and video traffic are close to CGAN's, but still larger than CGAN's. VAE and WGAN perform poorly across multiple traffic types. Comparative experiments on EMD demonstrate that CGAN learns the distribution characteristics of various traffic types better. Therefore, the generated traffic better matches the data distribution of traffic across various applications.

[0079] To visually demonstrate how the model embeds different features of network traffic into the vector space, the t-SNE technique is used to reduce the high-dimensional embedding vector to a two-dimensional plane, and the perplexity parameter is adjusted to obtain the best visualization effect.

[0080] Assume the original distribution of the stream quintuple is P emb The goal of t-SNE is to find a value close to P. emb A new distribution for low-dimensional data Q. t-SNE uses the Student distribution with a single degree of freedom to create a low-dimensional space, denoted as...

[0081]

[0082] Introducing KL divergence to measure P emb The distance between Q and Q is shown below:

[0083]

[0084] One of the most important parameters of t-SNE is the perplexity (prep) captured at different scales in the data, defined as:

[0085]

[0086] In the formula For data point x i Select x j The probability of being its neighbor, H(P) emb The entropy is Shannon entropy, calculated using the following formula:

[0087] H(P emb )=-∑ i P i emb log(P i emb )

[0088] H(P emb )=-∑ i P i emb log(P i emb (18)

[0089] Figure 6-8 t-SNE visualization of flow quintuples at different complexities is presented. After training and converging an improved IP2Vec neural network model, its embedding performance is evaluated experimentally. In this experiment, vector representations of network flow quintuples for different applications are computed. These vectors are then recombine and fed into a t-SNE algorithm with specified perplexity values ​​to obtain two-dimensional representations. Dimensionality reduction results from different applications are compared pairwise to assess whether they are significantly distinguishable. Figure 6 As shown, when the perplexity increases to 150, the internal aggregation level of the data distribution for each application also increases, resulting in one or two clusters.

[0090] However, most data points still have a relatively scattered distribution, with significant overlap between them. When the perplexity increases to 175, significant differences in data distribution emerge between applications, except for text and images. Figure 7 As shown. Finally, when the perplexity level is set to 200, a noticeable gap appears between every two applications, as... Figure 8 As shown. Furthermore, the distribution between certain application pairs, such as images and files, images and text, and files and text, can be easily distinguished using linear regression algorithms. Based on the above analysis, it can be inferred that the embedding method based on the improved IP2Vec can effectively generate vector representations of flow quintuples in the input traffic. This method extracts and expresses the similarity within individual application traffic and the differences between every two application traffic flows.

[0091] To evaluate the quality of synthetic traffic, this invention analyzes the distribution of various network flow attributes of real traffic and synthetically generated traffic. Figure 9 and Figure 10 The distributions of 20,000 real traffic streams and 20,000 synthetic traffic streams generated by VAE, VGAN, WGAN, and CGAN are presented respectively. This invention selects two statistical flow attributes for analysis: average packet size and average forward packet interval. The attribute "average packet size" refers to the average size of each packet in the traffic. The mean flow IAT represents the average inter-arrival time (IAT) in the traffic.

[0092] Figure 9 Figures (A) through (D) show the distribution of image traffic generated by four different methods. The blue curves and bars show the statistical distribution of the average packet size characteristics of the real traffic used to train the improved IP2Vec model and CGAN. Red represents the synthetic traffic generated by various generative adversarial network (GAN) methods. Subfigures (A) through (D) show a comparison of the distribution of image traffic. Notably, VAE and VGAN generate less traffic and have smaller average packet sizes compared to real traffic. WGAN generates more samples with average packet sizes between 30 and 100 bytes than real traffic. CGAN-generated traffic shows the trend of being closest to real traffic.

[0093] Figure 10This paper compares the distribution of the mean IAT attribute of synthetic and real traffic flows. The blue curves and bar charts show the statistical distribution of the mean IAT characteristics of real traffic used to train the improved IP2Vec model and CGAN. Red represents synthetic traffic generated by various GAN methods. Subplots (A) to (D) show a comparison of the distribution of voice traffic. This study will use voice as an example. The worst performance was observed in voice volume, with the largest deviation in the fitted curve. VAE and CGAN performed similarly in these two applications. Based on the previous analysis, it is concluded that CGAN outperforms the other three methods in the traffic generation task. The synthetic traffic flows generated by CGAN exhibit behavior similar to real traffic flows. Furthermore, VAE, VGAN, and WGAN generate traffic using different models. New types of traffic require training new models. Compared to other methods, CGAN has significantly lower training and storage costs when generating the same number of traffic types. Other GAN models mentioned in this paper cannot generate specific types of traffic unless trained with only one type of traffic, thus requiring multiple trained models to generate multiple types of traffic. Experiments of this invention have demonstrated that using CGAN to generate network traffic flows is a feasible and effective method.

Claims

1. A method for generating data link network traffic based on generative adversarial networks, the method comprising the following steps: Step 1: Prepare traffic data; Traffic data is captured from the physical network, including network flow quintuples and statistical attributes of the traffic, and the labels of the captured traffic data are recorded. The quintuples include: Source IP, destination IP, source port, destination port, and protocol; Step 2: Context extraction of the data, treating the quintuples in the data as a whole and extracting them pairwise to obtain the extracted samples; Step 3: Embed the extracted samples into the improved IP2Vec model so that it can predict other elements based on one element in the traffic, capture the relationship between traffic attributes, and obtain the embedding vector; First, the extracted vector obtained in step 2 is one-hot encoded, and then input into the improved IP2Vec model. The improved IP2Vec model comprises an input layer, a single hidden layer, and an output layer. Neurons in the hidden layer are fully connected to neurons in the input and output layers. The input layer of the improved IP2Vec model contains the target word to be predicted, and the output layer contains the context words. The input and output layers are respectively connected through an s... voc ×s emb and s emb ×s voc The weight matrix is ​​connected to the hidden layer, where s voc Indicates the size of the dictionary, s emb This represents the embedding dimension of the Word2Vec model; the output layer uses the Softmax function to indicate the probability that input and output words appear in the same context. The improvements to the IP2Vec model training process specifically include: Step 3A: The One-Hot vector of w(t) represents the word-context pairs that enter it. Given a word w, use... The embedding vector of x(t) is calculated as follows: Where V is the input word matrix, s emb It is the size of the embedded space; Step 3B: The score vector is composed of the output word matrix. The result, calculated by multiplying by v(t), is expressed as: Step 3C: Then, use Softmax to calculate the probability; the predicted probability of the context words is expressed as: The One-Hot representation vector of the context words is expressed as Equation (4), which matches the predicted probability vector, s win The length of the context boundary; y(t-s win ),...,y(t-1),y(t+1),...y(t+s win )(4) Step 3D: Consider feature x in X with c1 and c2 clusters rea and X syn The distributions in the data are represented as follows: and This represents the average value of the i-th cluster. Let D represent the distribution score of the i-th cluster; let D = [d ij ] is the ground distance matrix, where d ij express and The ground distance between them; assuming f ij yes and The goal is to find the flow between [f], where the total cost is minimized by F = [f]. ij ]; After obtaining the optimal flow rate, EMD is defined as the power consumption normalized to the total flow rate, as shown below: The probabilities of predicting context words using the head word are independent of each other, and the conditional probabilities are shown in formula (7): Where AveEMD represents X real and X syn The average EMD of all features between them; the goal of this model is to minimize this probability: Where T is the length of the sentence, i.e., the length of the quintuple in this paper; the probability of the context word w(o) calculated using the given head word w(c) is expressed as follows: Among them, v c It is the word vector of the center word, that is, the c-th column vector of V; u o It is the word vector of the context words, that is, the o-th column vector of U. The computational cost is directly proportional to the size of the vocabulary; Step 4: Construct the Conditional Generative Adversarial Network (CGAN) architecture and train the CGAN model; The Conditional Generative Adversarial Network (CGAN) consists of a generator G and a discriminator D. The generator G network generates synthetic traffic from random noise and traffic type labels. The discriminator D network distinguishes between generated traffic and real traffic. The CGAN model is trained using real traffic data with traffic type labels, including combining the embedding vectors obtained in step 3 with the statistical properties of the traffic as training data. Through adversarial training, the generator learns to generate traffic with specified features, while the discriminator learns how to distinguish between real traffic and generated traffic. Step 5: Using the trained generator network, generate synthetic traffic based on the specified traffic type labels; these synthetic traffic statistically mimic the distribution of real traffic; map the embedding attributes of the generated synthetic traffic back to the original quintuple space, add it to the total training samples, and further use it for network behavior analysis; find the most similar words and map them back to the corresponding fields of the synthetic traffic by calculating the cosine similarity between the synthetic embedding attributes and all embedding results stored in the training phase.

2. The data link network traffic generation method based on generative adversarial networks as described in claim 1, characterized in that, The input to the generator used in step 4 consists of two parts, the first part being prior noise p. z (z); The second part is the application type of the traffic; The generator G is a neural network that generates a prior noise distribution p. z (z) is mapped to the real flow space G(z,θ) g ), and learn a way in real space X real Distribution p on g The training objective of G is to minimize log(1-D(G(z))); the discriminator D is a neural network that outputs a value to measure the probability that a sample belongs to the true stream; the discriminator D and the generator G are trained simultaneously to minimize log(D(x)), and the objective function during the training of the generator and discriminator is to minimize a maximum value, defined as follows: The generator network receives a randomly generated noise vector and the labels of the training samples, and generates labeled samples. The training samples, the generator's output, and their respective labels are fed into the discriminator. In addition to the noise z, CGAN also introduces conditional information into the generator network, which is combined in a joint hidden representation. This information is also fed into the discriminator network and compared with the real X. real By adding additional conditional information c, the objective function of CGAN is transformed into a two-player game with the conditional probability of minimax, expressed as: The discriminator must not only determine whether the input sample matches the true X real Furthermore, it is necessary to determine whether the input sample meets the conditions restricted by c; the discriminator only determines that the generated sample is true when the label represented by c matches the sample; after training with c, the generator generates synthetic traffic with specified labels, corresponding to the application type specified in this paper; Apart from additional auxiliary information, CGAN is trained in the same way as VGAN; the discriminator and generator are trained alternately through a two-player game, and they reinforce each other until a Nash equilibrium is reached.

3. The data link network traffic generation method based on generative adversarial networks as described in claim 1, characterized in that, The specific method for step 5 is as follows: After the CGAN model generates synthetic embedding attributes, the synthetic embedding attributes need to be transformed back to the original space, i.e., the stream quintuple. The nearest neighbor of the synthetic embedding attribute is selected in the existing embedding space. To achieve this, all embeddings of the vocabulary are first computed using a well-trained improved IP2Vec model. All correspondences between the vocabulary and embeddings are stored for further searching. After generating the synthetic stream, the embeddings of the stream quintuple are extracted. Each embedding is used to calculate its cosine similarity with all previously stored embedding results. The word with the highest cosine similarity between the trained embedding and the generated synthetic embedding is mapped to the corresponding field in the synthetic stream. Then, the stream quintuple is transformed back to the address space instead of the embedding space. The generated stream is further utilized in various downstream tasks of the datalink network. The cosine similarity is calculated as follows:

4. The data link network traffic generation method based on generative adversarial networks as described in claim 1, characterized in that, During training, samples are selectively incorporated into the training of the improved IP2Vec model; then: The target logP(w(o)|w(c)) is replaced with: Then, the task for each target word w(c) is transformed, and logistic regression is used to connect the context word w(o) with the noise distribution P. n The k negative samples extracted from (w) are distinguished; the loss of the target word is calculated as a classification problem between the context word w(o) and the k negative samples; The selection probability corresponding to the sample is: Where f(w) is the occurrence time of word w, and P n (w) is the probability of selecting word w as a negative sample.

Images