Network traffic anomaly detection method based on Transform generative adversarial network

Abstract

The invention discloses a network traffic anomaly detection method based on a Transform generative adversarial network, and the method comprises the steps: collecting a plurality of traffic data in a normal operation state of a communication network, generating a traffic feature matrix corresponding to each piece of traffic data, and forming a training sample set; constructing a Transform generative adversarial network comprising an encoder, a generator and a discriminator, and training the Transform generative adversarial network by adopting the training sample set; and for network traffic to be detected, generating a traffic characteristic matrix by adopting the same method, inputting the traffic characteristic matrix into the trained Transform generative adversarial network, and calculating a difference value between the traffic characteristic matrix of the network traffic to be detected and the generated traffic characteristic matrix to judge whether the network traffic to be detected is abnormal. According to the method, the network traffic data is converted into the traffic feature matrix, and the features of the normal traffic data are learned by using the Transform generative adversarial network, so that efficient anomaly detection is realized, and the detection accuracy is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security artificial intelligence detection, and more specifically, relates to a network traffic anomaly detection method based on a Transformer-generated adversarial network. Background Art

[0002] At present, network intrusion detection system (IDS) has been widely used in the field of network security. Traditional IDS technology is mainly divided into the following categories:

[0003] Signature-based Detection: This type of IDS relies on a pre-defined attack signature database to detect potential threats by matching data in network traffic with known signatures. This method is very effective in detecting known attacks, but it is powerless against new or variant attacks (such as zero-day attacks). In addition, the maintenance of the signature library needs to be constantly updated, and as the number of signatures increases, the consumption of system resources will also increase. Moreover, the signature-based detection method cannot identify unknown attacks, especially zero-day attacks, because such attacks do not have pre-defined signatures. Therefore, when faced with new threats, the traditional signature matching method appears powerless.

[0004] Anomaly-based Detection: This method establishes a baseline of normal network behavior to detect abnormal behavior that deviates from this baseline. Although this method can detect unknown attack types, its false alarm rate is usually high because the dynamic changes in the network environment may cause normal behavior to be misjudged as abnormal, reducing the actual application value of the system.

[0005] Statistical and Rule-based Detection: These methods rely on statistical models or predefined rules to identify potential threats. Although they perform well in certain environments, they are difficult to maintain efficient detection rates when faced with complex and changing attack methods, especially in the context of the continuous evolution of network attack methods. The adaptability and scalability of such methods are limited.

[0006] Machine Learning-based Detection: In recent years, machine learning algorithms have been introduced into IDS to improve the automation and intelligence of detection. By classifying network traffic data, these systems can identify known and unknown attacks. However, the performance of machine learning algorithms is heavily dependent on the quality and quantity of training data sets, especially when dealing with unbalanced data sets (i.e., normal traffic far exceeds attack traffic), which may lead to reduced detection results.

[0007] Generative adversarial networks (GANs) have also been used in network intrusion detection systems due to their powerful generative capabilities. This type of technical solution trains a generator and a discriminator. The generator attempts to generate forged network traffic data, while the discriminator attempts to distinguish between real network traffic and forged traffic generated by the generator. Through such adversarial training, the system can learn the characteristics of network traffic and thus detect potential network attacks. Summary of the invention

[0008] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a network traffic anomaly detection method based on Transformer generative adversarial network, which converts network traffic data into a traffic feature matrix and uses Transformer generative adversarial network to learn the features of normal traffic data, thereby achieving efficient anomaly detection and improving detection accuracy.

[0009] In order to achieve the above-mentioned object of the invention, the network traffic anomaly detection method based on Transformer generative adversarial network of the present invention comprises the following steps:

[0010] S1: Collect some traffic data under the normal operation of the communication network to obtain a traffic data set; extract N eigenvalues ​​of each traffic data respectively to obtain a traffic feature vector X = [x1, x2, ..., x N ], where x n represents the nth eigenvalue, n = 1, 2, ..., N; the flow feature vector X is copied M times to obtain an extended vector of length M × N, which is then converted into a flow feature matrix Where H and W represent the height and width of the matrix respectively, and C represents the number of channels; the traffic feature matrix corresponding to each traffic data is used as a training sample to form a training sample set;

[0011] S2: Construct a Transformer generative adversarial network, including an encoder, a generator, and a discriminator, where:

[0012] The encoder is used to calculate the flow characteristic matrix Encode and get the noise matrix and sent to the generator;

[0013] The generator is used to generate the reconstructed traffic feature matrix according to the noise matrix Z generated by the encoder And sent to the discriminator; the generator includes a noise matrix block module, a position encoding module, a vector superposition module, a Transformer encoder module and a generator output module, where:

[0014] The noise matrix block module is used to divide the noise matrix Divide it into multiple non-overlapping noise data blocks of fixed size, flatten each noise data block into a vector, and then embed the noise vector into a fixed-dimensional vector space through linear projection to obtain the noise embedding vector z d , d=1,2,…,D, D represents the number of data blocks, and D noise embedding vectors are sent to the vector superposition module;

[0015] The position encoding module is used to generate a position encoding vector p for each noise data block with the same dimension as the noise embedding vector d And sent to the vector superposition module;

[0016] The vector superposition module is used to respectively transform the position encoding vector p d Added to the noise embedding vector z d , and get the feature vector s d =z d +p d And sent to the Transformer encoder module;

[0017] The Transformer encoder module includes H Transformer encoders for D feature vectors s d Encode and obtain the encoding feature v d And sent to the generator output module;

[0018] The generator output module is used to encode the feature v d Processing is performed to generate a reconstructed traffic feature matrix

[0019] The discriminator is used to reconstruct the real traffic feature matrix F or the traffic feature matrix Perform discrimination and obtain the discrimination score belonging to the real data;

[0020] S3: Use the training sample set obtained in step S1 to train the Transformer generative adversarial network constructed in step S2 to obtain a trained Transformer generative adversarial network. The training method is:

[0021] First, the generator and discriminator are trained alternately using the generative adversarial network training method, and then the parameters of the generator and discriminator are fixed to train the encoder.

[0022] S4: For the network traffic to be detected, the same method as in step S1 is used to generate the traffic feature matrix F′, and then it is input into the Transformer generative adversarial network trained in step S3 to generate a two-dimensional traffic feature matrix Then calculate the two-dimensional flow characteristic matrix F′ and the two-dimensional flow characteristic matrix If the difference value dif is greater than the preset difference value threshold T, the network traffic is abnormal network traffic, otherwise it is normal network traffic.

[0023] The present invention is based on a network traffic anomaly detection method based on a Transformer generative adversarial network. First, a number of traffic data are collected in the normal operating state of a communication network, a traffic feature matrix corresponding to each traffic data is generated to form a training sample set, and a Transformer generative adversarial network including an encoder, a generator and a discriminator is constructed and trained using the training sample set; for the network traffic to be detected, a traffic feature matrix is ​​generated using the same method, and the traffic feature matrix is ​​input into the trained Transformer generative adversarial network, and the difference value between the traffic feature matrix of the network traffic to be detected and the generated traffic feature matrix is ​​calculated to determine whether the network traffic to be detected is abnormal.

[0024] The present invention has the following beneficial effects:

[0025] 1) The present invention constructs a Transformer generative adversarial network and uses the self-attention mechanism in the Transformer to effectively process the temporal characteristics in network traffic, especially in the analysis of long sequence data. Compared with the traditional RNN or LSTM structure, it has higher accuracy and efficiency, thereby effectively improving the performance of processing complex network behaviors and improving the accuracy of anomaly detection;

[0026] 2) The present invention combines the generation capability of GAN and the feature extraction capability of Transformer, and proposes a solution to the data imbalance problem by using only positive sample data for modeling improvement, that is, only relying on normal traffic data for training, reducing the dependence on a large amount of labeled attack data, thereby reducing the complexity and cost of data collection;

[0027] 3) The present invention uses Transformer to construct a generative adversarial network to learn network traffic characteristics, which can significantly reduce false positives, improve detection accuracy, and ensure that normal network activities will not be mistakenly marked as abnormal or malicious behavior, thereby reducing interference with network management personnel;

[0028] 4) The present invention adopts an unsupervised Transformer generative adversarial network, which can learn complex traffic patterns through adversarial training, so that unknown attacks or variant attacks can be detected more effectively, improving the responsiveness of the method of the present invention to new threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1It is a flowchart of a specific implementation method of the network traffic anomaly detection method based on Transformer generative adversarial network of the present invention;

[0030] Figure 2 It is a structural diagram of the traffic anomaly detection model of the Transformer generative adversarial network in the present invention;

[0031] Figure 3 is a structural diagram of the encoder in this embodiment;

[0032] Figure 4 is a structural diagram of the generator in this embodiment;

[0033] Figure 5 is a structural diagram of the discriminator in this embodiment;

[0034] Figure 6 Schematic diagram of calculating the difference value in this embodiment. DETAILED DESCRIPTION

[0035] The specific implementation of the present invention is described below in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when the detailed description of known functions and designs may dilute the main content of the present invention, these descriptions will be omitted here.

[0036] Example

[0037] Figure 1 This is a flowchart of a specific implementation method of the network traffic anomaly detection method based on the Transformer-generated adversarial network of the present invention. Figure 1 As shown, the specific steps of the network traffic anomaly detection method based on Transformer generative adversarial network of the present invention include:

[0038] S101: Obtain training samples:

[0039] Under the normal operation of the communication network, some traffic data are collected to obtain a traffic data set. N eigenvalues ​​of each traffic data are extracted respectively to obtain the traffic feature vector X = [x1, x2, ..., x N ], where x n Represents the nth eigenvalue, n = 1, 2, ..., N. The traffic feature vector X is copied M times to obtain an extended vector of length M × N, which is then converted into a traffic feature matrix Where H and W represent the height and width of the matrix respectively, and C represents the number of channels. The traffic feature matrix corresponding to each traffic data is used as a training sample to form a training sample set.

[0040] In this embodiment, the method for extracting the traffic feature vector is: extracting the source IP address, destination IP address, port number, protocol type, TCP flag, statistical characteristics of the traffic and time characteristics from the traffic data, wherein the statistical characteristics of the traffic include the average size of the packet and the duration of the flow, and the time characteristics include the time interval between packet arrivals and the active time of the flow.

[0041] In this embodiment, in order to improve the quality of the training sample set, the traffic data needs to be cleaned after it is collected. Data cleaning includes removing noise data, processing missing values ​​and outliers, etc., to ensure the accuracy and consistency of the data. Irrelevant or harmful data is removed by detecting and deleting duplicate samples or abnormally long traffic sessions. Then feature selection is performed to select the features with the most distinguishing ability for the detection task. Through the above data cleaning steps, it can be ensured that the constructed intrusion detection system has higher detection accuracy and efficiency in practical applications.

[0042] In addition, in order to ensure that the features are compared on the same scale, each feature value in the data set needs to be normalized. In this embodiment, the "maximum-minimum" normalization method is used to scale each feature value to a specified range of [0,1]. That is, the traffic feature vector X = [x1, x2, ..., x N ] for each eigenvalue x n is the normalized eigenvalue, and the normalized calculation formula is:

[0043]

[0044] Among them, x′ n The original value of the nth feature, x′ n,max , x′ n,min Indicates the maximum and minimum values ​​of this feature item in all traffic data.

[0045] S102: Constructing Transformer Generative Adversarial Network:

[0046] In order to improve the accuracy of traffic anomaly detection, the present invention constructs a traffic anomaly detection model of Transformer generative adversarial network. Figure 2 This is a structural diagram of the traffic anomaly detection model of the Transformer generative adversarial network in the present invention. Figure 2 As shown, the traffic anomaly detection model of the Transformer generative adversarial network in the present invention includes an encoder, a generator and a discriminator, and each module is described in detail below.

[0047] The encoder is used to calculate the flow characteristic matrix Encode and get the noise matrix and sent to the generator. Figure 3 is a structural diagram of the encoder in this embodiment. Figure 3 As shown, the encoder in the present invention includes a first linear module, a second linear module and a third linear module, wherein:

[0048] The first linear module includes a cascaded linear transformation layer (Linear), a LeakyReLU activation layer and a Dropout module, which is used to perform linear processing on the traffic feature matrix F to obtain the matrix f1 and send it to the second linear module.

[0049] The second linear module includes a cascaded linear transformation layer, a LeakyReLU activation layer and a Dropout module, which is used to perform linear processing on the matrix f1 to obtain the matrix f2 and send it to the third linear module.

[0050] The third linear module includes a cascaded linear transformation layer and a Tanh activation layer, which is used to perform linear processing on the matrix f2 to obtain a noise matrix Z and output it.

[0051] According to the above description, the operation of the encoder in this embodiment can be expressed by the following formula: Z = Tanh (W3 * Dropout 2( LeakyRelu2(W2*Dropout1(LeakyRelu1(W1*F+b1))+b2) ) +b3)

[0052] Among them, W1, W2, and W3 represent the linear transformation coefficients of the first linear module, the second linear module, and the third linear module respectively, b1, b2, and b3 represent the biases of the first linear module, the second linear module, and the third linear module respectively, LeakyRelu1() and LeakyRelu2() represent the LeakyRelu activation functions in the first linear module and the second linear module respectively, Dropout1() and Dropout2() represent the Dropout module operations in the first linear module and the second linear module respectively, and Tanh() represents the Tanh activation function in the first linear module.

[0053] The generator is used to generate the reconstructed traffic feature matrix according to the noise matrix Z generated by the encoder and sent to the discriminator. Figure 4 is a structural diagram of the generator in this embodiment. Figure 2 As shown, in this embodiment, the generator is based on the Transformer structure, including a noise matrix block module, a position encoding module, a vector superposition module, a Transformer encoder module and a generator output module, wherein:

[0054] The noise matrix block module is used to divide the noise matrix Divide it into multiple non-overlapping noise data blocks of fixed size, flatten each noise data block into a vector, and then embed the noise vector into a fixed-dimensional vector space through linear projection to obtain the noise embedding vector z d , d=1,2,…,D, D represents the number of data blocks, and D noise embedding vectors are sent to the vector superposition module. By dividing the noise matrix into blocks, high-dimensional data can be effectively processed, local spatial information can be retained, and it can be converted into a format suitable for Transformer processing. Assume that the two-dimensional noise matrix Z is divided into noise data blocks of size P×P, and the number of data blocks D=HWP 2 Each noise data block is then expanded to obtain a vector of length P×P×C, and then linearly projected into a vector space of fixed dimension. This process converts the matrix block into a set of vector representations, called matrix block embeddings.

[0055] The position encoding module is used to generate a position encoding vector p for each noise data block with the same dimension as the noise embedding vector d And sent to the vector superposition module. Since the Transformer structure itself does not have position information, in order to retain the position information of the data block in the noise feature matrix, the position encoding is added and superimposed on the noise embedding vector, thereby retaining the position information of the noise data block and enhancing the model's ability to understand the spatial structure of the noise data.

[0056] The vector superposition module is used to respectively transform the position encoding vector p d Added to the noise embedding vector z d , and get the feature vector s d =z d +p d And sent to the Transformer encoder module.

[0057] The Transformer encoder module includes H Transformer encoders for D feature vectors s d Encode and obtain the encoding feature v d And sent to the generator output module. Figure 4 As shown, in this embodiment, the Transformer encoder includes a multi-head self-attention module, a first feature fusion module, a first layer normalization module, a feed-forward network (Feed-Forward Net, FFN), a second feature fusion module and a second layer normalization module, wherein:

[0058] The multi-head self-attention module is used to process the input feature matrix f using the multi-head self-attention mechanism, and send the obtained attention matrix w to the first feature fusion module. The multi-head self-attention mechanism embeds each matrix block to interact with other blocks, and captures the global relationship in the matrix by calculating self-attention. The self-attention mechanism maps the input features to three matrices: query (Q), key (K), and value (V), and calculates the dot product between them to generate an attention score. This process is performed in parallel on multiple independent heads, and the output of each head is concatenated and projected back to the input dimension through a linear layer. The input undergoes three linear transformations to generate the query matrix Q, key matrix K, and value matrix V respectively. The core of the attention mechanism is to calculate the similarity measure between the query and the key, and construct the attention matrix as the attention score. The specific formula is:

[0059]

[0060] Among them, d k is the dimension of the key vector, is a scaling factor used to stabilize the gradient.

[0061] The first feature fusion module is used to superimpose the input feature matrix f and the attention matrix w to obtain the fused feature a1 and send it to the first layer normalization module.

[0062] The first layer normalization module is used to normalize the fused feature a1, obtain the normalized feature a2 and send it to the feedforward network. The specific operation of the layer normalization module can be expressed by the following formula:

[0063]

[0064] Among them, x represents the input, mean() represents the mean, std() represents the standard deviation, γ represents the scaling parameter, and β represents the offset parameter.

[0065] The feedforward network is used to map the received normalized feature a2 to obtain feature a3 and send it to the second feature fusion module. The feedforward network is applied independently on the embedding of each matrix block, that is, the calculation of each matrix block is parallel. In this embodiment, the feedforward network includes two fully connected layers and a layer of Dropout neuron random inactivation layer, with a nonlinear activation function between them. The specific operation of the feedforward network can be expressed by the following formula:

[0066] FFN(x)=FC2(Dropout(Relu(FC1(x))))

[0067] Among them, FC1() and FC2() represent two fully connected layer operations respectively, Relu() represents the Relu activation function layer, and Dropout() represents the Dropout operation.

[0068] The second feature fusion module is used to superimpose the normalized feature a2 and the feature a3 to obtain the fused feature a4 and send it to the second layer normalization module.

[0069] The second-layer normalization module is used to normalize the fused feature a4, obtain the normalized feature and output it as the result of the current Transformer encoder.

[0070] The generator output module is used to encode the feature v d Processing is performed to generate a reconstructed traffic feature matrix In this embodiment, the generator output module uses a cascaded layer normalization layer and a fully connected layer, that is, the encoding feature v is first d The layer is normalized, and then the output result shape is inversely synthesized into a reconstructed two-dimensional traffic feature matrix with the same dimension as the original two-dimensional traffic feature matrix through a fully connected layer (Linear).

[0071] The discriminator is used to reconstruct the real traffic feature matrix F or the two-dimensional traffic feature matrix Perform discrimination and obtain the discrimination score belonging to the real data. Figure 5 is a structural diagram of the discriminator in this embodiment. Figure 5 As shown, the discriminator in this embodiment also uses Transformer as the main structure, including a traffic feature matrix block module, a first position encoding module, a first vector superposition module, a Transformer encoder module, a coding feature embedding, a second position encoding module, a second vector superposition module, a Transformer decoder module, a splicing module and a discriminator output module, wherein:

[0072] The traffic feature matrix block module is used to transform the real traffic feature matrix F or reconstruct the two-dimensional traffic feature matrix Divide it into multiple non-overlapping traffic feature data blocks of fixed size, flatten each traffic feature data block into a vector, and then embed the traffic feature vector into a fixed-dimensional vector space through linear projection to obtain the traffic embedding vector z′ d , D traffic embedding vectors are sent to the first vector superposition module. In this embodiment, the block division process of the traffic feature matrix block division module is consistent with the noise matrix block division module.

[0073] The first position encoding module is used to generate a position encoding vector p′ with the same dimension as the traffic embedding vector for each traffic feature data block. d and sent to the first vector superposition module;

[0074] The first vector superposition module is used to respectively superimpose the position coding vector p′ d Superimposed on the flow embedding vector z′ d , get the feature vector s′ d = z′ d +p′ d And sent to the Transformer encoder module.

[0075] The Transformer encoder module includes H′ Transformer encoders for D feature vectors s′ d Encode and obtain D encoding features v′ d And sent to the Transformer decoder module. In this embodiment, the Transformer encoder module in the discriminator uses the same number and structure of Transformer encoder modules as those in the generator.

[0076] The encoding feature embedding module embeds D encoding features v′ d Perform linear projection to obtain D encoding embedding vectors z′ d ’ is sent to the second vector superposition module.

[0077] The second position encoding module is used to generate a position encoding vector p′ with the same dimension for each encoding embedding vector. d ' and sent to the second vector superposition module;

[0078] The second vector superposition module is used to respectively superimpose the position coding vector p′ d ′ is superimposed on the flow embedding vector z′ d ′, get the feature vector s′ d ′=z′ d ′+p′ d ’ and sent to the Transformer decoder module.

[0079] The Transformer decoder module consists of H′ Transformer decoders for D encoded features v′ d Decode and obtain the reconstructed features And sent to the splicing module. Figure 5 As shown, the structure of the Transformer decoder module in this embodiment is similar to that of the Transformer encoder module, including a masked multi-head self-attention module, a first feature fusion module, a first layer normalization module, a multi-head self-attention module, a second feature fusion module, a second layer normalization module, a feedforward network, a third feature fusion module and a third layer normalization module, wherein:

[0080] The masked multi-head self-attention module is used to process the input feature matrix f′ using the masked multi-head self-attention mechanism, and send the obtained attention matrix w′ to the first feature fusion module. The masked multi-head self-attention mechanism is almost the same as the standard multi-head self-attention mechanism, the only difference is the masking process of its attention mechanism. That is, in the task of generating sequences, to avoid the model "seeing" future information during generation, an upper triangular mask matrix is ​​used to mask the information of future time steps (tokens). Ensure that the model only pays attention to past time steps when generating the output of the current time step.

[0081] The first feature fusion module is used to superimpose the input feature matrix f′ and the attention matrix w′ to obtain the fused feature a1′ and send it to the first layer normalization module.

[0082] The first-layer normalization module is used to normalize the fused feature a1′, obtain the normalized feature a′2 and send it to the multi-head self-attention module.

[0083] The multi-head self-attention module is used to process the normalized feature a′2 using the multi-head self-attention mechanism, and send the obtained attention matrix w″ to the second feature fusion module.

[0084] The second feature fusion module is used to superimpose the normalized feature a′2 and the attention matrix w″ to obtain the fused feature a3′ and send it to the second layer normalization module.

[0085] The second-layer normalization module is used to normalize the fused feature a3′, obtain the normalized feature a′4 and send it to the feedforward network.

[0086] The feed-forward network is used to perform a mapping operation on the received normalized feature a′4 to obtain feature a5′ and send it to the third feature fusion module.

[0087] The third feature fusion module is used to superimpose the normalized feature a′4 and the feature a5′ to obtain the fused feature a′6 and send it to the third-layer normalization module.

[0088] The third-layer normalization module is used to normalize the fused feature a′6 to obtain the normalized feature and output it as the result of the current Transformer decoder.

[0089] The concatenation module is used to reconstruct D features The concatenation is performed to obtain feature V and sent to the discriminator output module.

[0090] The discriminator output module is used to process the feature V to obtain the score Score of the input traffic feature vector being the real traffic. In this embodiment, the discriminator output processing module includes a cascaded fully connected layer and a Softmax layer, so the score can be expressed by the following formula:

[0091] Score = softmax(FC(V))

[0092] S103: Training Transformer Generative Adversarial Network:

[0093] The training sample set obtained in step S1 is used to train the Transformer generative adversarial network constructed in step S2 to obtain a trained Transformer generative adversarial network. The training method is:

[0094] First, the generator and discriminator are trained alternately using the generative adversarial network training method. Then, the parameters of the generator and discriminator are fixed and the encoder is trained.

[0095] In order to improve the training effect of the Transformer generative adversarial network, this embodiment improves the calculation method of the loss function and enhances the training stability of the network through the gradient penalty mechanism. Traditional generative adversarial networks may encounter the problem of gradient disappearance or explosion during training, resulting in difficulty in model convergence or unsatisfactory generation results. To solve this problem, this embodiment generates new samples by interpolating between real samples and generated samples, and calculates the gradient of the discriminator for these interpolated samples, thereby introducing a gradient penalty term and optimizing the calculation of the loss function. In this embodiment, the discriminator loss function L D The specific calculation method is:

[0096] For each real traffic feature matrix F in the current training batch i And the generated traffic feature matrix generated by the Transformer generative adversarial network i=1,2,…,B, B represents the number of samples in the training batch, and a weight matrix is ​​randomly generated. The value range of each element is [0,1]. Through this weight, linear interpolation is performed between the real sample and the generated sample to obtain the interpolated traffic feature matrix F i,in :

[0097]

[0098] Each interpolation flow characteristic matrix F i,in Input the discriminator and get the corresponding score Score(F i,in ) and calculate its corresponding gradient Thus, the gradient vector ▽Score is obtained, and then the gradient penalty term gp is calculated using the following formula:

[0099]

[0100] Among them, 2 means to obtain the L2 norm.

[0101] The design goal of the gradient penalty (gp) is to make the gradient norm of the discriminator close to 1, thereby ensuring the smoothness of the gradient.

[0102] The discriminator loss L is calculated using the following formula: D :

[0103]

[0104] Among them, Score(F i ), Represent the real traffic feature matrix F i And generate the traffic feature matrix is the discriminant score of , ρ is a hyperparameter used to adjust the weight of the gradient penalty term, and ρ is 10 in this embodiment.

[0105] Generator loss L G The calculation formula is:

[0106]

[0107] In this embodiment, the loss function L E The calculation method is:

[0108]

[0109] Among them, L i,img Represents the real traffic feature matrix F i And generate the traffic feature matrix The difference loss in this embodiment MSE() means to obtain the mean square error, L i,feat Represents the real traffic feature matrix F i Discriminant scores and generated traffic feature matrix The difference loss between the discriminant scores, in this embodiment τ represents a hyperparameter used to adjust the discriminant score difference loss. In this embodiment, τ is set to 1.

[0110] S104: Network traffic detection:

[0111] For the network traffic to be detected, the same method in step S101 is used to generate the traffic feature matrix F′, and then it is input into the trained Transformer generative adversarial network in step S103 to generate a two-dimensional traffic feature matrix Then calculate the two-dimensional flow characteristic matrix F′ and the two-dimensional flow characteristic matrix If the difference value dif is greater than the preset difference value threshold T, the network traffic is abnormal network traffic, otherwise it is normal network traffic.

[0112] Figure 6 Schematic diagram of calculating the difference value in this embodiment. Figure 6 As shown, in this embodiment, the encoder loss function is used as the difference value dif, that is, the difference value dif is calculated using the following method:

[0113] dif=L i ' mg +τ×L′ feat

[0114] Among them, L i ' mg Represents the real traffic feature matrix F′ and the generated traffic feature matrix The difference between the two, MSE() means to obtain the mean square error, L feat Represents the real traffic feature matrix F′ discriminant score and generated traffic feature matrix The difference between the discriminant scores. τ′ represents a hyperparameter used to adjust the difference in the discriminant scores.

[0115] In this embodiment, the difference value threshold T is determined by the following method:

[0116] In addition, several flow data are collected when the network is in an attack state. The attack state can be set according to actual needs. In this embodiment, the attack state includes DoS / DDoS attack, port scanning attack, and Web attack. The same method in step S101 is used to generate a flow feature matrix for each flow data in the attack state. The flow feature matrix under normal operation and the flow feature matrix under attack are respectively input into the Transformer Generative Adversarial Network, and the difference value dif corresponding to each flow feature matrix is ​​calculated. The threshold with the highest judgment accuracy of the two types of flow feature matrices is searched and used as the final difference value threshold T.

[0117] In order to illustrate the technical effect of the present invention, a specific example is used to experimentally verify the present invention. In this embodiment, the CIC-IDS-2017 dataset is used, which is released by the Canadian Institute for Cyber ​​Security and simulates a real enterprise network environment, including multiple clients and servers. Traffic collection covers multiple protocols and services, making it close to real-life scenarios. The dataset contains a variety of known network attack types, including but not limited to: FTP and SSH brute force cracking, DoS and DDoS, Web attacks and Heartbleed attacks, etc.

[0118] First, the data set is preprocessed. In this embodiment, after data clarification and feature selection, the most important feature items of 78 dimensions are finally retained and normalized. The normalized data is replicated 5 times to form a one-dimensional feature vector of 390 length, and then the one-dimensional feature vector is padded with 0 to a length of 400 and converted into a 20*20 two-dimensional feature matrix. Finally, the preprocessed data is divided into training set, validation set and test set according to 7:2:1, and the training set is used to train the transformer-based generative adversarial network.

[0119] During training, all normal data is used for training, and during validation and testing, both normal and abnormal data are used for testing. The validation set is used for model validation, and the score of each piece of data is recorded. Finally, the F1-score is used as a reference to search for the best scoring threshold, which is used as the dividing line between normal data and abnormal data. Data above this threshold is normal data, and data below this threshold is abnormal data.

[0120] In this embodiment, three existing network intrusion detection methods are used as comparison methods to compare and verify with the present invention, namely:

[0121] MSCNN-LSTM-AE: For details, please refer to the document "Abou El Houda Z, Senhaji Hafid A, KhoukhiL.A novel unsupervised learning method for intrusion detection in software-defined networks[M] / / Computational Intelligence in Recent CommunicationNetworks.Cham: Springer International Publishing, 2021:103-117."

[0122] FID-GAN: For details, see the paper "Singh A, Jang-Jaccard J. Autoencoder-based unsupervised intrusion detection using multi-scale convolutional recurrent networks[J].arXiv preprint arXiv:2204.03779,2022."

[0123] IDS-IF: For details, please refer to the document "de Araujo-Filho PF, Naili M, Kaddoum G, etal. Unsupervised gan-based intrusion detection system using temporal convolutional networks and self-attention[J]. IEEE Transactions on Network and Service Management, 2023, 20(4): 4951-4963."

[0124] In the performance evaluation of network intrusion detection methods, commonly used evaluation indicators include accuracy, recall, precision, F1-score and area under the curve (AUC). These indicators can fully reflect the effect of the model in detecting network attacks. In practical applications, Recall is mainly used as the basis, which can truly reflect whether there is any abnormal data missed. Table 1 is a comparison table of evaluation indicators of the method of the present invention and the other three methods in this embodiment.

[0125]

[0126]

[0127] Table 1

[0128] As shown in Table 1, the method of the present invention performs well in recall rate, up to 0.995, which is significantly better than other methods, which means that it is very capable in detecting attacks and can effectively identify almost all attacks. However, the precision rate is 0.912, which is slightly lower than the IDS-IF method, which means that there is a certain risk of false positives. Overall, the F1 score is 0.952, indicating that this method can maintain a good balance while accurately detecting attacks, and is a detection method that is very suitable for scenarios with extremely high security requirements.

[0129] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A network traffic anomaly detection method based on Transformer generative adversarial network, characterized in that: The following steps are involved: S1: Collect some traffic data under the normal operation of the communication network to obtain a traffic data set; extract N eigenvalues ​​of each traffic data respectively to obtain a traffic feature vector X = [x1, x2, ..., x N ], where x n represents the nth eigenvalue, n = 1, 2, ..., N; the flow feature vector X is copied M times to obtain an extended vector of length M × N, which is then converted into a flow feature matrix Where H and W represent the height and width of the matrix respectively, and C represents the number of channels; the traffic feature matrix corresponding to each traffic data is used as a training sample to form a training sample set; S2: Construct a Transformer generative adversarial network, including an encoder, a generator, and a discriminator, where: The encoder is used to calculate the flow characteristic matrix Encode and get the noise matrix and sent to the generator; The generator is used to generate the reconstructed traffic feature matrix according to the noise matrix Z generated by the encoder And sent to the discriminator; the generator includes a noise matrix block module, a position encoding module, a vector superposition module, a Transformer encoder module and a generator output module, where: The noise matrix block module is used to divide the noise matrix Divide it into multiple non-overlapping noise data blocks of fixed size, flatten each noise data block into a vector, and then embed the noise vector into a fixed-dimensional vector space through linear projection to obtain the noise embedding vector z d , d=1,2,…,D, D represents the number of data blocks, and D noise embedding vectors are sent to the vector superposition module; The position encoding module is used to generate a position encoding vector p for each noise data block with the same dimension as the noise embedding vector d And sent to the vector superposition module; The vector superposition module is used to respectively transform the position encoding vector p d Added to the noise embedding vector z d , and get the feature vector s d =z d +p d And sent to the Transformer encoder module; The Transformer encoder module includes H Transformer encoders for D feature vectors s d Encode and obtain the encoding feature v d And sent to the generator output module; The generator output module is used to encode the feature v d Processing is performed to generate a reconstructed traffic feature matrix The discriminator is used to reconstruct the real traffic feature matrix F or the traffic feature matrix Perform discrimination and obtain the discrimination score belonging to the real data; S3: Use the training sample set obtained in step S1 to train the Transformer generative adversarial network constructed in step S2 to obtain a trained Transformer generative adversarial network. The training method is: First, the generator and discriminator are trained alternately using the generative adversarial network training method, and then the parameters of the generator and discriminator are fixed to train the encoder. S4: For the network traffic to be detected, the same method as in step S1 is used to generate the traffic feature matrix F′, and then it is input into the Transformer generative adversarial network trained in step S3 to generate a two-dimensional traffic feature matrix Then calculate the two-dimensional flow characteristic matrix F′ and the two-dimensional flow characteristic matrix If the difference value dif is greater than the preset difference value threshold T, the network traffic is abnormal network traffic, otherwise it is normal network traffic.

2. The network traffic anomaly detection method according to claim 1, characterized in that: The characteristics of the traffic data in step S1 include the source IP address, destination IP address, port number, protocol type, TCP flag, statistical characteristics of the traffic and time characteristics, wherein the statistical characteristics of the traffic include the average size of the packet and the duration of the flow, and the time characteristics include the time interval between packet arrivals and the active time of the flow.

3. The network traffic anomaly detection method according to claim 1, characterized in that: In step S2, the encoder includes a first linear module, a second linear module and a third linear module, wherein: The first linear module includes a cascaded linear transformation layer, a LeakyReLU activation layer, and a Dropout module, which is used to perform linear processing on the traffic feature matrix F to obtain a matrix f1 and send it to the second linear module; The second linear module includes a cascaded linear transformation layer, a LeakyReLU activation layer, and a Dropout module, which is used to perform linear processing on the matrix f1 to obtain the matrix f2 and send it to the third linear module; The third linear module includes a cascaded linear transformation layer and a Tanh activation layer, which is used to perform linear processing on the matrix f2 to obtain a noise matrix Z and output it.

4. The network traffic anomaly detection method according to claim 1, characterized in that: The Transformer encoder in step S2 includes a multi-head self-attention module, a first feature fusion module, a first layer normalization module, a feedforward network, a second feature fusion module and a second layer normalization module, wherein: The multi-head self-attention module is used to process the input feature matrix f using the multi-head self-attention mechanism, and send the obtained attention matrix w to the first feature fusion module; The first feature fusion module is used to superimpose the input feature matrix f and the attention matrix w to obtain the fused feature a1 and send it to the first layer normalization module; The first layer normalization module is used to normalize the fused feature a1, obtain the normalized feature a2 and send it to the feedforward network; The feedforward network is used to perform a mapping operation on the received normalized feature a2 to obtain feature a3 and send it to the second feature fusion module; The second feature fusion module is used to superimpose the normalized feature a2 and the feature a3 to obtain the fused feature a4 and send it to the second layer normalization module; The second-layer normalization module is used to normalize the fused feature a4, obtain the normalized feature and output it as the result of the current Transformer encoder.

5. The network traffic anomaly detection method according to claim 1, characterized in that: The discriminator in step S2 includes a traffic feature matrix block module, a first position encoding module, a first vector superposition module, a Transformer encoder module, a coding feature embedding, a second position encoding module, a second vector superposition module, a Transformer decoder module, a splicing module and a discriminator output module, wherein: The traffic feature matrix block module is used to convert the real traffic feature matrix or reconstruct the two-dimensional traffic feature matrix Divide it into multiple non-overlapping traffic feature data blocks of fixed size, flatten each traffic feature data block into a vector, and then embed the traffic feature vector into a fixed-dimensional vector space through linear projection to obtain the traffic embedding vector z′ d , sending the D traffic embedding vectors to the first vector superposition module; The first position encoding module is used to generate a position encoding vector p′ with the same dimension as the traffic embedding vector for each traffic feature data block. d and sent to the first vector superposition module; The first vector superposition module is used to respectively superimpose the position coding vector p′ d Superimposed on the flow embedding vector z′ d , get the feature vector s′ d = z′ d +p′ d And sent to the Transformer encoder module; The Transformer encoder module includes H′ Transformer encoders for D feature vectors s′ d Encode and obtain D encoding features v′ d And sent to the Transformer decoder module; The encoding feature embedding module embeds D encoding features v′ d Perform linear projection to obtain D encoding embedding vectors z′ d 'Sent to the second vector superposition module; The second position encoding module is used to generate a position encoding vector p′ with the same dimension for each encoding embedding vector. d ' and sent to the second vector superposition module; The second vector superposition module is used to respectively superimpose the position coding vector p′ d ′ is superimposed on the flow embedding vector z′ d ′, get the feature vector s′ d ′=z′ d ′+p′ d ′ and sent to the Transformer decoder module; The Transformer decoder module consists of H′ Transformer decoders for D encoded features v′ d Decode and obtain the reconstructed features And send it to the splicing module; The concatenation module is used to reconstruct D features The feature V is concatenated and sent to the discriminator output module; The discriminant output processing module is used to process the feature V and obtain the score Score of the input traffic feature vector as the real traffic.

6. The network traffic anomaly detection method according to claim 5, characterized in that: The Transformer decoder includes a masked multi-head self-attention module, a first feature fusion module, a first layer normalization module, a multi-head self-attention module, a second feature fusion module, a second layer normalization module, a feedforward network, a third feature fusion module and a third layer normalization module, wherein: The masked multi-head self-attention module is used to process the input feature matrix f′ using the masked multi-head self-attention mechanism, and send the obtained attention matrix w′ to the first feature fusion module; The first feature fusion module is used to superimpose the input feature matrix f′ and the attention matrix w′ to obtain the fused feature a1′ and send it to the first layer normalization module; The first layer normalization module is used to normalize the fused feature a1′, obtain the normalized feature a′2 and send it to the multi-head self-attention module; The multi-head self-attention module is used to process the normalized feature a′2 using the multi-head self-attention mechanism, and send the obtained attention matrix w″ to the second feature fusion module; The first feature fusion module is used to superimpose the normalized feature a′2 and the attention matrix w″ to obtain the fused feature a3′ and send it to the second layer normalization module; The second layer normalization module is used to normalize the fused feature a3′, obtain the normalized feature a′4 and send it to the feedforward network; The feed-forward network is used to perform a mapping operation on the received normalized feature a′4 to obtain the feature a5′ and send it to the third feature fusion module; The third feature fusion module is used to superimpose the normalized feature a′4 and the feature a5′ to obtain the fused feature a′6 and send it to the third layer normalization module; The third-layer normalization module is used to normalize the fused feature a′6 to obtain the normalized feature and output it as the result of the current Transformer decoder.

7. The network traffic anomaly detection method according to claim 1, characterized in that: The loss function calculation method used in the Transformer generative adversarial network training in step S3 is as follows: Discriminator loss function L D The specific calculation method is: For each true traffic feature matrix F in the current training batch i And the generated traffic feature matrix generated by the Transformer generative adversarial network i=1,2,…,B, B represents the number of samples in the training batch, and a weight matrix is ​​randomly generated. The value range of each element is [0,1]. Through this weight, linear interpolation is performed between the real sample and the generated sample to obtain the interpolated traffic feature matrix F i,in : Each interpolation flow characteristic matrix F i,in Input the discriminator and get the corresponding score Score(F i,in ) and calculate its corresponding gradient So we get the gradient vector Then the gradient penalty term gp is calculated using the following formula: Among them, || ||2 means to obtain the L2 norm; The discriminator loss L is calculated using the following formula: D : Among them, Score(F i ), Represent the real traffic feature matrix F i And generate the traffic feature matrix The discriminant score of , ρ is a hyperparameter used to adjust the weight of the gradient penalty term; Generator loss L G The calculation formula is: The loss function L during encoder training E The calculation method is: Among them, L i,img Represents the real traffic feature matrix F i And generate the traffic feature matrix The difference loss, L i,feat Represents the real traffic feature matrix F i Discriminant scores and generated traffic feature matrix The difference loss between the discriminant scores and τ represents the hyperparameter used to adjust the difference loss of the discriminant scores.

8. The network traffic anomaly detection method according to claim 1, characterized in that: The difference value dif in step S4 is calculated using the following method: diff=L′ img +τ′×L′ feat Among them, L′ img Represents the real traffic feature matrix F′ and the generated traffic feature matrix The difference between the two, MSE() means to obtain the mean square error, L feat Represents the real traffic feature matrix F′ discriminant score and generated traffic feature matrix The difference between the discriminant scores, τ′ represents the hyperparameter used to adjust the discriminant score difference.

9. The network traffic anomaly detection method according to claim 1, characterized in that: The difference value threshold T in step S4 is determined by the following method: In addition, some traffic data when the network is in an attack state is collected. The attack state can be set according to actual needs. In this embodiment, the attack state includes DoS / DDoS attack, port scanning attack, and Web attack. The same method in step S1 is used to generate a traffic feature matrix; The traffic feature matrix under normal operation and the traffic feature matrix under attack are respectively input into the Transformer generative adversarial network, and the difference value dif corresponding to each traffic feature matrix is ​​calculated. The threshold with the highest judgment accuracy of the two types of traffic feature matrices is searched and used as the final difference value threshold T.

Images