Adversarial traffic example generation method and system, and computer equipment

Abstract

The invention relates to the technical field of network traffic, in particular to an adversarial traffic example generation method and system and computer equipment. According to the method, attack features are screened by using a weighted value algorithm, core features of original malicious behaviors are reserved, the applicability and authenticity of the generation example in a real energy internet scene are enhanced, overfitting of a discriminator can be inhibited by punishing the gradient, the quality of generation of the antagonistic traffic example is improved, and the generation efficiency of the antagonistic traffic example is improved. The convergence process of training is accelerated, the difference between a forged traffic sample and a real traffic sample is ensured to be gradually reduced by continuously adjusting a generator, so that the generated sample better conforms to the characteristics of the real network traffic, and through the optimization measures, the generated adversarial traffic example not only has high camouflage, but also has high robustness. And original attack behaviors can be reserved, and the confrontation detection performance can be effectively improved through retraining, so that the network security in the energy internet can be better guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of network traffic technology, and in particular to a method, system and computer device for generating adversarial traffic examples. Background Art

[0002] Energy Internet is being deployed in many industries in my country at an accelerated pace. Key infrastructure, production equipment, and control systems in important energy fields such as electricity, coal, oil and gas, and petrochemicals will gradually become networked, digital, and intelligent. Once maliciously attacked, they will cause significant economic losses and even threaten personal safety, posing major security risks to national security. As network traffic becomes increasingly complex, in the field of energy Internet, attackers use adversarial sample attack technology to destroy key energy equipment and network infrastructure. In order to protect the security of energy Internet, the encrypted malicious traffic detection model is retrained by generating adversarial traffic examples.

[0003] At present, the adversarial traffic example generation technology for the Energy Internet still has shortcomings. In the adversarial learning process, the existing adversarial traffic example generation method has a problem that the discriminator is too powerful, which causes it to quickly identify the difference between the generator output and the real sample, thereby forcing the generator to continuously improve the sample quality. This intense competition causes the discriminator to fall into local lag, which in turn affects the training effect and convergence speed of the entire model. Summary of the invention

[0004] The main purpose of the present invention is to provide a method for generating adversarial traffic examples, aiming to solve the technical problems in the prior art.

[0005] The present invention proposes a method for generating adversarial traffic examples, comprising:

[0006] Obtaining a random noise vector and a real traffic sample, and extracting important attack feature data of the real traffic sample;

[0007] Inputting the random noise vector into a generator to obtain normal traffic characteristic data;

[0008] The normal traffic feature data and the important attack feature data are combined to obtain a forged traffic sample;

[0009] Performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample;

[0010] Obtaining a gradient penalty item according to the real traffic sample and the forged traffic sample;

[0011] Obtaining a total loss according to the forged traffic sample, the adversarial traffic sample, and the real traffic sample, and determining whether the total loss is greater than a preset loss;

[0012] If the total loss is greater than the preset loss, the forged traffic sample is determined to be real traffic;

[0013] If the total loss is not greater than the preset loss, the process returns to the step of inputting the random noise vector into the generator to obtain normal flow characteristic data until the total loss is greater than the preset loss.

[0014] Preferably, the step of extracting important attack features of the network traffic includes:

[0015] Acquire all traffic characteristics of the network traffic, and acquire multiple attack characteristics according to all traffic characteristics;

[0016] Obtaining a corresponding predicted marginal contribution according to each of the attack features and all traffic features;

[0017] Dividing all traffic features evenly into multiple traffic sample subsets, and obtaining a corresponding average marginal contribution according to each of the attack features and traffic sample subsets;

[0018] Obtaining a weight value of each attack feature according to the plurality of average marginal contributions and predicted marginal contributions;

[0019] Sorting the plurality of weight values ​​in order of magnitude to obtain a weight sorting table;

[0020] Setting a split value, and splitting the weight values ​​in the weight ranking table that are greater than the split value, to obtain an important weight value table;

[0021] The attack feature corresponding to each weight value in the important weight value table is marked as an important attack feature.

[0022] Preferably, the step of obtaining the corresponding average marginal contribution according to each of the attack features and the traffic sample subset comprises:

[0023] Inputting each of the traffic sample subsets into a gradient boosting model to obtain a first prediction value;

[0024] Replacing the characteristic data in each of the traffic sample subsets with each of the attack characteristics to obtain a replaced traffic sample;

[0025] Input each replacement traffic sample into the gradient boosting model to obtain a second prediction value;

[0026] Obtaining a corresponding marginal contribution according to each of the second predicted value and the first predicted value;

[0027] The average marginal contribution is calculated based on the plurality of marginal contributions, wherein the calculation formula is:

[0028]

[0029] Among them, P(G) k represents the kth average marginal contribution, J(B) k represents the kth marginal contribution, k represents the ordinal number of the marginal contribution, and N represents the number of marginal contributions.

[0030] Preferably, the step of obtaining a gradient penalty term according to the real traffic sample and the forged traffic sample comprises:

[0031] Acquire a random interpolation coefficient table, wherein the random interpolation coefficient table includes a plurality of interpolation coefficients arranged in order of magnitude;

[0032] The corresponding interpolation sample is calculated according to each of the interpolation coefficients, the real traffic sample and the forged traffic sample, wherein the calculation formula is:

[0033] C(YB) i =α i *Z(Y)+(1-α i )W(Y);

[0034] Among them, C(YB) i represents the i-th interpolation sample, α i represents the i-th interpolation coefficient, i represents the serial number of the interpolation coefficient, Z(Y) represents the real traffic sample, and W(Y) represents the forged traffic sample;

[0035] Obtaining an interpolation expected value according to the average of a plurality of the interpolation samples;

[0036] Input each of the interpolation samples into the discriminator to obtain a corresponding interpolation output, and obtain a gradient of each of the interpolation outputs relative to the corresponding interpolation sample;

[0037] Calculate the L2 norm of each gradient to obtain the sum of squared gradients;

[0038] The gradient penalty term is calculated according to the interpolation expected value and multiple gradient square sums, wherein the calculation formula is:

[0039]

[0040] Among them, T(C) represents the gradient penalty term, λ represents the weight parameter of the penalty term, C(Q) represents the interpolation expected value, represents the i-th gradient, D(C(YB) i ) represents the i-th interpolation output, C(YB) i represents the i-th interpolation sample.

[0041] Preferably, the step of obtaining the total loss according to the forged traffic sample, the adversarial traffic sample and the real traffic sample comprises:

[0042] Obtaining a forged sample expected value according to the forged traffic sample, and obtaining a forged sample loss according to the forged sample expected value;

[0043] Performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample;

[0044] Acquire an adversarial sample expected value according to the adversarial traffic sample, and acquire a real sample expected value according to the real traffic sample;

[0045] Obtaining adversarial sample loss according to the adversarial sample expected value, and obtaining real sample loss according to the real sample expected value;

[0046] The total loss is obtained according to the gradient penalty term, the real sample loss, the forged sample loss and the adversarial sample loss.

[0047] Preferably, the step of obtaining the adversarial sample loss according to the adversarial sample expected value and obtaining the real sample loss according to the real sample expected value comprises:

[0048] Obtain an adversarial traffic sample, and input the adversarial traffic sample into the discriminator to obtain the true probability of the adversarial sample;

[0049] The adversarial sample loss is calculated according to the adversarial sample expected value and the adversarial sample true probability, where the calculation formula is:

[0050] D(Y)=D(QW)*[log(1-D(YG))];

[0051] Among them, D(Y) represents the adversarial sample loss, D(QW) represents the expected value of the adversarial sample, and D(YG) represents the true probability of the adversarial sample;

[0052] Obtain a real traffic sample, and input the real traffic sample into the discriminator to obtain a real probability of the real sample;

[0053] The real sample loss is calculated according to the real sample expected value and the real sample true probability, wherein the calculation formula is:

[0054] Z(Y)=Z(QW)*logZ(YG);

[0055] Among them, Z(Y) represents the true sample loss, Z(QW) represents the true sample expected value, and Z(YG) represents the true probability of the true sample.

[0056] The present application also provides a system for generating adversarial traffic examples, including:

[0057] A first acquisition module is used to acquire a random noise vector and a real traffic sample, and extract important attack feature data of the real traffic sample;

[0058] An input module, used for inputting the random noise vector into a generator to obtain normal traffic characteristic data;

[0059] A splicing module, used for splicing and fusing the normal traffic feature data and the important attack feature data to obtain a forged traffic sample;

[0060] A training module, used for performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample;

[0061] A second acquisition module is used to obtain a gradient penalty item according to the real traffic sample and the forged traffic sample;

[0062] A third acquisition module is used to obtain a total loss according to the forged traffic sample, the adversarial traffic sample and the real traffic sample;

[0063] A judgment module, used to judge whether the total loss is greater than a preset loss;

[0064] If the total loss is greater than the preset loss, the forged traffic sample is determined to be real traffic;

[0065] If the total loss is not greater than the preset loss, the process returns to the step of inputting the random noise vector into the generator to obtain normal flow characteristic data until the total loss is greater than the preset loss.

[0066] Preferably, the first acquisition module includes:

[0067] A first acquisition unit, configured to acquire all traffic features of the network traffic, and acquire a plurality of attack features according to all traffic features;

[0068] A second acquisition unit, configured to acquire a corresponding predicted marginal contribution according to each of the attack features and all traffic features;

[0069] A division unit, used to divide all traffic features into multiple traffic sample subsets on average, and obtain a corresponding average marginal contribution according to each of the attack features and traffic sample subsets;

[0070] A third acquisition unit, configured to acquire a weight value of each attack feature according to the plurality of average marginal contributions and predicted marginal contributions;

[0071] A sorting unit, used to sort the plurality of weight values ​​in order of magnitude to obtain a weight sorting table;

[0072] A segmentation unit, used for setting a segmentation value, and segmenting the weight values ​​in the weight ranking table that are greater than the segmentation value to obtain an important weight value table;

[0073] The marking unit is used to mark the attack feature corresponding to each weight value in the important weight value table as an important attack feature.

[0074] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned adversarial traffic example generation method when executing the computer program.

[0075] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned adversarial traffic example generation method are implemented.

[0076] The beneficial effects of the present invention are as follows: the present invention significantly improves the effect of generating adversarial traffic examples in the energy internet through multiple key optimizations, retains the core features of the original malicious behavior by using a weight value algorithm to evaluate and screen attack features, and enhances the applicability and authenticity of the generated examples in real energy internet scenarios. By penalizing the gradient, the overfitting of the discriminator can be suppressed, the adversarial balance between the generator and the discriminator can be maintained, and one party can be prevented from being too strong or too weak, thereby promoting a benign interaction between the generator and the discriminator, and can effectively capture the key information in the traffic sequence, further improve the quality of generating adversarial traffic examples, and accelerate the convergence process of training. The stability of the model is also improved. By continuously adjusting the generator, the difference between the forged traffic samples and the real traffic samples is ensured to gradually decrease, so that the generated samples are more in line with the characteristics of real network traffic. This high-fidelity adversarial traffic example can more realistically reflect the pattern of the original attack behavior. Through these optimization measures, the generated adversarial traffic examples are not only highly disguised, but also can retain the original attack behavior, and effectively improve the adversarial detection performance through retraining, thereby providing stronger protection for network security in the energy Internet. The present invention has a high practical application value and can provide personalized and accurate network security services for the energy Internet, and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 The figure is a schematic diagram of a method flow according to an embodiment of the present invention.

[0078] Figure 2 FIG. 1 is a schematic diagram of a device structure according to an embodiment of the present invention.

[0079] Figure 3 A schematic diagram of the internal structure of a computer device according to an embodiment of the present application.

[0080] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0081] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0082] like Figure 1-Figure 3 As shown, the present application provides a method for generating adversarial traffic examples, comprising:

[0083] S1. Obtain a random noise vector and a real traffic sample, and extract important attack feature data of the real traffic sample;

[0084] S2. Input the random noise vector into a generator to obtain normal traffic characteristic data;

[0085] S3, performing feature splicing and fusion on the normal traffic feature data and the important attack feature data to obtain a forged traffic sample;

[0086] S4, performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample;

[0087] S5. Obtain a gradient penalty item according to the real traffic sample and the forged traffic sample;

[0088] S6. Obtaining a total loss according to the forged traffic sample, the adversarial traffic sample, and the real traffic sample;

[0089] S7, determining whether the total loss is greater than a preset loss;

[0090] If the total loss is greater than the preset loss, the forged traffic sample is determined to be real traffic;

[0091] If the total loss is not greater than the preset loss, the process returns to the step of inputting the random noise vector into the generator to obtain normal flow characteristic data until the total loss is greater than the preset loss.

[0092] As described in the above steps S1-S7, as network traffic becomes increasingly complex, in the field of energy Internet, attackers use adversarial sample attack technology to destroy key energy equipment and network infrastructure. In order to protect the security of energy Internet, adversarial traffic examples are generated to retrain the encrypted malicious traffic detection model. At present, the adversarial traffic example generation technology for energy Internet still has shortcomings. During the training process, the existing adversarial traffic example generation method fails to maintain an effective adversarial balance between the generator and the discriminator, resulting in the generated adversarial examples ignoring the potential contextual dependencies between feature sequences and making it difficult to retain the pattern characteristics of the original traffic sequence, thereby reducing the misleading ability of the generated samples and affecting the success rate of the attack. The present invention obtains random noise vectors and real traffic samples, extracts important attack feature data of the real traffic samples, inputs the random noise vectors into a generator to obtain normal traffic feature data, and performs feature splicing and fusion of the normal traffic feature data and the important attack feature data to obtain forged traffic samples. In traditional adversarial traffic generation methods, the generator and the discriminator may not maintain an effective adversarial balance, resulting in the generated adversarial examples ignoring the potential contextual dependencies in the traffic sequence. Contextual dependencies refer to the mutual relationships and sequential information between various features in the traffic data, which is crucial to the success rate of the attack. By introducing the splicing and fusion of normal traffic and attack features, the new generative model can better capture and retain this contextual information and improve the quality of the generated adversarial examples. By means of feature splicing, the generated forged traffic samples can better retain the pattern characteristics of normal traffic and the key features of the attack. This fusion enables the generator to pay more attention to the patterns and regularities in the original traffic when generating forged traffic samples, avoiding the distortion of the adversarial examples in the traditional methods. The generated forged traffic samples can contain the key information of both real traffic and attack traffic during the feature splicing and fusion process, thereby improving the ability of these samples to mislead traffic classification models or traffic detection systems. Since the forged traffic not only retains the structure of the real traffic, but also enhances the characteristics of the attack, making them more deceptive, they can Effectively bypass the traffic detection system. Since the generated forged traffic samples can more accurately reflect the characteristics of normal traffic and attack traffic, they can break the normal behavior pattern of the traffic detection system when executed, thereby increasing the probability of successful attack. This method can effectively improve the feasibility and success rate of adversarial attacks in real environments. In the adversarial learning process, the existing adversarial traffic example generation method has a too powerful discriminator, which causes it to quickly identify the difference between the generator output and the real sample, thereby forcing the generator to continuously improve the sample quality. This intense competition causes the discriminator to fall into local lag, which in turn affects the training effect and convergence speed of the entire model. The adversarial traffic samples are obtained by adversarial training on the forged adversarial traffic samples, and the gradient penalty items are obtained according to the real traffic samples and the forged traffic samples.By controlling the gradient of the discriminator, we ensure that it will not be overly biased towards certain specific patterns during adversarial training, but allow the generator more room to adjust the output, thereby balancing the difficulty of training and the ability of the generator. This method helps to avoid the adverse effects of an overly strong discriminator on the training process and provides a more balanced learning dynamic. Through adversarial training, the generator and the discriminator are usually in a game relationship. The goal of a typical GAN ​​(generative adversarial network) model is to make the generator generate fake samples that are difficult for the discriminator to distinguish, while the discriminator strives to identify fake samples. The gradient penalty term is usually used to constrain the gradients of the generator and the discriminator to avoid the instability of the training process caused by the excessive gradient of the discriminator. By penalizing the gradient, it can Suppress the overfitting of the discriminator, maintain the confrontational balance between the generator and the discriminator, avoid one side being too strong or too weak, and thus promote a benign interaction between the generator and the discriminator. Since the generator and the discriminator are in a game with each other during the training process, an overly strong discriminator may cause the generator to fall into local lag, resulting in premature convergence of the training process, or the generator cannot effectively improve its sample quality. Through the constraint of gradient penalty, the discriminator will not over-learn the details of the data or make overly extreme judgments on the samples, which can prevent the discriminator from converging to the local optimum too early. Gradient penalty can prevent the model from falling into the local optimum and allow the generator to continue to adjust the generation strategy, thereby improving the robustness and generalization ability of training and increasing the diversity of sample generation. Another significant benefit of introducing the gradient penalty term is that it can speed up the convergence of the model. Since the gradient penalty makes the gradient update more stable during the training process, the generator and the discriminator can be optimized more smoothly and avoid overly intense training fluctuations. This helps to avoid shocks during the training process and reduce the instability caused by excessive game between the generator and the discriminator, thereby speeding up the convergence of the model. The gradient penalty helps to control the size of the gradient and avoid the occurrence of gradient explosion (gradient is too large) or gradient vanishing (gradient is too small), thereby enhancing the stability of the training process. By effectively balancing the training process of the generator and the discriminator, the gradient penalty term helps to improve the quality and diversity of forged adversarial traffic samples. The existing adversarial traffic The example generation method ignores the fidelity of the original malicious behavior, resulting in the difficulty of the generated samples to reflect the characteristics of the original attack behavior in real scenarios, reducing its research value on attack strategies and detection mechanisms in real environments. The total loss is obtained by forged traffic samples, adversarial traffic samples and real traffic samples, and it is determined whether the total loss is greater than the preset loss. If it is greater than the preset loss, the forged traffic sample is determined to be real traffic. If not, it returns to the step of inputting the random noise vector into the generator to obtain normal traffic feature data until the total loss is greater than the preset loss. By continuously adjusting the generator, it is ensured that the difference between the forged traffic sample and the real traffic sample is gradually reduced, so that the generated sample is more in line with the characteristics of real network traffic.This high-fidelity adversarial traffic example can more realistically reflect the pattern of the original attack behavior rather than just "simulating" the attack. The optimized forged traffic samples can better integrate the characteristics of real traffic, so they can more effectively evaluate the performance of existing detection mechanisms in actual network environments. The detection system may show different reactions to the generated high-fidelity samples, which in turn helps researchers more accurately evaluate the robustness of the detection mechanism. By analyzing these adversarial samples, we can deeply understand the evolution path of the attack and the behavioral characteristics of the attacker, and thus develop more effective defense measures on this basis. By continuously tuning the generator, the generated adversarial traffic samples are not only more realistic, but also cover more types of attack behaviors. This can provide more comprehensive attack data and provide different types of defense systems for testing and training. Through this optimization process, the forged traffic samples can better simulate the original malicious behavior. For example, attack traffic may contain certain specific network protocol features, traffic patterns, or abnormal behaviors, which are usually not effectively reflected in existing generation methods. By maximizing the similarity between samples and real traffic samples, the characteristics of malicious behavior can be better preserved, the effectiveness and credibility of generated samples can be improved, and more realistic and complex adversarial traffic samples can be generated, which helps to apply adversarial training technology to real environments. This enables security researchers to use these samples to train and test defense systems, and promote the research and response capabilities for adversarial attacks in the field of network security.

[0093] In one embodiment, the step S1 of extracting important attack features of the network traffic includes:

[0094] S11, obtaining all traffic characteristics of the network traffic, and obtaining multiple attack characteristics according to all the traffic characteristics;

[0095] S12. Obtaining a corresponding predicted marginal contribution according to each of the attack features and all traffic features;

[0096] S13, dividing all traffic features into multiple traffic sample subsets on average, and obtaining a corresponding average marginal contribution according to each of the attack features and traffic sample subsets;

[0097] S14. Calculate the weight value of each attack feature according to the plurality of average marginal contributions and predicted marginal contributions, wherein the calculation formula is:

[0098]

[0099] Among them, Q(Z) t represents the tth weight value, Y(G) t represents the t-th predicted marginal contribution, P(G) trepresents the t-th average marginal contribution, t represents the sequence number of the attack feature, and M represents the number of attack features;

[0100] S15, sorting the plurality of weight values ​​in order of magnitude to obtain a weight sorting table;

[0101] S16, setting a split value, and splitting the weight values ​​in the weight ranking table that are greater than the split value to obtain an important weight value table;

[0102] S17: Mark the attack feature corresponding to each weight value in the important weight value table as an important attack feature.

[0103] As described in the above steps S11-S17, the present invention obtains all traffic features of network traffic, and obtains multiple attack features based on all traffic features, obtains corresponding predicted marginal contributions based on each attack feature and all traffic features, divides all traffic features into multiple traffic sample subsets on average, and obtains corresponding average marginal contributions based on each attack feature and traffic sample subset, and then calculates the weight value of each attack feature based on multiple average marginal contributions and predicted marginal contributions, sorts multiple weight values ​​in order of size to obtain a weight sorting table, and divides the weight values ​​in the weight sorting table that are greater than the split value to obtain an important weight value table, and marks the attack feature corresponding to each weight value in the important weight value table as an important attack feature, wherein, The predicted marginal contribution refers to the incremental contribution of a feature or input variable to the final prediction result under a given model. The average marginal contribution is the average of the predicted marginal contributions of all features or input variables. In traditional adversarial traffic generation methods, the generator may ignore the contextual dependencies between traffic features, resulting in the generated adversarial examples not having the pattern characteristics of real traffic. Therefore, the structural information of the traffic sequence may be lost, which in turn affects the effectiveness of the adversarial samples. By calculating the marginal contribution of each traffic feature and dividing these features into subsets, it can help capture the potential contextual relationship between traffic features, thereby generating more practically misleading adversarial examples. This method calculates the average marginal contribution and Predicting marginal contributions can help the generator avoid overfitting certain features during training and ignoring the potential attack effects of other key features. By calculating the weight of each attack feature and sorting them by importance, the generator can more effectively adjust the attack strategy to make the generated adversarial examples more aggressive while maintaining similarity to real traffic, thereby increasing the difficulty of the discriminator and enhancing the generator's adversarial capabilities. By weight sorting and segmentation, the most influential attack features in adversarial traffic generation can be identified and marked, which can not only help attackers understand more accurately which traffic features play a key role in the success of the attack, but also help defenders focus on the most important attack paths or features in their defense strategies. Ultimately, this feature selection can improve the efficiency of generating adversarial examples and help build a more robust security protection system. By performing marginal contribution analysis on multiple traffic sample subsets, it can ensure that the generated adversarial examples can maintain misleading capabilities under different traffic modes. The identification and utilization of important attack features enable adversarial examples to accurately manipulate the key features of traffic while reducing dependence on other unimportant features, thereby achieving a higher success rate when disrupting the defense system. This is because adversarial samples can better simulate the structural characteristics of real traffic, and the selection and weight calculation methods of attack features help to accurately locate the features that have the greatest impact on the system. Therefore, these adversarial samples will be more misleading in actual attacks, increasing the success rate of attacks.This means that attackers can use these methods to more effectively bypass the defense system, increase the probability of successful attacks, and evenly divide traffic features and calculate marginal contributions, which helps to finely segment the entire traffic space, thereby reducing the computing resources required in the process of generating adversarial samples, speeding up the generation speed, reducing the amount of calculation, and improving the efficiency of the attack.

[0104] In one embodiment, the step S13 of obtaining the corresponding average marginal contribution according to each of the attack features and the traffic sample subset includes:

[0105] S131, inputting each of the traffic sample subsets into a gradient boosting model to obtain a first prediction value;

[0106] S132, replacing the characteristic data in each of the traffic sample subsets with each of the attack characteristics to obtain a replaced traffic sample;

[0107] S133, inputting each replacement flow sample into the gradient boosting model to obtain a second prediction value;

[0108] S134, obtaining a corresponding marginal contribution according to each of the second predicted value and the first predicted value;

[0109] S135. Calculate an average marginal contribution based on the plurality of marginal contributions, wherein the calculation formula is:

[0110]

[0111] Among them, P(G) k represents the kth average marginal contribution, J(B) k represents the kth marginal contribution, k represents the ordinal number of the marginal contribution, and N represents the number of marginal contributions.

[0112] As described in the above steps S131-S135, the present invention obtains a first prediction value by inputting each traffic sample subset into the gradient boosting model, obtains a replacement traffic sample by replacing the feature data in each of the traffic sample subsets with each of the attack features, and then inputs each replacement traffic sample into the gradient boosting model to obtain a second prediction value, and then obtains the corresponding marginal contribution according to each second prediction value and the first prediction value, and calculates the average marginal contribution according to multiple marginal contributions. The traditional adversarial traffic generation method may ignore the contextual relationship between features, resulting in the generated traffic examples not having an actual traffic pattern in the sequence structure. By replacing the attack features and calculating the difference in the predicted values ​​of each traffic sample subset under the original and replaced traffic samples, the specific impact of each feature on the traffic pattern can be effectively captured. The gradient boosting model can evaluate the importance of the feature according to its contribution, and help the generator take into account the dependency between features when generating adversarial samples, thereby retaining the pattern characteristics of the original traffic sequence, which helps to improve the "naturalness" of the adversarial sample, making it more misleading and increasing the success rate of the attack. In the traditional training process, the generator may overfit certain features and ignore other features, resulting in the generated adversarial samples being difficult to be discriminated by the discriminator.By calculating the marginal contribution of traffic samples based on the gradient boosting model, we can accurately understand the impact of each attack feature on the final judgment result and guide the generator to adjust the sample generation process more accurately. This method helps the generator better balance the adversarial process, avoid "over-adversarial" a specific feature, and enhance the aggressiveness and diversity of the generated adversarial samples. By replacing the attack features and calculating the corresponding predicted value differences (i.e., marginal contributions), we can clarify which attack features have the greatest impact on the model prediction results. This feature importance-based analysis helps to design more effective attack strategies from the attacker's perspective. Important attack features can be highlighted and optimized to increase the misleading ability of generated samples. For defense systems, this method provides valuable information that can help defenders identify potential weaknesses and improve the robustness of defense models. According to the predicted value differences of traffic samples under different feature combinations, the calculated marginal contribution reflects the importance of each feature to the model decision. The adversarial samples generated in this way can accurately manipulate the adversarial features to improve the misleading ability of adversarial samples. This method enables the generated traffic samples to deviate from The distribution of normal traffic, while retaining sufficient authenticity and aggressiveness, thereby increasing the success rate of the attack, especially in a complex detection environment. By calculating the marginal contribution of multiple traffic samples and finally obtaining the average marginal contribution of each feature, the generator can be effectively guided to select important features for optimization when generating adversarial samples. Compared with traditional random or heuristic generation methods, this marginal contribution-based optimization method can find effective attack feature combinations more quickly, thereby improving the efficiency of generating adversarial samples and the success rate of the attack. By using the gradient boosting model for marginal contribution calculation, the generation method can adapt to different types of traffic data and attack scenarios, and flexibly adjust the attack strategy, which enables the generated adversarial samples to play a better role in different network environments and attack targets. Based on the marginal contribution analysis method of the gradient boosting model, the generated adversarial samples can more realistically reflect the attacker's behavior pattern, making it more confusing and misleading in the actual network. These generated adversarial samples can not only be used for adversarial training, but also for evaluating and optimizing existing defense systems, thereby providing more realistic samples for practical applications in the field of network security.

[0113] In one embodiment, the step S5 of obtaining a gradient penalty term according to the real traffic sample and the forged traffic sample includes:

[0114] S51, obtaining a random interpolation coefficient table, wherein the random interpolation coefficient table includes a plurality of interpolation coefficients arranged in order of magnitude;

[0115] S52. Calculate a corresponding interpolation sample according to each of the interpolation coefficients, the real traffic sample, and the forged traffic sample, wherein the calculation formula is:

[0116] C(YB) i =α i *Z(Y)+(1-α i )W(Y);

[0117] Among them, C(YB) i represents the i-th interpolation sample, α i represents the i-th interpolation coefficient, i represents the serial number of the interpolation coefficient, Z(Y) represents the real traffic sample, and W(Y) represents the forged traffic sample;

[0118] S53, obtaining an interpolation expected value according to the average of the plurality of interpolation samples;

[0119] S54, inputting each of the interpolation samples into a discriminator to obtain a corresponding interpolation output, and obtaining a gradient of each of the interpolation outputs relative to the corresponding interpolation sample;

[0120] S55, calculating the L2 norm of each gradient to obtain the sum of squares of the gradients;

[0121] S56, calculating a gradient penalty term according to the interpolation expected value and a plurality of gradient square sums, wherein the calculation formula is:

[0122]

[0123] Among them, T(C) represents the gradient penalty term, λ represents the weight parameter of the penalty term, C(Q) represents the interpolation expected value, represents the i-th gradient, D(C(YB) i ) represents the i-th interpolation output, C(YB) i represents the i-th interpolation sample.

[0124] As described in the above steps S51-S56, the present invention obtains a random interpolation coefficient table including a plurality of interpolation coefficients arranged in order of size, and calculates a corresponding interpolation sample according to each interpolation coefficient, a real traffic sample and a forged traffic sample, obtains an interpolation expected value by the mean of a plurality of interpolation samples, inputs each interpolation sample into the discriminator to obtain a corresponding interpolation output, obtains the gradient of each interpolation output relative to the corresponding interpolation sample, calculates the L2 norm of each gradient to obtain the sum of squared gradients, and then calculates a gradient penalty term according to the interpolation expected value and a plurality of sums of squared gradients. By introducing an interpolation coefficient and performing a gradient penalty on the generated interpolation sample, the overly powerful influence of the discriminator can be reduced. Specifically, the gradient The penalty term (i.e., the calculation of the sum of squared gradients) can constrain the learning of the discriminator, preventing it from falling into too fast convergence at the local optimal point, but instead prompting the generator to gradually improve the sample quality and stabilize the training process. Due to the game nature of the generator and the discriminator, the training process is often unstable. The samples generated by the generator in the early stage may be of low quality, and the model training is prone to stop at the local optimal solution. The gradient penalty can make the training process of the discriminator smoother by normalizing the gradient (calculation of the L2 norm), thereby prompting the generator to explore in a wider sample space and ultimately generate more realistic and high-quality traffic examples. This method increases the continuity and consistency of the quality of the generator output samples and avoids the discriminator being too powerful. The fierce competition caused by this reduces the instability in training. The calculation of the interpolation expectation and the introduction of the gradient penalty term help prevent the generator from converging to a single mode and increase the diversity of generated samples. In the adversarial training process, an overly strong discriminator may cause the generator to be fixed on a fixed mode too early, resulting in insufficient sample diversity. By processing the mean of the interpolated samples and smoothing the output of the generator through the gradient penalty, the generator can be prompted to better learn a variety of possible sample distributions and improve the diversity of generated samples. A common problem in adversarial training is slow training speed and poor convergence. Especially when there is an imbalance in the adversarial process between the generator and the discriminator, the training may be very slow. By using interpolated samples and gradient The degree penalty term can effectively improve the learning efficiency of the generator, avoid over-learning of the discriminator and too slow optimization of the generator, which can accelerate the overall training process and improve the convergence speed. The gradient penalty term not only helps to combat the over-optimization of the strong discriminator, but also regularizes the training process of the discriminator to prevent it from being overly sensitive to certain small differences. By calculating the L2 norm of the gradients of multiple interpolated samples, the penalty term constrains the change of the gradient, so that the discriminator will not respond too violently when facing the generated samples, thereby helping the generator to more stably generate samples with high quality and diversity, and improve the training efficiency and convergence speed of the entire model, so that the generator can better generate high-quality traffic samples close to real samples.

[0125] In one embodiment, the step S6 of obtaining the total loss according to the forged traffic sample, the adversarial traffic sample and the real traffic sample includes:

[0126] S61, obtaining a forged sample expected value according to the forged traffic sample, and obtaining a forged sample loss according to the forged sample expected value;

[0127] S61, performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample;

[0128] S63, obtaining an adversarial sample expected value according to the adversarial traffic sample, and obtaining a real sample expected value according to the real traffic sample;

[0129] S64, obtaining an adversarial sample loss according to the adversarial sample expected value, and obtaining a real sample loss according to the real sample expected value;

[0130] S65. Calculate the total loss according to the gradient penalty term, the real sample loss, the forged sample loss and the adversarial sample loss, wherein the calculation formula is:

[0131] Z(S)=Z(Y)+W(Y)+D(Y)+T(C);

[0132] Among them, Z(S) represents the total loss, Z(Y) represents the real sample loss, W(Y) represents the forged sample loss, D(Y) represents the adversarial sample loss, and T(C) represents the gradient penalty term.

[0133] As described in the above steps S61-S65, the present invention obtains a forged sample expected value through a forged traffic sample, and obtains a forged sample loss based on the forged sample expected value, obtains an adversarial traffic sample by performing adversarial training on the forged adversarial traffic sample, obtains an adversarial sample expected value through the adversarial traffic sample, obtains an adversarial sample loss based on the adversarial sample expected value, obtains a real sample expected value through a real traffic sample, obtains a real sample loss based on the real sample expected value, and calculates the total loss through the gradient penalty term, the real sample loss, the forged sample loss and the adversarial sample loss. Traditional adversarial sample generation methods, especially in the detection and defense scenarios of network attacks, often ignore the characteristics of the original malicious traffic, resulting in the generated adversarial samples being difficult to detect in real environments. It reflects the real characteristics of the attack behavior. By introducing the expected value calculation of forged traffic samples and real traffic samples, it ensures that the generated adversarial traffic samples can better match the distribution of the original malicious traffic, thereby improving the authenticity of the generated traffic and the fidelity of the attack behavior. By calculating the expected value of forged samples, it can effectively simulate the distribution of attack traffic, making the generated adversarial samples more representative and practical. The expected value of adversarial samples obtained through adversarial training can make the adversarial samples not only adversarial detection systems, but also simulate real attack behaviors. Combined with the expected value of real traffic samples, it ensures that the generated traffic samples conform to the malicious traffic distribution in real scenarios. By simultaneously optimizing the loss functions of forged samples, adversarial samples and real samples, The generated adversarial samples can be made more generalizable and robust. Traditional adversarial training often focuses on "deceiving" the detection system, while ignoring the relationship between the generated samples and the actual attack behavior, which may make the generated samples difficult to play a role in the actual environment. Combining the optimization method of the gradient penalty term and the multi-sample loss function, the training model can generate adversarial samples that not only meet the attack goals but also have high practical significance. By generating adversarial traffic samples, the intrusion detection system or malicious traffic detection system can be effectively trained to improve its ability to cope with real-world attacks. The generated adversarial samples can not only confront the detection system, but also simulate a variety of attack strategies, so that the system can identify and prevent different types of attack behaviors. By combining adversarial flow The loss of large-scale samples, forged samples and real samples can train the detection system more meticulously, making it have higher recognition rate and robustness for different types of attack samples. Generating adversarial samples with real malicious behavior characteristics can help researchers better understand the attacker's attack methods, identify potential vulnerabilities, and design more effective defense strategies. Through the combined training of multiple samples, more diverse attack scenarios can be simulated, and the adaptability and flexibility of attack detection and defense models can be improved. The training method combining forged samples, real samples and adversarial samples can provide richer training data and enhance the training quality of the model. Different types of samples provide diverse attack performances and traffic characteristics, and the model can learn the details of different types of attacks from them.This improves the detection system's ability to identify complex attack patterns. The gradient penalty term can effectively prevent overfitting or poor generation quality during the training process by constraining the gradient of the generated model. The gradient penalty can enhance the stability of the generated model and ensure that the generated adversarial samples can not only successfully "cheat" the detection system, but also maintain the original characteristics of the malicious traffic, thereby ensuring its effectiveness in the real environment.

[0134] In one embodiment, the step S63 of obtaining the adversarial sample loss according to the adversarial sample expected value and obtaining the real sample loss according to the real sample expected value includes:

[0135] S631, obtaining an adversarial traffic sample, and inputting the adversarial traffic sample into a discriminator to obtain a true probability of the adversarial sample;

[0136] S632: Calculate the adversarial sample loss according to the adversarial sample expected value and the adversarial sample true probability, where the calculation formula is:

[0137] D(Y)=D(QW)*[log(1-D(YG))];

[0138] Among them, D(Y) represents the adversarial sample loss, D(QW) represents the expected value of the adversarial sample, and D(YG) represents the true probability of the adversarial sample;

[0139] S633, obtaining a real traffic sample, and inputting the real traffic sample into the discriminator to obtain a real probability of the real sample;

[0140] S634: Calculate the real sample loss according to the real sample expected value and the real sample true probability, wherein the calculation formula is:

[0141] Z(Y)=Z(QW)*logZ(YG);

[0142] Among them, Z(Y) represents the true sample loss, Z(QW) represents the true sample expected value, and Z(YG) represents the true probability of the true sample.

[0143] As described in the above steps S631-S634, the present invention obtains the true probability of the adversarial sample by inputting the adversarial traffic sample into the discriminator, and calculates the adversarial sample loss according to the expected value of the adversarial sample and the true probability of the adversarial sample, obtains the true probability of the real sample by inputting the real traffic sample into the discriminator, and calculates the real sample loss according to the expected value of the real sample and the true probability of the real sample, and inputs the adversarial traffic sample into the discriminator and calculates its true probability, combined with the expected value of the adversarial sample, it is possible to effectively control the difference between the generated sample and the real malicious traffic. This method focuses on the fact that the generated sample can more realistically reflect the original attack behavior, thereby maintaining the characteristics and dynamics of the original malicious behavior. By introducing the true probability and expected value of the real sample, the discriminator can more accurately evaluate the quality of the generated sample, which helps to improve the effectiveness and adaptability of the generated adversarial sample, thereby improving the aggressiveness and usability of the adversarial sample. This means that the generated adversarial sample is more aggressive and can pose sufficient challenges to the real detection system, thereby helping the detection mechanism to better respond to new attack methods. If the generated adversarial sample can better retain the characteristics of the original malicious behavior, it can better integrate with the attack strategy, network in the real environment. This means that researchers can use this adversarial sample to better evaluate the effectiveness of existing defense strategies, especially in complex and dynamic actual network environments. By combining the expected value of real samples and the true probability of generated samples, adversarial samples are more consistent with the distribution of real attack traffic, thereby providing more realistic test data for the research of detection mechanisms. This is important for improving the accuracy of network security protection, reducing false alarm rates, and improving the adaptability of detection systems to new attacks. Using the discriminator to evaluate samples can be used as an important feedback signal in the training of generative models (such as adversarial generative networks GANs, etc.). The loss calculation of adversarial samples and real samples not only helps to improve the generation quality of the generator, but also helps to improve the discriminant ability of the discriminator, thereby making the generation process more robust and improving the generation effect of adversarial samples in complex environments. The key advantage of this method is that it makes its application in real environments more effective by improving the authenticity and fidelity of adversarial samples. The generated adversarial samples can not only better reflect the characteristics of the original malicious traffic, but also provide more representative and challenging test samples for the research of detection mechanisms and the optimization of network security defense.

[0144] In one embodiment, the main reason for the slow convergence speed of generative adversarial training is that non-robust distortion tends to make all samples close to the decision boundary, so even a small distortion can move the adversarial example to the decision boundary and cause misclassification. In contrast, for a robust discriminator, such distortion is expected to be much larger. Based on this, it is proposed to make the discriminator more robust by introducing adversarial attacks, thereby improving the convergence speed and stability during gradient penalty training. The PGD (Projected Gradient Descent) projected gradient descent adversarial attack method is selected as the adversarial attack method for robust training of our discriminator. The PGD attack principle formula is as follows:

[0145]

[0146] Among them, x t+1 represents the next traffic sample, x t represents the current traffic sample, Π x+S is a projection operation used to ensure that the perturbation range of the adversarial sample does not exceed the limit, α is used to control the size of the perturbation in each iteration, and sgn(·) determines the direction of the perturbation. is the gradient of the loss function L(θ,x,y) with respect to the input x. Since PGD is an iterative attack method that generates stronger adversarial samples through multi-step gradient updates and projection operations, PGD can generate stronger perturbations compared to other methods, making the generated adversarial samples more challenging. Therefore, it can effectively test the robustness of the discriminator in the face of strong adversarial samples, and enable the discriminator to adapt to stronger adversarial attacks during training, thereby improving its robustness. The iterative process of PGD simulates more realistic adversarial attack behaviors, and PGD approaches the optimization goal through multiple update steps, which makes the adversarial samples it generates more representative and closer to the strategies adopted by adversaries in reality. This gradual optimization feature can also enable the model to resist various attacks of different intensities during training, thereby improving the defense capabilities of the discriminator. One of the core features of PGD is that it can limit the generated adversarial samples to a predetermined constraint through projection operations. In this way, PGD can generate legitimate adversarial perturbations in the space, approaching the decision boundary of the model without destroying the original structure of the sample. This makes PGD an ideal tool in adversarial training because it can help the model maintain strong robustness within a certain range of perturbations. PGD can better capture the vulnerability of the network by repeatedly updating adversarial samples. Compared with other attack methods, PGD is a multi-step attack based on gradients. Each step adjusts the direction and size of the perturbation so that the adversarial samples generated can better force the discriminator to misclassify. This iterative update process can more effectively find the weak points of the model, improve the effect of adversarial training, and thus improve robustness. Since PGD is an iterative optimization method based on gradients, the adversarial samples it generates not only depend on the selection of the initial perturbation, but also explore more perturbation spaces through multiple iterations. This diverse perturbation space can help the model generalize better and adapt to different types of adversarial samples, thereby improving its robustness in actual deployment.

[0147] The present application also provides a system for generating adversarial traffic examples, including:

[0148] A first acquisition module is used to acquire a random noise vector and a real traffic sample, and extract important attack feature data of the real traffic sample;

[0149] An input module, used for inputting the random noise vector into a generator to obtain normal traffic characteristic data;

[0150] A splicing module, used for splicing and fusing the normal traffic feature data and the important attack feature data to obtain a forged traffic sample;

[0151] A training module, used for performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample;

[0152] A second acquisition module is used to obtain a gradient penalty item according to the real traffic sample and the forged traffic sample;

[0153] A third acquisition module is used to obtain a total loss according to the forged traffic sample, the adversarial traffic sample and the real traffic sample;

[0154] A judgment module, used to judge whether the total loss is greater than a preset loss;

[0155] If the total loss is greater than the preset loss, the forged traffic sample is determined to be real traffic;

[0156] If the total loss is not greater than the preset loss, the process returns to the step of inputting the random noise vector into the generator to obtain normal flow characteristic data until the total loss is greater than the preset loss.

[0157] In one embodiment, the first acquisition module includes:

[0158] A first acquisition unit, configured to acquire all traffic features of the network traffic, and acquire a plurality of attack features according to all traffic features;

[0159] A second acquisition unit, configured to acquire a corresponding predicted marginal contribution according to each of the attack features and all traffic features;

[0160] A division unit, used to divide all traffic features into multiple traffic sample subsets on average, and obtain a corresponding average marginal contribution according to each of the attack features and traffic sample subsets;

[0161] A third acquisition unit, configured to acquire a weight value of each attack feature according to the plurality of average marginal contributions and predicted marginal contributions;

[0162] A sorting unit, used to sort the plurality of weight values ​​in order of magnitude to obtain a weight sorting table;

[0163] A segmentation unit, used for setting a segmentation value, and segmenting the weight values ​​in the weight ranking table that are greater than the segmentation value to obtain an important weight value table;

[0164] The marking unit is used to mark the attack feature corresponding to each weight value in the important weight value table as an important attack feature.

[0165] It should be noted that each module and unit in the adversarial traffic example generation system corresponds one-to-one to the steps in the adversarial traffic example generation method.

[0166] like Figure 3 As shown, the present application also provides a computer device, which may be a server, and its internal structure may be as shown in Figure 3As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store all data required for the process of the adversarial traffic example generation method. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the adversarial traffic example generation method is implemented.

[0167] Those skilled in the art will understand that Figure 3 The structure shown in is merely a block diagram of a portion of the structure related to the present application solution and does not constitute a limitation on the computer device to which the present application solution is applied.

[0168] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, any one of the above-mentioned adversarial traffic example generation methods is implemented.

[0169] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0170] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0171] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

[0172] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0173] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for generating adversarial traffic examples, characterized in that: include: Obtaining a random noise vector and a real traffic sample, and extracting important attack feature data of the real traffic sample; Inputting the random noise vector into a generator to obtain normal traffic characteristic data; The normal traffic feature data and the important attack feature data are combined to obtain a forged traffic sample; Performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample; Obtaining a gradient penalty item according to the real traffic sample and the forged traffic sample; Obtaining a total loss according to the forged traffic sample, the adversarial traffic sample, and the real traffic sample, and determining whether the total loss is greater than a preset loss; If the total loss is greater than the preset loss, the forged traffic sample is determined to be real traffic; If the total loss is not greater than the preset loss, the process returns to the step of inputting the random noise vector into the generator to obtain normal flow characteristic data until the total loss is greater than the preset loss.

2. The method for generating adversarial traffic examples according to claim 1, characterized in that: The step of extracting important attack features of the network traffic includes: Acquire all traffic characteristics of the network traffic, and acquire multiple attack characteristics according to all traffic characteristics; Obtaining a corresponding predicted marginal contribution according to each of the attack features and all traffic features; Dividing all traffic features evenly into multiple traffic sample subsets, and obtaining a corresponding average marginal contribution according to each of the attack features and traffic sample subsets; Obtaining a weight value of each attack feature according to the plurality of average marginal contributions and predicted marginal contributions; Sorting the plurality of weight values ​​in order of magnitude to obtain a weight sorting table; Setting a split value, and splitting the weight values ​​in the weight ranking table that are greater than the split value, to obtain an important weight value table; The attack feature corresponding to each weight value in the important weight value table is marked as an important attack feature.

3. The method for generating adversarial traffic examples according to claim 2, characterized in that: The step of obtaining the corresponding average marginal contribution according to each of the attack features and the traffic sample subset includes: Inputting each of the traffic sample subsets into a gradient boosting model to obtain a first prediction value; Replacing the characteristic data in each of the traffic sample subsets with each of the attack characteristics to obtain a replaced traffic sample; Input each replacement traffic sample into the gradient boosting model to obtain a second prediction value; Obtaining a corresponding marginal contribution according to each of the second predicted value and the first predicted value; The average marginal contribution is calculated based on the plurality of marginal contributions, wherein the calculation formula is: Among them, P(G) k represents the kth average marginal contribution, J(B) k represents the kth marginal contribution, k represents the ordinal number of the marginal contribution, and N represents the number of marginal contributions.

4. The method for generating adversarial traffic examples according to claim 1, characterized in that: The step of obtaining a gradient penalty term according to the real traffic sample and the forged traffic sample comprises: Acquire a random interpolation coefficient table, wherein the random interpolation coefficient table includes a plurality of interpolation coefficients arranged in order of magnitude; The corresponding interpolation sample is calculated according to each of the interpolation coefficients, the real traffic sample and the forged traffic sample, wherein the calculation formula is: C(YB) i =α i *Z(Y)+(1-α i )W(Y); Among them, C(YB) i represents the i-th interpolation sample, α i represents the i-th interpolation coefficient, i represents the serial number of the interpolation coefficient, Z(Y) represents the real traffic sample, and W(Y) represents the forged traffic sample; Obtaining an interpolation expected value according to the average of a plurality of the interpolation samples; Input each of the interpolation samples into the discriminator to obtain a corresponding interpolation output, and obtain the gradient of each of the interpolation outputs relative to the corresponding interpolation sample; Calculate the L2 norm of each gradient to obtain the sum of squared gradients; The gradient penalty term is calculated according to the interpolation expected value and multiple gradient square sums, wherein the calculation formula is: Among them, T(C) represents the gradient penalty term, λ represents the weight parameter of the penalty term, C(Q) represents the interpolation expected value, represents the i-th gradient, D(C(YB) i ) represents the i-th interpolation output, C(YB) i represents the i-th interpolation sample.

5. The method for generating adversarial traffic examples according to claim 1, characterized in that: The step of obtaining the total loss according to the forged traffic sample, the adversarial traffic sample and the real traffic sample comprises: Obtaining a forged sample expected value according to the forged traffic sample, and obtaining a forged sample loss according to the forged sample expected value; Performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample; Acquire an adversarial sample expected value according to the adversarial traffic sample, and acquire a real sample expected value according to the real traffic sample; Obtaining adversarial sample loss according to the adversarial sample expected value, and obtaining real sample loss according to the real sample expected value; The total loss is obtained according to the gradient penalty term, the real sample loss, the forged sample loss and the adversarial sample loss.

6. The adversarial traffic example generation method according to claim 1, characterized in that: The step of obtaining the adversarial sample loss according to the adversarial sample expected value and obtaining the real sample loss according to the real sample expected value comprises: Obtain an adversarial traffic sample, and input the adversarial traffic sample into the discriminator to obtain the true probability of the adversarial sample; The adversarial sample loss is calculated according to the adversarial sample expected value and the adversarial sample true probability, wherein the calculation formula is: D(Y)=D(QW)*[log(1-D(YG))]; Among them, D(Y) represents the adversarial sample loss, D(QW) represents the expected value of the adversarial sample, and D(YG) represents the true probability of the adversarial sample; Obtain a real traffic sample, and input the real traffic sample into the discriminator to obtain a real probability of the real sample; The real sample loss is calculated according to the real sample expected value and the real sample true probability, wherein the calculation formula is: Z(Y)=Z(QW)*logZ(YG); Among them, Z(Y) represents the true sample loss, Z(QW) represents the true sample expected value, and Z(YG) represents the true probability of the true sample.

7. A system for generating adversarial traffic examples, characterized in that: include: A first acquisition module is used to acquire a random noise vector and a real traffic sample, and extract important attack feature data of the real traffic sample; An input module, used for inputting the random noise vector into a generator to obtain normal traffic characteristic data; A splicing module, used for splicing and fusing the normal traffic feature data and the important attack feature data to obtain a forged traffic sample; A training module, used for performing adversarial training on the forged adversarial traffic sample to obtain an adversarial traffic sample; A second acquisition module is used to obtain a gradient penalty item according to the real traffic sample and the forged traffic sample; A third acquisition module is used to obtain a total loss according to the forged traffic sample, the adversarial traffic sample and the real traffic sample; A judgment module, used to judge whether the total loss is greater than a preset loss; If the total loss is greater than the preset loss, the forged traffic sample is determined to be real traffic; If the total loss is not greater than the preset loss, the process returns to the step of inputting the random noise vector into the generator to obtain normal flow characteristic data until the total loss is greater than the preset loss.

8. The adversarial traffic example generation system according to claim 7, characterized in that: The first acquisition module includes: A first acquisition unit, configured to acquire all traffic features of the network traffic, and acquire a plurality of attack features according to all traffic features; A second acquisition unit, configured to acquire a corresponding predicted marginal contribution according to each of the attack features and all traffic features; A division unit, used to divide all traffic features into multiple traffic sample subsets on average, and obtain a corresponding average marginal contribution according to each of the attack features and traffic sample subsets; A third acquisition unit, configured to acquire a weight value of each attack feature according to the plurality of average marginal contributions and predicted marginal contributions; A sorting unit, used to sort the plurality of weight values ​​in order of magnitude to obtain a weight sorting table; A segmentation unit, used for setting a segmentation value, and segmenting the weight values ​​in the weight ranking table that are greater than the segmentation value to obtain an important weight value table; The marking unit is used to mark the attack feature corresponding to each weight value in the important weight value table as an important attack feature.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images