An adversarial traffic generation method based on a deep learning intrusion detection system

Abstract

The application relates to the technical field of network security, and discloses an adversarial traffic generation method based on a deep learning intrusion detection system, which comprises the following steps: obtaining an original network traffic dataset; modifying malicious traffic according to a preset modification rule to obtain modified traffic, and obtaining original adversarial traffic by using a preset generator; determining the gradient loss of the preset generator by using a preset discriminator and a preset proxy classifier according to normal traffic and the original adversarial traffic; repeating the step of obtaining the original adversarial traffic by using the preset generator according to the modified traffic until the gradient loss of the preset generator converges, so that a trained generator is obtained; and obtaining adversarial traffic by using the trained generator according to the modified traffic. The application modifies the malicious traffic in the traffic space, improves the execution efficiency of the adversarial attack, reduces the attack execution cost, simulates the behavior of a black-box intrusion detection by adding the preset proxy classifier, and realizes the generation of the adversarial traffic by using limited knowledge.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a method for generating adversarial traffic based on a deep learning intrusion detection system. Background Technology

[0002] With the rapid development of Industry 4.0, the Internet of Things (IoT) has become ubiquitous in industries such as manufacturing, transportation, power, and energy. The rapid expansion of industrial IoT infrastructure has significantly improved production efficiency and fault tolerance. However, this rapid expansion of the open network environment has triggered a surge in network infrastructure threats, ranging from ransomware to IoT botnets. The ever-changing security landscape of industrial IoT necessitates the development of resilient and robust network intrusion detection systems to effectively detect potential attack threats. In recent years, intrusion detection systems have been widely used in industrial IoT security protection, with machine learning (ML) and deep learning (DL) based intrusion detection systems demonstrating powerful capabilities in traffic feature extraction and intrusion behavior pattern recognition. However, ML / DL models are relatively weak in the face of adversarial attacks and are easily interfered with by malicious attackers, allowing attack data to bypass detection. Such adversarial attacks not only affect the accuracy of detection but also directly threaten the security and stability of industrial IoT. Adversarial attacks are a type of attack method designed to deceive deep learning models by adding carefully designed micro-perturbations to the input data, causing the model to misjudge or even completely fail. To evaluate the robustness of ML / DL model-based systems, a common approach is to construct adversarial attacks to help test the effectiveness of intrusion detection systems and expose weaknesses and blind spots in intrusion detection algorithms. Research on adversarial attacks allows network defenders to understand future attack trends, facilitating the earlier development of new defense strategies and methods.

[0003] When existing adversarial attack techniques are applied in real-world scenarios, they mainly suffer from high attack execution costs and limited knowledge background. At the same time, there is a lack of research on mapping traffic data from feature space to traffic space in the field of intrusion detection, as well as research on adversarial attack methods for deep learning-based intrusion detection systems in traffic space. Summary of the Invention

[0004] In view of this, the present invention provides an adversarial traffic generation method based on a deep learning intrusion detection system to solve the problems of high attack execution cost and limited knowledge background when existing adversarial attack techniques are applied in real-world scenarios.

[0005] In a first aspect, the present invention provides an adversarial traffic generation method based on a deep learning intrusion detection system, the method comprising:

[0006] Obtain the raw network traffic dataset, which includes both normal and malicious traffic;

[0007] The malicious traffic is modified according to the preset modification rules to obtain the modified traffic, and the original countermeasure traffic is obtained based on the modified traffic using the preset generator;

[0008] Based on normal traffic and original adversarial traffic, the gradient loss of the preset generator is determined using a preset discriminator and a preset proxy classifier.

[0009] Repeat the steps of obtaining the original adversarial flow using the preset generator based on the modified flow until the gradient loss of the preset generator converges, and the trained generator is obtained.

[0010] Obtain random noise and input it into the trained generator to obtain a perturbation vector. Add the perturbation vector to the modified flow to obtain the adversarial flow.

[0011] The adversarial traffic generation method based on a deep learning intrusion detection system provided by this invention improves the execution efficiency of adversarial attacks and reduces the attack execution cost by modifying malicious traffic in the traffic space. By adding a preset proxy classifier, it simulates the behavior of black-box intrusion detection to help determine whether the generated adversarial traffic is malicious. It does not require knowledge of the deep learning model parameters or output information of the target intrusion detection, thus realizing the generation of adversarial traffic using limited knowledge.

[0012] In one optional implementation, malicious traffic is modified according to preset modification rules to obtain modified traffic, including:

[0013] Copy the malicious traffic data packets to obtain the traffic to be modified;

[0014] Modify the arrival interval, protocol, and length of data packets in the traffic to be modified to obtain the modified traffic.

[0015] The adversarial traffic generation method based on a deep learning intrusion detection system provided by this invention modifies the copied malicious traffic without destroying the original malicious traffic, ensuring the effectiveness and security of the original malicious traffic, and ensuring that the modified traffic has malicious functionality and executability.

[0016] In one optional implementation, modifying the arrival interval, protocol, and length of data packets in the traffic to be modified to obtain the modified traffic includes:

[0017] Modify the arrival interval of data packets in the traffic to be modified to no greater than the preset interval threshold.

[0018] Set the protocol of the data packets in the traffic to be modified to the default protocol;

[0019] Modify the length of data packets in the traffic to be modified to be no greater than the preset length threshold;

[0020] Traffic to be modified is traffic whose arrival interval is no greater than a preset interval threshold, whose protocol is a preset protocol, and whose length is no greater than a preset length threshold.

[0021] The adversarial traffic generation method based on a deep learning intrusion detection system provided by this invention generates adversarial traffic by effectively modifying three specific fields, maintaining the legitimacy and malicious functionality of the original malicious traffic, and transforming the traffic into a vector containing metadata from the original malicious traffic by changing specific attributes of the original malicious traffic data packet, which facilitates subsequent processing by the generator.

[0022] In one optional implementation, obtaining the original adversarial traffic using a preset generator based on the modified traffic includes:

[0023] Obtain random noise and input the random noise into a preset generator to obtain a perturbation vector;

[0024] The perturbation vector is added to the modified traffic, and the fields of the data packets in the modified traffic are restored to their corresponding preset field values ​​to obtain the original adversarial traffic.

[0025] The adversarial traffic generation method based on a deep learning intrusion detection system provided by this invention adds noise perturbation to the generator input, making the original adversarial traffic generated by the generator more diverse and creative. It restores each field of the data packet in the modified traffic to the corresponding preset field value, ensuring that the adversarial feature vector of the subsequent original adversarial traffic can be correctly extracted. For deep learning models, introducing random or specific forms of noise during the training process can improve the model's resistance to such attacks.

[0026] In one optional implementation, the gradient loss of the preset generator is determined using a preset discriminator and a preset proxy classifier based on normal traffic and original adversarial traffic, including:

[0027] By combining a preset discriminator with normal traffic, the true probability of the original adversarial traffic is determined;

[0028] The normal probability of the original adversarial traffic is determined by using a pre-defined proxy classifier, and the gradient loss of the pre-defined generator is determined by combining the true probability.

[0029] The adversarial traffic generation method based on a deep learning intrusion detection system provided by this invention uses a pre-trained proxy classifier to simulate the behavior of a black-box intrusion detection system, which helps to accurately detect whether the generated adversarial traffic is malicious. In the feature space, the discriminator and the proxy classifier are combined to provide gradient loss information for generator training, thereby improving the high escape success rate of adversarial traffic.

[0030] In one optional implementation, a preset discriminator is used in conjunction with normal traffic to determine the true probability of the original adversarial traffic, including:

[0031] Normal traffic is input into the first feature extractor to extract normal features, and the original adversarial traffic is input into the second feature extractor to extract adversarial features.

[0032] By simultaneously inputting adversarial features and normal features into the discriminator, the true probability of an adversarial feature being identified as a normal feature is obtained.

[0033] The adversarial traffic generation method based on a deep learning intrusion detection system provided by this invention utilizes a discriminator to evaluate the authenticity of normal features and the true probability of adversarial features. The discriminator's discrimination result is used as part of the generator's gradient loss, forming an adversarial relationship with the generator. This helps the generator generate adversarial traffic that is closer to normal traffic, thereby improving the accuracy of adversarial traffic.

[0034] In one optional implementation, a preset proxy classifier is used to determine the normal probability of the original adversarial traffic, and the gradient loss of the preset generator is determined by combining the true probability, including:

[0035] Input the adversarial features into the preset proxy classifier to obtain the normal probability that the original adversarial traffic is normal traffic;

[0036] The classification loss is calculated based on the normal probability of adversarial features being identified as normal traffic by the preset proxy classifier.

[0037] The gradient loss of the preset generator is calculated based on the true probability and the classification loss.

[0038] The adversarial traffic generation method based on a deep learning intrusion detection system provided by this invention involves a feature extractor extracting features from normal traffic and carefully crafted malicious traffic, and then inputting these features into a discriminator and a proxy classifier. The discriminator and the proxy classifier distinguish these traffic in the feature space and obtain the gradient loss of the preset generator. The generator is continuously trained in combination with the gradient loss, so that the generator can generate minimal perturbation to modify malicious traffic, thereby improving the effectiveness of the generator in generating adversarial traffic.

[0039] Secondly, the present invention provides an adversarial traffic generation device based on a deep learning intrusion detection system, the device comprising:

[0040] The raw traffic acquisition module is used to acquire raw network traffic datasets, which include both normal and malicious traffic.

[0041] The traffic modification module is used to modify malicious traffic according to preset modification rules, obtain modified traffic, and use a preset generator to obtain the original countermeasure traffic based on the modified traffic;

[0042] The traffic identification module is used to determine the gradient loss of the preset generator based on normal traffic and original adversarial traffic using a preset discriminator and a preset proxy classifier.

[0043] The generator training module is used to repeatedly obtain the original adversarial flow from the preset generator based on the modified flow until the gradient loss of the preset generator converges, thus obtaining the trained generator.

[0044] The adversarial traffic generation module is used to acquire random noise and input the random noise into a trained generator to obtain a perturbation vector. The perturbation vector is added to the modified traffic to obtain the adversarial traffic.

[0045] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the method described in the first aspect or any corresponding embodiment thereof.

[0046] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to perform the method described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0047] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0048] Figure 1 This is a basic structural diagram based on existing methods for combating DDoS attacks;

[0049] Figure 2 This is a flowchart illustrating an adversarial traffic generation method based on a deep learning-based intrusion detection system according to an embodiment of the present invention.

[0050] Figure 3This is a schematic diagram of the basic components for executing the adversarial traffic generation method based on a deep learning intrusion detection system according to an embodiment of the present invention;

[0051] Figure 4 This is a flowchart illustrating another adversarial traffic generation method based on a deep learning intrusion detection system according to an embodiment of the present invention;

[0052] Figure 5 This is a flowchart illustrating a specific embodiment of an adversarial traffic generation method based on a deep learning intrusion detection system according to an embodiment of the present invention;

[0053] Figure 6 This is a structural block diagram of an adversarial traffic generation device based on a deep learning intrusion detection system according to an embodiment of the present invention;

[0054] Figure 7 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Adversarial attack methods against ML / DL systems have been extensively studied in fields such as computer vision, natural language processing, and malware detection. For example... Figure 1 The diagram illustrates the basic structure of a counter-traffic attack. The attacker is located outside the victim's target network and collects raw traffic datasets from the target network. The attacker modifies malicious traffic in the raw traffic dataset to obtain counter-traffic. The intrusion detection system detects the counter-traffic and obtains the detection results. The attacker continuously optimizes its attack model based on the detection results until the attack model converges. Using the attack model, counter-traffic is generated and input into the intrusion detection system again. The counter-traffic can evade intrusion detection and successfully reach the target network, thus achieving an attack on the target network.

[0057] The aforementioned methods cannot be directly applied to network intrusion detection systems for the Industrial Internet of Things (IIoT) for two reasons: First, unlike in non-security domains, attackers cannot guarantee that modified malicious traffic will not violate communication protocol rules within the intrusion detection system. For example, each protocol layer contains a header and length, and the header has a fixed format. Second, attackers can only generate adversarial examples in the feature space to deceive the detection model, but it is difficult to map these adversarial examples to the traffic space. For instance, some statistical features in the IIoT (e.g., average data stream length, bytes transmitted per second, etc.) cannot be mapped to the original traffic space. However, in other domains (e.g., computer vision, natural language processing), features are easily mapped to the original image because features in other domains can be formalized as differentiable functions. Therefore, these generative adversarial attack methods from non-security domains are impractical for intrusion detection systems. Research on adversarial traffic attacks in the IIoT environment is becoming increasingly important. Understanding their attack mechanisms is crucial to determining the robustness of ML / DL model-based systems to ensure the security of the IIoT.

[0058] Practical adversarial attack methods for malicious traffic detection based on ML / DL models mainly include gray-box attacks and black-box attacks. Gray-box attacks involve attackers lacking detailed knowledge of the target model, such as its structure or parameters, but may require feedback from the model, such as predicted labels or confidence levels. This type of attack only requires feedback from the target model to modify traffic. A perfect black-box attack requires the attacker to have absolutely no prior knowledge of the target system. In other words, the attacker neither knows the target model nor its parameters, nor needs any feedback. It involves generating realistic traffic to evade ML-based models.

[0059] Techniques to combat traffic modification include:

[0060] (1) First, traffic is input into the target intrusion detection model to probe and obtain traffic labels. Then, a local proxy model is trained based on the probed traffic and labels. This method adds small perturbations to the spatiotemporal sequence features that can bypass the proxy model and maps the sequence features to adversarial traffic to evade detection. Finally, an adversarial attack based on generative adversarial networks is executed to generate adversarial examples to evade detection.

[0061] (2) First, perform a binary search on each malicious data packet sent within a range of 0 to 15 seconds to see if adding a delay can reduce the score of the current data packet to below 0.9 × a preset threshold. If the score is greater than the preset threshold, attempt to split the data packet. This splitting process continuously attempts to convert large data packets into multiple smaller data packets so that the score of all data packets is less than the preset threshold, until the entire data packet length is sent and none of them are detected, then the anti-traffic attack is successful.

[0062] (3) Collect traffic from the target network and then modify it. Modification operations include increasing the arrival interval of malicious traffic, simulating packet dropping, copying some original packets and retransmitting them, modifying the maximum transmission unit of packets, and modifying the transmission order of packets. The modified traffic is the adversarial traffic.

[0063] (4) First, a Long Short-Term Memory (LSTM) neural network is trained to learn benign network traffic behavior by predicting the time differences between benign network packets. This neural network is trained on the specific network connection to which the attack will be carried out. Then, the trained neural network is applied to the malicious traffic of the intrusion attack to reshape the inter-packet delay (adjust timestamps) to resemble the delay of benign traffic. Finally, the reshaped malicious traffic is sent to the target network with the aim of bypassing the intrusion detection system, which is considered a black box.

[0064] When adversarial attack techniques are applied in real-world scenarios, they have the following four main drawbacks:

[0065] (1) Random or simple traffic / feature space modification: Most existing research methods focus on directly modifying data packets or feature values ​​to evade intrusion detection systems, without deliberately considering changes to specific fields in traffic data packets. This may compromise the legitimacy and functionality of the original malicious traffic. Moreover, in deep learning-based intrusion detection systems, feature extraction is irreversible. This is mainly due to the lack of research on mapping traffic data from the feature space to the traffic space in the field of intrusion detection.

[0066] (2) Requirement of white-box / grey-box knowledge: Most attack evasion methods use white-box or gray-box methods to disrupt traffic patterns. In these methods, the attacker has complete knowledge of the target intrusion detection system, including the features being exploited, the architecture and parameters of the ML model, as well as feedback from the target model (e.g., predicted labels or confidence levels). However, in practice, attackers rarely have access to such detailed information due to limited knowledge.

[0067] (3) High attack execution cost: Some existing attack methods do not limit the attacker's overhead or ability to modify traffic, such as obtaining a large amount of target traffic or having a high attack time delay. However, in practice, attackers must consider the execution cost of the attack and cannot arbitrarily modify traffic fields, increase the size of training traffic, or increase execution complexity.

[0068] (4) Lack of effective research on DL-based intrusion detection systems: Adversarial attacks on ML / DL-based intrusion detection systems in the feature space and ML-based intrusion detection systems in the traffic space have been extensively studied. However, research on adversarial attack methods for DL-based intrusion detection systems in the traffic space remains insufficient.

[0069] To address the aforementioned issues, this invention provides a method for generating adversarial traffic based on a deep learning intrusion detection system. By modifying malicious traffic in the traffic space and processing adversarial features using a preset proxy classifier, the method aims to improve attack efficiency and generate adversarial traffic using limited knowledge.

[0070] According to an embodiment of the present invention, an embodiment of an adversarial traffic generation method based on a deep learning intrusion detection system is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0071] This embodiment provides an adversarial traffic generation method based on a deep learning intrusion detection system, which can be used in the aforementioned computer system. Figure 2 This is a flowchart of an adversarial traffic generation method based on a deep learning-based intrusion detection system according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0072] Step S101: Obtain the raw network traffic dataset, which includes normal traffic and malicious traffic.

[0073] Specifically, to generate adversarial traffic, it is necessary to obtain the original network traffic dataset from the target network. The target network has tools to detect malicious traffic, which can identify it. Therefore, the original network traffic dataset contains both normal and malicious traffic. To facilitate numerical calculations on the structured traffic data, the attacker vectorizes the original traffic in the training set into a metadata vector containing the original traffic. Since the adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment includes a model training process, the original network traffic dataset can be divided into a training set and a test set, ensuring that both the training set and the test set simultaneously contain normal and malicious traffic. The training set is used to train a preset generator, and the test set is used to test the performance of the trained generator.

[0074] Step S102: Modify the malicious traffic according to the preset modification rules to obtain the modified traffic, and use the preset generator to obtain the original adversarial traffic based on the modified traffic.

[0075] Specifically, such as Figure 3As shown, this embodiment illustrates the multiple components and their interconnections required to implement the adversarial traffic generation method based on a deep learning intrusion detection system. The components include: a generator, a first feature extractor, a second feature extractor, a discriminator, and a proxy classifier. Since malicious traffic is detectable by existing deep learning intrusion detection systems, the goal of this embodiment is to generate adversarial traffic that is malicious and cannot be identified by existing deep learning intrusion detection systems. Therefore, modifications can be made to existing malicious traffic to ensure its malicious functionality and effectiveness. Modifications must be performed according to preset rules to avoid generating unusable adversarial traffic. To make the adversarial traffic as close as possible to normal traffic, the generator needs to be trained, and the original adversarial traffic is generated using the generator and modified traffic.

[0076] Step S103: Based on the normal traffic and the original adversarial traffic, determine the gradient loss of the preset generator using the preset discriminator and the preset proxy classifier.

[0077] Specifically, such as Figure 3 As shown, normal traffic and original adversarial traffic are input into different feature extractors to obtain normal features and adversarial features. Then, based on the normal features and adversarial features, the gradient loss of the preset generator is determined using a preset discriminator and a preset surrogate classifier. The generator, discriminator, and surrogate classifier can be deep neural network models of different layers, such as long short-term memory networks, convolutional neural networks, and recurrent neural networks. These are just examples and are not limited to this. A bidirectional long short term memory (BiLSTM) model is used as an example. A four-layer BiLSTM includes an input layer, a forward transport layer, a backward transport layer, and an output layer. The input layer is responsible for sequence encoding of the input data to meet the network's input requirements; the forward transport layer is responsible for extracting forward features from the input sequence; the backward transport layer is responsible for extracting backward features from the input sequence; the output layer is responsible for integrating the data output from the forward and backward transport layers. Based on the data in the merged sample set, the cross-entropy loss function is used to train the BiLSTM network model to obtain the corresponding generator, discriminator, and surrogate classifier models.

[0078] Step S104: Repeat the steps of obtaining the original adversarial flow using the preset generator based on the modified flow until the gradient loss of the preset generator converges, and the trained generator is obtained.

[0079] Specifically, in this embodiment, the generator is a direct component for generating adversarial traffic. Therefore, the training process of the generator is the focus. The gradient loss calculated by the discriminator and the surrogate classifier is fed back to the generator. The generator changes its own parameters according to the fed-back gradient loss. The process of obtaining the original adversarial traffic using the preset generator based on the modified traffic is repeated. The gradient loss of the preset generator is determined using the preset discriminator and the preset surrogate classifier based on the normal traffic and the original adversarial traffic, until the gradient loss of the preset generator converges, indicating that the generator's performance has reached the optimal level, and a well-trained generator is obtained.

[0080] Step S105: Obtain random noise and input the random noise into the trained generator to obtain a perturbation vector. Add the perturbation vector to the modified flow to obtain the adversarial flow.

[0081] Specifically, random Gaussian noise is input into the generator trained in step S104 above, and a perturbation vector is output. The malicious traffic is modified to obtain the modified traffic, and then the perturbation vector is added to the modified traffic for calculation. The result is the adversarial traffic. This malicious traffic can be obtained based on malicious traffic in the original network traffic dataset, or it can utilize newly collected malicious traffic.

[0082] The adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment improves the execution efficiency of adversarial attacks and reduces the attack execution cost by modifying malicious traffic in the traffic space. By adding a preset proxy classifier, it simulates the behavior of black-box intrusion detection to help determine whether the generated adversarial traffic is malicious. It does not require knowledge of the deep learning model parameters or output information of the target intrusion detection, thus realizing the generation of adversarial traffic using limited knowledge.

[0083] This embodiment provides an adversarial traffic generation method based on a deep learning intrusion detection system, which can be used in the aforementioned computer system. Figure 4 This is a flowchart of an adversarial traffic generation method based on a deep learning-based intrusion detection system according to an embodiment of the present invention, such as... Figure 4 As shown, the process includes the following steps:

[0084] Step S201: Obtain the raw network traffic dataset, which includes both normal and malicious traffic. For details, please refer to [link to relevant documentation]. Figure 2 Step S101 of the illustrated embodiment will not be described again here.

[0085] Step S202: Modify the malicious traffic according to the preset modification rules to obtain the modified traffic, and use the preset generator to obtain the original adversarial traffic based on the modified traffic.

[0086] Specifically, in step S202 above, the malicious traffic is modified according to a preset modification rule to obtain the modified traffic, including:

[0087] Step S2021: Copy the malicious traffic data packets to obtain the traffic to be modified.

[0088] Specifically, for malicious traffic in the original network traffic dataset, instead of directly modifying it, the malicious traffic data packets are copied first as the traffic to be modified, thus avoiding damage to the original malicious traffic.

[0089] Step S2022: Modify the arrival interval, protocol, and length of data packets in the traffic to be modified to obtain the modified traffic.

[0090] Specifically, malicious network traffic is modified and vectorized while retaining its legitimacy and malice. The modification of the traffic to be modified includes changing specific attributes of the original data packets to affect the feature space, converting the traffic into a vector containing metadata from the original traffic, and this transformation operation is reversible.

[0091] The adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment modifies the copied malicious traffic without destroying the original malicious traffic, ensuring the effectiveness and security of the original malicious traffic, while ensuring that the modified traffic has malicious functionality and executability.

[0092] In some optional implementations, step S2022 above includes:

[0093] Modify the arrival interval of data packets in the traffic to be modified to no greater than the preset interval threshold.

[0094] Set the protocol of the data packets in the traffic to be modified to the default protocol;

[0095] Modify the length of data packets in the traffic to be modified to be no greater than the preset length threshold;

[0096] Traffic to be modified is traffic whose arrival interval is no greater than a preset interval threshold, whose protocol is a preset protocol, and whose length is no greater than a preset length threshold.

[0097] Specifically, the modification of data packets in the traffic to be modified mainly includes three aspects:

[0098] Firstly, the arrival interval of data packets in the generated traffic is modified. The modified arrival interval of data packets is not greater than a preset interval threshold. The preset interval threshold can be the maximum arrival interval between any two original malicious data packets and normal data packets in the training set. This is just an example and is not a limitation.

[0099] Secondly, modify the protocol layer of the data packets in the generated traffic. The modified protocol layer must comply with established network standards, such as the TCP and UDP protocols at the third layer of the network. This is just an example, but not a limitation.

[0100] Thirdly, the length of data packets in the generated traffic is modified so that the length of the modified data packets does not exceed a preset length threshold. The preset length threshold can be the maximum value allowed by the protocol layer. For example, the maximum TCP data packet size should theoretically not exceed the network's maximum transmission unit, which is set to 1500 bytes. This is just an example and is not a limitation.

[0101] The adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment generates adversarial traffic by effectively modifying three specific fields, maintaining the legitimacy and malicious functionality of the original malicious traffic, and transforming the traffic into a vector containing metadata from the original malicious traffic by changing specific attributes of the original malicious traffic data packet, which facilitates subsequent processing by the generator.

[0102] Step S2023: Input random noise into the preset generator to obtain the perturbation vector.

[0103] Specifically, the random noise can be Gaussian noise, which is input into the generator to generate a perturbation vector containing three attribute metadata: the arrival interval of the data packet, the protocol, and the length of the data packet. In order to match the output value range constraint, the sigmoid activation function can be used to restrict the values ​​of the three attribute metadata of the perturbation vector to between 0 and 1.

[0104] Step S2024: Add the perturbation vector to the modified traffic, and restore each field of the data packet in the modified traffic to the corresponding preset field value to obtain the original adversarial traffic.

[0105] Specifically, the perturbation vector is added to the modified malicious traffic. To ensure that the subsequent feature vectors can be extracted correctly, the calculated malicious traffic is restored to the value of the corresponding field in the data packet according to the minimum and maximum values ​​of each field preset in step S2022.

[0106] The adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment adds noise perturbation to the generator's input, making the original adversarial traffic generated by the generator more diverse and creative. It restores each field of the data packet in the modified traffic to the corresponding preset field value, ensuring that the adversarial feature vector of the subsequent original adversarial traffic can be correctly extracted. For deep learning models, introducing random or specific forms of noise during the training process can improve the model's resistance to such attacks.

[0107] Step S203: Based on the normal traffic and the original adversarial traffic, determine the gradient loss of the preset generator using the preset discriminator and the preset proxy classifier.

[0108] Specifically, step S203 includes:

[0109] Step S2031: Use a preset discriminator in conjunction with normal traffic to determine the true probability of the original adversarial traffic.

[0110] Specifically, such as Figure 3 As shown, the normal characteristics of normal traffic and the adversarial characteristics of original adversarial traffic are input into a preset discriminator to obtain the true probability of the original adversarial traffic.

[0111] Step S2032: Use the preset proxy classifier to determine the normal probability of the original adversarial traffic, and combine it with the true probability to determine the gradient loss of the preset generator.

[0112] Specifically, such as Figure 3 As shown, the adversarial features of the original adversarial traffic are input into the preset proxy classifier to obtain the normal probability of the original adversarial traffic. The gradient loss of the preset generator is calculated by combining the normal probability with the true probability.

[0113] The adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment uses a pre-trained proxy classifier to simulate the behavior of a black-box intrusion detection system, which helps to accurately detect whether the generated adversarial traffic is malicious. In the feature space, the discriminator and the proxy classifier are combined to provide gradient loss information for generator training, thereby improving the high escape success rate of adversarial traffic.

[0114] In some optional implementations, step S2031 above includes:

[0115] Step a1: Input the normal traffic into the first feature extractor to extract normal features, and input the original adversarial traffic into the second feature extractor to extract adversarial features.

[0116] Specifically, such as Figure 3As shown, normal traffic is input into the first feature extractor for feature extraction, yielding normal features. The original adversarial traffic is input into the second feature extractor for feature extraction, yielding adversarial features. It should be noted that both the extracted normal and adversarial features are spatiotemporal features. The goal of feature extraction is to find information from raw data that can discriminate network behavior or attack patterns, and spatiotemporal features are precisely the most direct and identifiable aspects of network traffic. Examples include packet arrival time intervals, timestamp sequences, and traffic bursts. These features reflect the dynamic behavior of network activity. Moreover, spatiotemporal features can often be handled well by existing machine learning and deep learning models (such as BiLSTM) because these models can capture the correlation between time series and spatial distributions. Other feature types (such as identifiers or field information specific to a particular protocol) have limited application in network traffic analysis because encrypted communication is increasingly prevalent, and content-layer information cannot be directly obtained. Therefore, the features extracted here are spatiotemporal features.

[0117] Step a2: Input both adversarial features and normal features into the discriminator to obtain the true probability that the adversarial features are identified as normal features.

[0118] Specifically, adversarial features and normal features are simultaneously input into the discriminator to obtain the true probability D(f) of normal features being identified as normal traffic, where f represents the true probability D(f) of normal features and adversarial features being identified as normal traffic. * ), f * The adversarial characteristics are represented, and the authenticity of the adversarial traffic is evaluated based on the true adversarial probability. The discriminator loss is obtained using the cross-entropy loss function based on the normal and adversarial true probabilities. Loss L D The discriminator can be trained by minimizing the loss. When the loss converges, the trained discriminator is obtained. The training process of the discriminator can be a mature existing technology, which will not be elaborated here.

[0119] The adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment uses a discriminator to evaluate the authenticity of normal features and the true probability of adversarial features. The discriminator's discrimination result is used as part of the generator's gradient loss to form an adversarial relationship with the generator, helping the generator to generate adversarial traffic that is closer to normal traffic and improving the accuracy of adversarial traffic.

[0120] In some optional implementations, step S2032 above includes:

[0121] Step b1: Input the adversarial features into the preset proxy classifier to obtain the normal probability that the original adversarial traffic is normal traffic.

[0122] Specifically, the proxy classifier, as a black-box intrusion detection system, is used to determine the probability that the generated adversarial examples are normal, and to classify the adversarial features f* The input is fed into a preset proxy classifier to obtain the normal probability P that the adversarial traffic is normal traffic. f* =C(f) * ).

[0123] Step b2: Calculate the classification loss of adversarial features that are identified as normal traffic by the preset proxy classifier based on normal probability.

[0124] Specifically, the classification loss can be calculated based on the normal probability. Let CE represent the cross-entropy function, and based on the normal probability P... f* The loss CE(P) is calculated when adversarial features are identified as normal traffic by a pre-defined proxy classifier. f* ,y * ). Where y * This represents the desired target category (normal traffic category) for classifying the adversarial features. For example, the goal of this embodiment is to have the generated adversarial traffic classified as normal traffic by a preset proxy classifier, to prove that the adversarial traffic generated by the preset generator has a high similarity to normal traffic, thereby helping the generator to train better. In this embodiment, there are only two traffic categories: normal traffic category 0 and malicious traffic category 1 (adversarial traffic also belongs to malicious traffic). Normal probability P f* It is the softmax function of the last layer of the pre-defined proxy classifier model, which is the adversarial feature f. * The calculation yields a result for normal traffic category 0. The cross-entropy loss CE quantifies the predicted normal probability distribution P. f* The difference between this distribution and the actual category distribution (normal traffic category 0 distribution). Therefore, y * Set to 0, where 0 represents the category of normal traffic. The preset proxy classifier helps the generator generate adversarial traffic better by determining the likelihood that the adversarial feature is adversarial traffic.

[0125] Step b3: Calculate the gradient loss of the preset generator based on the true probability and the classification loss.

[0126] Specifically, the true adversarial probability D(f) of the adversarial feature is... * ) and normal probability P f* Classification loss CE(P) f* ,y * The gradient loss of the generator is obtained by adding the two values ​​together. Let L2 represent the gradient loss of the generator, i.e., L... G = -logD(f * )+CE(P f* ,y * Minimize L G The function is used to make the gradient loss of the generator G converge, thus completing the training of the generator.

[0127] The loss from the true probability of adversarial features and the classification loss from normal probabilities are summed to provide the training gradient loss for the generator.

[0128] The adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment involves a feature extractor extracting features from normal traffic and carefully crafted malicious traffic, and then inputting them into a discriminator and a proxy classifier. The discriminator and the proxy classifier distinguish these traffic in the feature space and obtain the gradient loss of the preset generator. The generator is continuously trained in combination with the gradient loss, so that the generator can generate minimal perturbation to modify malicious traffic, thereby improving the effectiveness of the generator in generating adversarial traffic.

[0129] Step S204: Repeat the process of obtaining the original adversarial flow using the preset generator based on the modified flow until the gradient loss of the preset generator converges, thus obtaining the trained generator. For details, please refer to [link to relevant documentation]. Figure 2 Step S104 of the illustrated embodiment will not be described again here.

[0130] Step S205: Obtain random noise and input it into the trained generator to obtain a perturbation vector. Add the perturbation vector to the modified flow to obtain the adversarial flow. For details, please refer to [link to details]. Figure 2 Step S105 of the illustrated embodiment will not be described again here.

[0131] The adversarial traffic generation method based on a deep learning intrusion detection system provided in this embodiment improves the execution efficiency of adversarial attacks and reduces the attack execution cost by modifying malicious traffic in the traffic space. By adding a preset proxy classifier, it simulates the behavior of black-box intrusion detection to help determine whether the generated adversarial traffic is malicious. It does not require knowledge of the deep learning model parameters or output information of the target intrusion detection, thus realizing the generation of adversarial traffic using limited knowledge.

[0132] In a specific embodiment, the complete process of the adversarial traffic generation method based on a deep learning intrusion detection system is as follows: Figure 5 As shown, the specific steps include:

[0133] (1) Obtain raw traffic data from the target network and divide the raw traffic data into training set and test set.

[0134] (2) Divide the data in the training set into normal traffic and malicious traffic. Malicious traffic is the traffic that has been detected by the target network. The specific detection method can be a mature existing technology, which will not be elaborated here.

[0135] (3) Obtain random noise and add it to the generator for training. Use the generator and malicious traffic to generate original adversarial traffic and input it into the second feature extractor to obtain adversarial features.

[0136] (4) Input the normal traffic into the first feature extractor to obtain normal features, and use the discriminator to generate the true probability of normal features and the true probability of adversarial features based on normal features and adversarial features.

[0137] (5) Input the adversarial features into the proxy classifier for detection to obtain the normal probability of the adversarial features.

[0138] (6) Obtain the gradient loss of the generator based on the true probability and the normal probability, and determine whether the generator training has converged based on the gradient loss. If the generator training has not converged, return to the step of modifying malicious traffic and continue training until the generator training converges. Test the trained generator using a test set. After feature extraction, input it into a deep learning-based target intrusion detection system to obtain the detection results. Observe whether the malicious traffic in the test set is mistakenly identified as normal traffic by the deep learning-based target intrusion detection system after being generated by the generator into adversarial traffic.

[0139] This embodiment also provides an adversarial traffic generation device based on a deep learning intrusion detection system. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0140] This embodiment provides an adversarial traffic generation device based on a deep learning intrusion detection system, such as... Figure 6 As shown, it includes:

[0141] The raw traffic acquisition module 601 is used to acquire raw network traffic datasets, which include normal traffic and malicious traffic.

[0142] The traffic modification module 602 is used to modify malicious traffic according to preset modification rules, obtain modified traffic, and obtain the original countermeasure traffic based on the modified traffic using a preset generator.

[0143] The traffic identification module 603 is used to determine the gradient loss of the preset generator based on the normal traffic and the original adversarial traffic using a preset discriminator and a preset proxy classifier.

[0144] The generator training module 604 is used to repeatedly obtain the original adversarial flow from the preset generator based on the modified flow until the gradient loss of the preset generator converges, thus obtaining the trained generator.

[0145] The adversarial traffic generation module 605 is used to acquire random noise and input the random noise into the trained generator to obtain a perturbation vector. The perturbation vector is added to the modified traffic to obtain the adversarial traffic.

[0146] In some alternative implementations, the flow modification module 602 includes:

[0147] The traffic replication unit is used to replicate malicious traffic packets to obtain traffic to be modified.

[0148] The traffic modification unit is used to modify the arrival interval, protocol, and length of data packets in the traffic to be modified, thereby obtaining the modified traffic.

[0149] The noise addition unit is used to input random noise into a preset generator to obtain a perturbation vector.

[0150] The adversarial traffic generation unit is used to add perturbation vectors to the modified traffic and restore each field of the data packet in the modified traffic to the corresponding preset field values ​​to obtain the original adversarial traffic.

[0151] In some alternative implementations, the traffic identification module 603 includes:

[0152] The true probability determination unit is used to determine the true probability of the original adversarial traffic by combining a preset discriminator with normal traffic.

[0153] The gradient loss calculation unit is used to determine the normal probability of the original adversarial traffic using a preset proxy classifier, and to determine the gradient loss of the preset generator by combining the true probability.

[0154] In some optional implementations, the true probability determination unit includes:

[0155] The feature extraction subunit is used to input normal traffic into the first feature extractor to extract normal features, and input the original adversarial traffic into the second feature extractor to extract adversarial features.

[0156] The adversarial feature discrimination subunit is used to simultaneously input adversarial features and normal features into the discriminator to obtain the true probability that the adversarial feature is identified as a normal feature.

[0157] In some alternative implementations, the gradient loss calculation unit includes:

[0158] The normal probability determination subunit is used to input adversarial features into a preset proxy classifier to obtain the normal probability that the original adversarial traffic is normal traffic.

[0159] The classification loss calculation subunit is used to calculate the classification loss of adversarial features that are identified as normal traffic by the preset proxy classifier based on normal probability.

[0160] The gradient loss determination subunit is used to calculate the gradient loss of the preset generator based on the true probability and the classification loss.

[0161] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0162] In this embodiment, the adversarial traffic generation device of the deep learning intrusion detection system is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0163] This invention also provides a computer device having the above-described features. Figure 6 The diagram shows the adversarial traffic generation device for a deep learning intrusion detection system.

[0164] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 7 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 7 Take a processor 10 as an example.

[0165] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0166] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0167] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0168] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0169] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0170] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0171] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for generating adversarial traffic based on a deep learning intrusion detection system, characterized in that, The method includes: Obtain the raw network traffic dataset, which includes normal traffic and malicious traffic; The malicious traffic is modified according to preset modification rules to obtain modified traffic. Based on the modified traffic, an original adversarial traffic is obtained using a preset generator. This process includes: copying the data packets of the malicious traffic to obtain traffic to be modified; modifying the arrival interval, protocol, and length of the data packets in the traffic to be modified to obtain modified traffic; acquiring random noise and inputting the random noise into a preset generator to obtain a perturbation vector; adding the perturbation vector to the modified traffic and restoring each field of the data packets in the modified traffic to its corresponding preset field value to obtain the original adversarial traffic. Based on the normal traffic and the original adversarial traffic, the gradient loss of the preset generator is determined using a preset discriminator and a preset proxy classifier; Repeat the process of inputting the modified flow into the preset generator to obtain the original adversarial flow until the gradient loss of the preset generator converges, thus obtaining a trained generator. Random noise is acquired and input into a trained generator to obtain a perturbation vector. The perturbation vector is then added to the modified flow to obtain the adversarial flow.

2. The method according to claim 1, characterized in that, Modifying the arrival interval, protocol, and length of data packets in the traffic to be modified to obtain the modified traffic includes: The arrival interval of data packets in the traffic to be modified is modified to be no greater than a preset interval time threshold. Set the protocol of the data packets in the traffic to be modified to a preset protocol; Modify the length of the data packets in the traffic to be modified to be no greater than a preset length threshold; Traffic to be modified is traffic whose arrival interval is no greater than a preset interval threshold, whose protocol is a preset protocol, and whose length is no greater than a preset length threshold.

3. The method according to claim 1, characterized in that, Based on the normal traffic and the original adversarial traffic, the gradient loss of the preset generator is determined using a preset discriminator and a preset proxy classifier, including: The true probability of the original adversarial traffic is determined by combining the preset discriminator with the normal traffic. The normal probability of the original adversarial traffic is determined by using a preset proxy classifier, and the gradient loss of the preset generator is determined by combining the true probability.

4. The method according to claim 3, characterized in that, Using the preset discriminator in conjunction with the normal traffic, the true probability of the original adversarial traffic is determined, including: The normal traffic is input into the first feature extractor to extract features and obtain normal features; the original adversarial traffic is input into the second feature extractor to extract features and obtain adversarial features. The adversarial feature and the normal feature are simultaneously input into the discriminator to obtain the true probability that the adversarial feature is identified as a normal feature.

5. The method according to claim 4, characterized in that, The normal probability of the original adversarial traffic is determined using a preset proxy classifier, and the gradient loss of the preset generator is determined by combining the true probability, including: The adversarial features are input into the preset proxy classifier to obtain the normal probability that the original adversarial traffic is normal traffic; The classification loss of the adversarial feature being identified as normal traffic by the preset proxy classifier is calculated based on the normal probability. The gradient loss of the preset generator is calculated based on the true probability and the classification loss.

6. A device for generating adversarial traffic based on a deep learning intrusion detection system, characterized in that, The device includes: The raw traffic acquisition module is used to acquire raw network traffic datasets, which include normal traffic and malicious traffic; The traffic modification module is used to modify the malicious traffic according to preset modification rules to obtain modified traffic, and input the modified traffic into a preset generator to obtain the original adversarial traffic. The module includes: copying the data packets of the malicious traffic to obtain traffic to be modified; modifying the arrival interval, protocol, and length of the data packets in the traffic to be modified to obtain modified traffic; acquiring random noise and inputting the random noise into a preset generator to obtain a perturbation vector; adding the perturbation vector to the modified traffic; and restoring each field of the data packets in the modified traffic to its corresponding preset field value to obtain the original adversarial traffic. The traffic identification module is used to determine the gradient loss of the preset generator based on the normal traffic and the original adversarial traffic using a preset discriminator and a preset proxy classifier. The generator training module is used to repeatedly input the modified traffic into the preset generator to obtain the original adversarial traffic until the gradient loss of the preset generator converges, thus obtaining a trained generator. The adversarial traffic generation module is used to acquire random noise and input the random noise into a trained generator to obtain a perturbation vector. The perturbation vector is added to the modified traffic to obtain the adversarial traffic.

7. A computer device, characterized in that, include: A memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, the processor executing the computer instructions to perform the method of any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method of any one of claims 1 to 5.

Images