A network security malicious traffic detection and tracing method based on generative adversarial network

Abstract

The present invention discloses a network security malicious traffic detection and tracing method based on a generative adversarial network, comprising the following steps: S1, collecting normal traffic samples and malicious traffic samples to form a training data set; S2, training a malicious traffic detection model based on an improved generative adversarial network generator and discriminator; S3, analyzing input traffic data using an improved gated recurrent unit network; S4, analyzing the input traffic data using the malicious traffic detection model and outputting a malicious traffic alert; S5, tracing the source of the identified malicious traffic and analyzing the propagation path of the malicious traffic; S6, dynamically adjusting the parameters of the malicious traffic detection model based on the malicious traffic samples generated by the generator and the tracing results; S7, continuously optimizing the generator and discriminator. The present invention combines an improved generative adversarial network with an improved gated recurrent unit to improve the accuracy and robustness of malicious traffic detection through malicious traffic sample generation and tracing analysis.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security malicious traffic detection and tracing method based on a generative adversarial network. Background Art

[0002] With the continuous development of information technology, the Internet has become a vital platform for global data transmission and information exchange. However, the resulting network security issues are becoming increasingly severe, especially the emergence of malicious traffic, which poses a significant challenge to network security. Malicious traffic is often caused by various attack methods (such as distributed denial of service attacks, botnet attacks, and virus propagation). Attackers exploit network resources by forging legitimate traffic and using malware to launch large-scale attacks. Malicious traffic not only consumes large amounts of network bandwidth and server resources, but can also cause network service interruptions, sensitive data leaks, and even cause serious damage to the critical infrastructure of enterprises and government agencies. Therefore, how to effectively detect and respond to malicious traffic has become a hot topic in network security research.

[0003] Currently, malicious traffic detection technology relies primarily on two approaches: rule-based detection and machine learning-based detection. Rule-based detection typically matches and screens network traffic by setting specific rules and thresholds. This approach can quickly detect known attack patterns through static rules, offering high detection speed and accuracy. However, this approach has limited adaptability to new attack patterns and cannot effectively address evolving attack vectors. Furthermore, rule setup and maintenance require human expertise, resulting in lengthy rule updates and optimization cycles and limited flexibility.

[0004] Machine learning-based detection methods extract and analyze features from network traffic data and classify traffic using classification algorithms (such as decision trees, support vector machines, and K-nearest neighbors). These methods can automatically learn and identify attack patterns based on training data, are highly adaptable and scalable, and can effectively detect unknown attacks. However, traditional machine learning-based detection methods also face several challenges. First, training machine learning models requires a large amount of labeled data, which is often scarce in real-world scenarios. This lack of training data significantly reduces the model's accuracy in detecting new attack types, especially for novel attack types. Second, many machine learning-based models fail to fully consider the temporal characteristics of traffic data, resulting in poor attack traffic identification. Network traffic has not only spatial characteristics (such as IP addresses and port numbers) but also temporal characteristics (such as traffic fluctuations and periodicity). These temporal characteristics can help detection systems more accurately identify attack patterns and changes. Therefore, ignoring these characteristics often reduces the model's detection effectiveness.

[0005] In recent years, generative adversarial networks (GANs) have been proposed and rapidly applied in various fields, including image generation and text generation. GANs are capable of generating high-quality sample data through adversarial training of generators and discriminators. Malicious traffic detection methods based on GANs aim to detect malicious traffic by generating realistic malicious traffic samples through generative models and comparing the generated traffic with real traffic using a discriminator. However, GAN-based traffic detection methods still have some issues. First, existing GAN-based traffic detection methods fail to fully consider the temporal characteristics of network traffic when generating malicious traffic samples. Temporal characteristics of traffic, such as volatility, periodic changes, and sudden events, are crucial for identifying malicious traffic. Especially when addressing network attacks, temporal characteristics can help models capture attack patterns and trends. Existing generators primarily focus on generating content features of malicious traffic and lack consideration of the temporal characteristics of traffic variations. This results in significant temporal discrepancies between generated malicious traffic samples and real traffic samples, which in turn affects the model's detection effectiveness. Second, existing malicious traffic detection methods rely on static training datasets and are unable to cope with the ever-changing nature of attacks. Attackers often evade detection by changing their attack strategies and traffic characteristics, but traditional detection models lack the ability to adapt to these new attack patterns. While some methods have introduced adaptive learning mechanisms to adjust model parameters, existing methods still lack adaptability and are unable to quickly adjust the model's detection strategy in a dynamically changing attack environment.

[0006] In addition, existing malicious traffic detection methods based on generative adversarial networks are also insufficient in tracing the source of traffic. In network attacks, tracing the source is one of the key defense measures, which can help track the attack source in a timely manner, block the attack path, and prevent the attack from spreading further. However, existing technologies mostly focus on detecting malicious traffic, and pay less attention to tracking the source of the attack and analyzing the attack path. Especially in the face of complex attack paths and multiple traffic sources, the efficiency and accuracy of the tracing process are still low. Current tracing methods mostly rely on traditional IP address and port analysis, which makes it difficult to cope with the complexity and diversity of attacks such as distributed denial of service. Therefore, in highly dynamic and large-scale network environments, existing tracing technologies face challenges.

[0007] In summary, while existing technologies have made some progress in malicious traffic detection and tracing, they still have many shortcomings. Key issues include a failure to fully leverage temporal features to improve traffic detection accuracy, a lack of ability to address new attack models, and inefficiencies and limitations in the tracing process. Therefore, a new approach is urgently needed that leverages the strengths of generative adversarial networks (GANs) to fully exploit the temporal features in traffic data and, through adaptive learning and dynamic adjustments, improves the accuracy and robustness of malicious traffic detection models. Summary of the Invention

[0008] One purpose of the present invention is to propose a network security malicious traffic detection and tracing method based on a generative adversarial network. The present invention combines an improved generative adversarial network and an improved gated cyclic unit, generates malicious traffic samples with temporal and variability, and uses a tracing algorithm to track the source of the attack, thereby improving the accuracy and robustness of malicious traffic detection. By analyzing the timing characteristics, fluctuation patterns and periodic changes of the generated traffic samples, the present invention can effectively identify and respond to new attack patterns, and has efficient and flexible adaptability.

[0009] According to an embodiment of the present invention, a network security malicious traffic detection and tracing method based on a generative adversarial network includes the following steps:

[0010] S1. Collect normal traffic samples and malicious traffic samples from the actual network, and mix the normal traffic samples and malicious traffic samples to form a training data set;

[0011] S2. Train a malicious traffic detection model based on the generator and discriminator of the improved generative adversarial network. The generator is trained based on the training dataset to generate malicious traffic samples with temporal and variable characteristics. The discriminator compares the malicious traffic samples generated by the generator with normal traffic samples, identifies the differences between the two, and outputs a traffic category label.

[0012] S3. Analyze the input traffic data using the improved gated recurrent unit network to capture the time series characteristics of the traffic data;

[0013] S4. Combining the improved gated recurrent unit network analysis results and the malicious traffic samples generated by the generator, the malicious traffic detection model is used to analyze the input traffic data and output a malicious traffic alert.

[0014] S5. Trace the source of identified malicious traffic, analyze its propagation path, and reversely infer the attack source based on traffic characteristics, providing key information about the attack path and the initiator.

[0015] S6. Dynamically adjust the parameters of the malicious traffic detection model based on the malicious traffic samples and tracing results generated by the generator;

[0016] S7. By improving the automatic learning mechanism of the generative adversarial network, the generator and discriminator are continuously optimized. The generator continuously generates new malicious traffic samples, and the discriminator adjusts the judgment criteria based on the traffic samples to simulate different types of attack traffic.

[0017] Optionally, the S2 specifically includes:

[0018] S21. Initialize an improved generative adversarial network, wherein the improved generative adversarial network includes a generator and a discriminator. The input of the generator is a training data set, and the input of the discriminator is generated malicious traffic samples and normal traffic samples. The generator generates malicious traffic samples that are temporal and variable, and the discriminator compares the malicious traffic samples generated by the generator with the normal traffic samples, identifies the difference between malicious traffic and normal traffic, and outputs a traffic category label. The improvements of the improved generative adversarial network include introducing a temporal loss function into the generator loss function, introducing a reconstruction loss function into the generator loss function, and introducing a temporal consistency loss function into the discriminator loss function.

[0019] S22. Train the generator based on the training dataset. The training goal is to generate malicious traffic samples with temporal and variability, and construct the generator's loss function:

[0020]

[0021] Among them, L G represents the loss function of the generator, D(G(z)) represents the score of the discriminator on the generated traffic sample, G(z) represents the malicious traffic sample output by the generator, z represents the input noise vector, and p z (z) represents the probability distribution of the input noise vector z, E represents the mathematical expectation, ∥∥ 2 represents the second norm, λ1 and λ2 represent the weights of the time series characteristics and the loss of the variation amplitude, ΔG(z) represents the variation amplitude of the generated traffic sample in the time series, and x real represents normal traffic samples, T(G(z)) and T(x real ) represent the time series features of generated traffic samples and normal traffic samples respectively, and T represents the time series feature extraction operator;

[0022] S23. Train the discriminator based on the training dataset. The training goal is to identify the difference between malicious traffic samples generated by the generator and normal traffic samples, and define the loss function of the discriminator:

[0023]

[0024] Among them, L D represents the loss function of the discriminator, x represents the normal traffic sample, p data (x) represents the probability distribution of normal traffic sample x, D(x) represents the score of the discriminator for normal traffic sample x, E represents the mathematical expectation, ∥∥ 2 represents the two-norm, λ3 and λ4 represent the weights of temporal consistency loss and gradient penalty, D(G(z)) represents the score of the discriminator on the generated traffic sample, x realrepresents normal traffic samples, T(G(z)) and T(x real ) represent the time series characteristics of generated traffic samples and normal traffic samples, respectively. represents the gradient of the discriminator to the input flow sample;

[0025] S24. The generator and discriminator are iteratively updated through adversarial training. The generator minimizes the loss function of generating malicious traffic samples, and the discriminator updates its parameters by maximizing the distinction between malicious traffic and normal traffic.

[0026] S25. Construct a temporal loss function to enhance temporal characteristics during generator training. By learning temporal patterns, periodic fluctuations, and emergencies in the network, we can generate diverse malicious traffic samples.

[0027]

[0028] in, Represents the temporal loss function, Δx t represents the normal flow variation at time step t, Denotes the change of malicious traffic generated by the generator at time step t, T(G(z)) and T(x real ) represent the temporal characteristics of generated traffic samples and real traffic samples respectively, and λ5 represents the temporal consistency loss weight;

[0029] S26. Construct a temporal consistency loss function to identify traffic trends, volatility, periodicity, and sudden events by comparing the generated malicious traffic samples with normal traffic samples:

[0030]

[0031] in, represents the temporal consistency loss function, x represents the normal traffic sample, p data (x) represents the probability distribution of normal traffic sample x, Δx real,t represents the normal flow change at time step t, Δx real,t-1 represents the change of normal traffic at time step t-1, ΔG(z,t) represents the change of malicious traffic generated by the generator at time step t, and ΔG(z,t-1) represents the change of malicious traffic generated by the generator at time step t-1;

[0032] S27. Construct a reconstruction loss function and generate malicious traffic samples based on the reconstruction loss:

[0033]

[0034] in, represents the reconstruction loss function, xgenerated Represents the generated malicious traffic sample, x real Indicates a normal traffic sample, represents the traffic sample generated by the generator, and λ6 represents the weight of the reconstruction loss;

[0035] S28. The discriminator outputs a traffic category label, which includes normal traffic and malicious traffic, and further classifies the malicious traffic according to its characteristics.

[0036] Optionally, the S3 specifically includes:

[0037] S31, performing a normalization operation on the input flow data, scaling the data value of each time step to the interval [0,1];

[0038] S32, input the normalized traffic data into the improved gated recurrent unit network, and learn the long-term dependency of the traffic data through the control mechanism of the internal reset gate and update gate. The improved gated recurrent unit network introduces an adaptive gating mechanism to perform weighted processing on different traffic patterns, and calculates the updated hidden state h t Extract traffic features;

[0039] S33. Define the loss function of the improved gated recurrent unit network and train it by minimizing the loss function:

[0040]

[0041] Among them, L GRU represents the loss function of the improved gated recurrent unit network, K represents the length of the time series, and is the number of time steps of the input flow data. represents the two-norm, Represents the current candidate hidden state, which is the increment of the current traffic time series feature, h t Represents the hidden state of the current time step t, which is the time series feature of the traffic data at time step t;

[0042] S34. After the training is completed, the time series features of the traffic data are extracted through the inference stage. The time series features include the change trend, volatility, periodicity and sudden events of the traffic data.

[0043] Optionally, the malicious traffic alarm includes attack type, traffic anomaly degree and traffic location information.

[0044] Optionally, the S5 specifically includes:

[0045] S51. Use a tracing algorithm to trace the source of the identified malicious traffic and obtain a network topology graph G = (V, E). The tracing algorithm models the traffic propagation path by analyzing the network topology structure. The network topology structure includes the connection relationship between each network node and the data transmission path. V in the network topology graph represents each node in the network, and E represents the connection relationship between nodes. The network topology is extracted through the configuration file of the network device or the routing information in the malicious traffic.

[0046] S52. Preliminary tracking of malicious traffic is performed based on the IP address and port information in the malicious traffic. The network topology of the malicious traffic is analyzed to calculate the propagation path of the traffic.

[0047]

[0048] Among them, s trace It represents the source of malicious traffic traced by network topology and malicious traffic characteristics, which is the attack source node. argmin represents the variable value when the function value takes the minimum value. V represents the node set in the network topology graph. v represents the target node. IP s represents the source IP address of the malicious traffic, e represents the path, cost(e) represents the cost metric of the path, E path (IP s ,v) represents the set of path edges from the source IP address to the destination node v;

[0049] S53. Track the propagation path of the malicious traffic, reversely calculate the propagation path of the malicious traffic, analyze the propagation path of the malicious traffic in the network, and use the network topology and traffic information to calculate the traffic propagation path:

[0050]

[0051] Among them, P path Indicates the propagation path from the source IP address to the destination IP address, P paths represents the set of all propagation paths, T represents the number of time steps on the propagation path, FI(p,t) represents the flow impact measure at each time step t on path p, which is the impact of flow on the network when passing through the path, and argmax represents the variable value when the function value reaches the maximum value;

[0052] S54. Further analyze the attack source by combining traffic characteristics, compare the network topology with traffic characteristics, and further identify the node of the traffic source:

[0053]

[0054] Among them, as represents the node of the traffic source, Δx flowIndicates the flow change characteristics, which is the fluctuation of flow over time, FPM(v,Δx flow ,P path ) represents the traffic pattern and traffic change characteristics Δx at node v flow degree of matching;

[0055] S55. After determining the attack source node by analyzing the tracing results, the system will provide key information of the attack source node, including the source IP address, attack time, and attack traffic characteristics.

[0056] The beneficial effects of the present invention are:

[0057] First, the generator of a generative adversarial network (GAN) generates temporal and variable malicious traffic samples, further enhancing the malicious traffic detection model's ability to identify complex attack patterns. By introducing a temporal consistency loss function and a reconstruction loss function, the generated malicious traffic samples are closer to real network traffic. This not only better captures traffic fluctuations and periodic changes, but also demonstrates high adaptability across a variety of attack modes, significantly improving the ability to identify new or variant attack patterns.

[0058] Secondly, during the detection process, the improved gated recurrent unit network analyzes the temporal characteristics of the input traffic data, capturing long-term dependencies in attack traffic and further optimizing the detection model's performance. In particular, the synergistic effect of temporal feature extraction and malicious traffic sample generation enables the present invention to not only detect static traffic characteristics but also identify sudden events, fluctuation patterns, and potential attack trends within the time series, thereby improving the accuracy of malicious traffic identification.

[0059] In addition, traditional tracing methods usually rely on static IP addresses and port information, making it difficult to deal with complex attack methods such as distributed denial of service (DDoS). However, the present invention combines network topology analysis with malicious traffic characteristics and adopts a dynamic tracking mechanism to accurately track the propagation path of traffic and determine the source of the attack through reverse calculation technology. Accurately locating the source of the attack not only improves the efficiency of tracing, but also makes the tracing system more resistant to variability and able to quickly respond to new attack patterns.

[0060] Finally, based on malicious traffic samples and tracing results, the malicious traffic detection model's adaptive learning mechanism dynamically adjusts model parameters, such as the learning rate, number of network layers, and activation functions, enabling the model to adapt to the changing characteristics of different attack types. By introducing a dynamic optimization mechanism, the model not only improves its accuracy during training but also self-adjusts to the changing attack environment during real-time detection, enhancing the system's robustness and adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0062] Figure 1 This is a flowchart of a network security malicious traffic detection and tracing method based on a generative adversarial network proposed by the present invention;

[0063] Figure 2 This is a workflow diagram of the generator and discriminator of a network security malicious traffic detection and tracing method based on a generative adversarial network proposed by the present invention. DETAILED DESCRIPTION

[0064] The present invention will now be described in further detail with reference to the accompanying drawings, which are simplified schematic diagrams that illustrate the basic structure of the present invention in a schematic manner.

[0065] refer to Figure 1 and Figure 2 A network security malicious traffic detection and tracing method based on a generative adversarial network includes the following steps:

[0066] S1. Collect normal traffic samples and malicious traffic samples from the actual network, and mix the normal traffic samples and malicious traffic samples to form a training data set;

[0067] S2. Train a malicious traffic detection model based on the generator and discriminator of the improved generative adversarial network. The generator is trained based on the training dataset to generate malicious traffic samples with temporal and variable characteristics. The discriminator compares the malicious traffic samples generated by the generator with normal traffic samples, identifies the differences between the two, and outputs a traffic category label.

[0068] S3. Analyze the input traffic data using the improved gated recurrent unit network to capture the time series characteristics of the traffic data;

[0069] S4. Combining the improved gated recurrent unit network analysis results and the malicious traffic samples generated by the generator, the malicious traffic detection model is used to analyze the input traffic data and output a malicious traffic alert.

[0070] S5. Trace the source of identified malicious traffic, analyze its propagation path, and reversely infer the attack source based on traffic characteristics, providing key information about the attack path and the initiator.

[0071] S6. Dynamically adjust the parameters of the malicious traffic detection model based on the malicious traffic samples and tracing results generated by the generator;

[0072] S7. By improving the automatic learning mechanism of the generative adversarial network, the generator and discriminator are continuously optimized. The generator continuously generates new malicious traffic samples, and the discriminator adjusts the judgment criteria based on the traffic samples to simulate different types of attack traffic.

[0073] In this embodiment, S2 specifically includes:

[0074] S21. Initialize an improved generative adversarial network, wherein the improved generative adversarial network includes a generator and a discriminator. The input of the generator is a training data set, and the input of the discriminator is generated malicious traffic samples and normal traffic samples. The generator generates malicious traffic samples that are temporal and variable, and the discriminator compares the malicious traffic samples generated by the generator with the normal traffic samples, identifies the difference between malicious traffic and normal traffic, and outputs a traffic category label. The improvements of the improved generative adversarial network include introducing a temporal loss function into the generator loss function, introducing a reconstruction loss function into the generator loss function, and introducing a temporal consistency loss function into the discriminator loss function.

[0075] S22. Train the generator based on the training dataset. The training goal is to generate malicious traffic samples with temporal and variability, and construct the generator's loss function:

[0076]

[0077] Among them, L G represents the loss function of the generator, D(G(z)) represents the score of the discriminator on the generated traffic sample, G(z) represents the malicious traffic sample output by the generator, z represents the input noise vector, and p z (z) represents the probability distribution of the input noise vector z, E represents the mathematical expectation, ∥∥ 2 represents the second norm, λ1 and λ2 represent the weights of the time series characteristics and the loss of the variation amplitude, ΔG(z) represents the variation amplitude of the generated traffic sample in the time series, and x real represents normal traffic samples, T(G(z)) and T(x real ) represent the time series features of generated traffic samples and normal traffic samples respectively, and T represents the time series feature extraction operator;

[0078] S23. Train the discriminator based on the training dataset. The training goal is to identify the difference between malicious traffic samples generated by the generator and normal traffic samples, and define the loss function of the discriminator:

[0079]

[0080] Among them, L Drepresents the loss function of the discriminator, x represents the normal traffic sample, p data (x) represents the probability distribution of normal traffic sample x, D(x) represents the score of the discriminator for normal traffic sample x, E represents the mathematical expectation, ∥∥ 2 represents the two-norm, λ3 and λ4 represent the weights of temporal consistency loss and gradient penalty, D(G(z)) represents the score of the discriminator on the generated traffic sample, x real represents normal traffic samples, T(G(z)) and T(x real ) represent the time series characteristics of generated traffic samples and normal traffic samples, respectively. represents the gradient of the discriminator to the input flow sample;

[0081] S24. The generator and discriminator are iteratively updated through adversarial training. The generator minimizes the loss function of generating malicious traffic samples, and the discriminator updates its parameters by maximizing the distinction between malicious traffic and normal traffic.

[0082] S25. Construct a temporal loss function to enhance temporal characteristics during generator training. By learning temporal patterns, periodic fluctuations, and emergencies in the network, we can generate diverse malicious traffic samples.

[0083]

[0084] in, Represents the temporal loss function, Δx t represents the normal flow variation at time step t, Denotes the change of malicious traffic generated by the generator at time step t, T(G(z)) and T(x real ) represent the temporal characteristics of generated traffic samples and real traffic samples respectively, and λ5 represents the temporal consistency loss weight;

[0085] S26. Construct a temporal consistency loss function to identify traffic trends, volatility, periodicity, and sudden events by comparing the generated malicious traffic samples with normal traffic samples:

[0086]

[0087] in, represents the temporal consistency loss function, x represents the normal traffic sample, p data (x) represents the probability distribution of normal traffic sample x, Δx real,t represents the normal flow change at time step t, Δx real,t-1represents the change of normal traffic at time step t-1, ΔG(z,t) represents the change of malicious traffic generated by the generator at time step t, and ΔG(z,t-1) represents the change of malicious traffic generated by the generator at time step t-1;

[0088] S27. Construct a reconstruction loss function and generate malicious traffic samples based on the reconstruction loss:

[0089]

[0090] in, represents the reconstruction loss function, x generated Represents the generated malicious traffic sample, x real Indicates normal traffic samples, represents the traffic sample generated by the generator, and λ6 represents the weight of the reconstruction loss;

[0091] S28. The discriminator outputs a traffic category label, which includes normal traffic and malicious traffic, and further classifies the malicious traffic according to its characteristics.

[0092] In this embodiment, S3 specifically includes:

[0093] S31, performing a normalization operation on the input flow data, scaling the data value of each time step to the interval [0,1];

[0094] S32, input the normalized traffic data into the improved gated recurrent unit network, and learn the long-term dependency of the traffic data through the control mechanism of the internal reset gate and update gate. The improved gated recurrent unit network introduces an adaptive gating mechanism to perform weighted processing on different traffic patterns, and calculates the updated hidden state h t Extract traffic features;

[0095] S33. Define the loss function of the improved gated recurrent unit network and train it by minimizing the loss function:

[0096]

[0097] Among them, L GRU represents the loss function of the improved gated recurrent unit network, K represents the length of the time series, and is the number of time steps of the input flow data. represents the two-norm, Represents the current candidate hidden state, which is the increment of the current traffic time series feature, h t Represents the hidden state of the current time step t, which is the time series feature of the traffic data at time step t;

[0098] S34. After the training is completed, the time series features of the traffic data are extracted through the inference stage. The time series features include the change trend, volatility, periodicity and sudden events of the traffic data.

[0099] In this embodiment, the malicious traffic alarm includes attack type, traffic anomaly degree and traffic location information.

[0100] In this embodiment, the S5 specifically includes:

[0101] S51. Use a tracing algorithm to trace the source of the identified malicious traffic and obtain a network topology graph G = (V, E). The tracing algorithm models the traffic propagation path by analyzing the network topology structure. The network topology structure includes the connection relationship between each network node and the data transmission path. V in the network topology graph represents each node in the network, and E represents the connection relationship between nodes. The network topology is extracted through the configuration file of the network device or the routing information in the malicious traffic.

[0102] S52. Preliminary tracking of malicious traffic is performed based on the IP address and port information in the malicious traffic. The network topology of the malicious traffic is analyzed to calculate the propagation path of the traffic.

[0103]

[0104] Among them, s trace It represents the source of malicious traffic traced by network topology and malicious traffic characteristics, which is the attack source node. argmin represents the variable value when the function value takes the minimum value. V represents the node set in the network topology graph. v represents the target node. IP s represents the source IP address of the malicious traffic, e represents the path, cost(e) represents the cost metric of the path, E path (IP s ,v) represents the set of path edges from the source IP address to the destination node v;

[0105] S53. Track the propagation path of the malicious traffic, reversely calculate the propagation path of the malicious traffic, analyze the propagation path of the malicious traffic in the network, and use the network topology and traffic information to calculate the traffic propagation path:

[0106]

[0107] Among them, P path Indicates the propagation path from the source IP address to the destination IP address, P pathsrepresents the set of all propagation paths, T represents the number of time steps on the propagation path, FI(p,t) represents the flow impact measure at each time step t on path p, which is the impact of flow on the network when passing through the path, and argmax represents the variable value when the function value reaches the maximum value;

[0108] S54. Further analyze the attack source by combining traffic characteristics, compare the network topology with traffic characteristics, and further identify the node of the traffic source:

[0109] as=argmax v∈V (FPM(v,Δx flow ,P path ));

[0110] Among them, as represents the node of the traffic source, Δx flow Indicates the flow change characteristics, which is the fluctuation of flow over time, FPM(v,Δx flow ,P path ) represents the traffic pattern and traffic change characteristics Δx at node v flow degree of matching;

[0111] S55. After determining the attack source node by analyzing the tracing results, the system will provide key information of the attack source node, including the source IP address, attack time, and attack traffic characteristics.

[0112] Example 1:

[0113] To verify the feasibility of this invention, we applied it to the network security system of a large financial institution. This financial institution handles a large volume of online transactions and sensitive user information, and therefore faces urgent network security needs. To address the malicious traffic threats faced by the institution, particularly DDoS attacks, botnet attacks, and other complex network attacks, the malicious traffic detection and tracing method of this invention was selected for use in the institution's network protection system.

[0114] The financial institution's network architecture consists of multiple subnets, each responsible for different business functions, such as user account management, fund transactions, and loan applications. All subnets are subject to rigorous security inspections and monitoring. While traditional malicious traffic detection systems based on signature matching can detect some known attack patterns, the proliferation of new attack methods has rendered existing systems ineffective. In particular, they lack sensitivity to the timing and dynamic nature of traffic, making it difficult to promptly identify potential attacks.

[0115] In practical applications, the malicious traffic detection and tracing method based on the improved generative adversarial network and the improved gated recurrent unit network first constructs a training dataset by collecting normal and malicious traffic samples from the network. Collaborating with the technical team behind the invention, a financial institution selected a three-month pilot project for testing within the institution's production environment.

[0116] During the malicious traffic detection phase, a generative adversarial network (GAN) was used to generate malicious traffic samples that exhibit temporal and variable characteristics. By learning from network traffic samples in the training dataset, the generator was able to generate malicious traffic that closely resembled real-world network environments. These generated malicious traffic samples reflected characteristics such as temporal fluctuations, sudden events, and periodic changes in attack traffic, enhancing the sensitivity of malicious traffic detection, particularly its ability to identify novel attack patterns.

[0117] To further enhance detection effectiveness, an improved Gated Recurrent Unit (GRU) network is used to analyze the temporal characteristics of traffic data. By learning the long-term dependencies and temporal variations in traffic data, the GRU network accurately captures the temporal differences between normal and malicious traffic. This process not only detects traffic content characteristics but also identifies traffic trends and unexpected events, providing a more comprehensive analytical tool for real-time detection of malicious traffic.

[0118] During the tracing phase, the combination of generated malicious traffic samples and network topology effectively tracked the source of the malicious traffic. By using tracing algorithms to track the traffic's propagation path and infer the attack's source, the financial institution was able to promptly block the attack's source in its early stages, preventing it from spreading further. The tracing results also helped the institution analyze the attack path and the underlying malicious traffic characteristics, providing critical data for subsequent defense strategies.

[0119] Table 1 Experimental comparison data table

[0120]

[0121]

[0122] In terms of malicious traffic identification, the malicious traffic identification rate increased by 25%, from 72% with traditional methods to 96%. This shows that the malicious traffic detection method based on the improved generative adversarial network and the improved gated recurrent unit network can more accurately identify complex and changing malicious traffic, especially when facing new attack patterns, with greater adaptability and accuracy.

[0123] In terms of DDoS attack detection, traditional methods have an accuracy rate of only 70%, but the method of this invention has increased the detection accuracy to 94%. This improvement can be attributed to the fact that the method of this invention can accurately reflect the time series characteristics of attack traffic, including traffic volatility and sudden events, when generating malicious traffic samples. This enables the detection system to more effectively identify and respond to large-scale distributed denial of service (DDoS) attacks.

[0124] In terms of traceability, the present invention also significantly improves its traceability accuracy, reaching 90%, a 30% increase compared to the 60% of traditional methods. Traditional traceability methods typically rely on static IP addresses and port information, and when faced with complex attack forms, they are often unable to effectively track the source of the attack. By combining malicious traffic samples generated by an improved generative adversarial network with network topology analysis, the present invention can accurately infer the propagation path of malicious traffic and quickly locate the source of the attack, significantly improving traceability accuracy.

[0125] The method of the present invention also outperforms traditional methods in terms of response time. During high-traffic periods, traditional methods take 7 seconds to detect malicious traffic, while the method of the present invention takes only 3 seconds, an improvement of approximately 60%. This advantage enables the system to quickly identify malicious traffic during periods of high traffic and concentrated attack traffic, and respond promptly, effectively preventing serious damage to the system caused by attacks.

[0126] In terms of malicious traffic sample detection, the detection success rate of malicious traffic samples increased from 80% to 94%, further proving that the present invention can stably and efficiently identify different types of malicious traffic in practical applications, especially when facing highly variable and difficult-to-identify attack types, the detection accuracy and stability have been greatly enhanced.

[0127] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A network security malicious traffic detection and tracing method based on generative adversarial network, characterized by: The steps include: S1. Collect normal traffic samples and malicious traffic samples from the actual network, and mix the normal traffic samples and malicious traffic samples to form a training data set; S2. Train a malicious traffic detection model based on the generator and discriminator of the improved generative adversarial network. The generator is trained based on the training dataset to generate malicious traffic samples with temporal and variable characteristics. The discriminator compares the malicious traffic samples generated by the generator with normal traffic samples, identifies the differences between the two, and outputs a traffic category label. S3. Analyze the input traffic data using the improved gated recurrent unit network to capture the time series characteristics of the traffic data; S4. Combining the improved gated recurrent unit network analysis results and the malicious traffic samples generated by the generator, the malicious traffic detection model is used to analyze the input traffic data and output a malicious traffic alert. S5. Trace the source of identified malicious traffic, analyze its propagation path, and reversely infer the attack source based on traffic characteristics, providing key information about the attack path and the initiator. S6. Dynamically adjust the parameters of the malicious traffic detection model based on the malicious traffic samples and tracing results generated by the generator; S7. By improving the automatic learning mechanism of the generative adversarial network, the generator and discriminator are continuously optimized. The generator continuously generates new malicious traffic samples, and the discriminator adjusts the judgment criteria based on the traffic samples to simulate different types of attack traffic. The S2 specifically includes: S21. Initialize an improved generative adversarial network, wherein the improved generative adversarial network includes a generator and a discriminator. The input of the generator is a training data set, and the input of the discriminator is generated malicious traffic samples and normal traffic samples. The generator generates malicious traffic samples that are temporal and variable, and the discriminator compares the malicious traffic samples generated by the generator with the normal traffic samples, identifies the difference between malicious traffic and normal traffic, and outputs a traffic category label. The improvements of the improved generative adversarial network include introducing a temporal loss function into the generator loss function, introducing a reconstruction loss function into the generator loss function, and introducing a temporal consistency loss function into the discriminator loss function. S22. Train the generator based on the training dataset. The training goal is to generate malicious traffic samples with temporal and variability, and construct the generator's loss function: ； in, represents the loss function of the generator, represents the score of the discriminator on the generated traffic sample, Represents the malicious traffic sample output by the generator, represents the input noise vector, represents the input noise vector The probability distribution of represents the mathematical expectation, represents the two-norm, and Represents the weight of the temporal characteristics and the loss of the amplitude of change, Indicates the variation of the generated traffic samples in time series. Indicates normal traffic samples, and Represent the time series characteristics of generated traffic samples and normal traffic samples respectively, represents the time series feature extraction operator; S23. Train the discriminator based on the training dataset. The training goal is to identify the difference between malicious traffic samples generated by the generator and normal traffic samples, and define the loss function of the discriminator: ； in, represents the loss function of the discriminator, Indicates normal traffic samples, Indicates normal traffic sample The probability distribution of Represents the discriminator for normal traffic samples Rating, represents the mathematical expectation, represents the two-norm, and represents the weights of temporal consistency loss and gradient penalty, represents the score of the discriminator on the generated traffic sample, Indicates normal traffic samples, and Represent the time series characteristics of generated traffic samples and normal traffic samples respectively, represents the gradient of the discriminator to the input flow sample; S24. The generator and discriminator are iteratively updated through adversarial training. The generator minimizes the loss function of generating malicious traffic samples, and the discriminator updates its parameters by maximizing the distinction between malicious traffic and normal traffic. S25. Construct a temporal loss function to enhance temporal characteristics during generator training. By learning temporal patterns, periodic fluctuations, and emergencies in the network, we can generate diverse malicious traffic samples. ； in, represents the temporal loss function, Represents the time step Normal flow changes, Represents the malicious traffic generated by the generator at time step changes, and Represent the time series characteristics of generated traffic samples and real traffic samples respectively, represents the temporal consistency loss weight; S26. Construct a temporal consistency loss function to identify traffic trends, volatility, periodicity, and sudden events by comparing the generated malicious traffic samples with normal traffic samples: ； in, represents the temporal consistency loss function, Indicates normal traffic samples, Indicates normal traffic sample The probability distribution of Represents the time step Normal flow changes, Represents the time step Normal flow changes, Represents the malicious traffic generated by the generator at time step changes, Represents the malicious traffic generated by the generator at time step changes; S27. Construct a reconstruction loss function and generate malicious traffic samples based on the reconstruction loss: ； in, represents the reconstruction loss function, Indicates the generated malicious traffic samples, Indicates a normal traffic sample, represents the traffic sample generated by the generator, represents the weight of reconstruction loss; S28. The discriminator outputs a traffic category label, wherein the traffic category label includes normal traffic and malicious traffic, and further classifies the malicious traffic according to its characteristics; The improved gated recurrent unit network learns the long-term dependency of traffic data through the control mechanism of internal reset gate and update gate, and introduces an adaptive gating mechanism to perform weighted processing on different traffic patterns. Extract traffic features.

2. A network security malicious traffic detection and tracing method based on a generative adversarial network according to claim 1, characterized in that: The S3 specifically includes: S31, performing a normalization operation on the input flow data, scaling the data value of each time step to the interval [0,1]; S32. Input the normalized traffic data into the improved gated recurrent unit network, learn the long-term dependency of the traffic data through the control mechanism of the internal reset gate and update gate, and extract traffic features; S33. Define the loss function of the improved gated recurrent unit network and train it by minimizing the loss function: ； in, represents the loss function of the improved gated recurrent unit network, Indicates the length of the time series, which is the number of time steps of the input flow data. represents the two-norm, Represents the current candidate hidden state, which is the increment of the current traffic time series feature. Indicates the current time step The hidden state of the traffic data at time step Time series characteristics of S34. After the training is completed, the time series features of the traffic data are extracted through the inference stage. The time series features include the change trend, volatility, periodicity and sudden events of the traffic data.

3. A network security malicious traffic detection and tracing method based on a generative adversarial network according to claim 1, characterized in that: The malicious traffic alert includes attack type, traffic anomaly level and traffic location information.

4. A network security malicious traffic detection and tracing method based on a generative adversarial network according to claim 1, characterized in that: The S5 specifically includes: S51. Use the tracing algorithm to trace the source of the identified malicious traffic and obtain the network topology map. The tracing algorithm models the traffic propagation path by analyzing the network topology structure, which includes the connection relationship between each network node and the data transmission path. Represents each node in the network, Represents the connection relationship between nodes, extracted through the configuration files of network devices or routing information in malicious traffic; S52. Preliminary tracking of malicious traffic is performed based on the IP address and port information in the malicious traffic. The network topology of the malicious traffic is analyzed to calculate the propagation path of the traffic. ； in, Indicates the source of malicious traffic traced through network topology and malicious traffic characteristics, which is the attack source node. Indicates the value of the variable when the function value reaches the minimum value, Represents a set of nodes in a network topology graph, represents the target node, Indicates the source IP address of the malicious traffic, Indicates the path, represents the cost metric of the path, Indicates the distance from the source IP address to the target node The path edge set of ; S53. Track the propagation path of the malicious traffic, reversely calculate the propagation path of the malicious traffic, analyze the propagation path of the malicious traffic in the network, and use the network topology and traffic information to calculate the traffic propagation path: ； in, Indicates the propagation path from the source IP address to the destination IP address. represents the set of all propagation paths, represents the number of time steps on the propagation path, Indicates the path At each time step The traffic impact metric is the impact of traffic on the network when it passes through the path. Indicates the value of the variable when the function value reaches the maximum value; S54. Further analyze the attack source by combining traffic characteristics, compare the network topology with traffic characteristics, and further identify the node of the traffic source: ； in, The node representing the source of traffic, Indicates the flow change characteristics, which is the fluctuation of flow over time. Indicates that the node Traffic patterns and traffic change characteristics degree of matching; S55. After determining the attack source node by analyzing the tracing results, the system will provide key information of the attack source node, including the source IP address, attack time, and attack traffic characteristics.

Images