A method and device for generating adversarial malicious traffic

Abstract

This invention relates to a method and apparatus for generating adversarial malicious traffic, belonging to the field of network security technology. The specific process of the method is as follows: generating malicious traffic feature vectors and benign traffic feature vectors, and adding noise to the malicious traffic feature vectors; inputting the noisy malicious traffic features into a generator, the pre-trained generator generates adversarial malicious traffic feature vectors and mutates them to generate mutated malicious traffic feature vectors; inputting the mutated malicious traffic feature vectors and benign traffic feature vectors into an Intrusion Detection System (NIDS), and inputting the prediction results of the NIDS into a discriminator; the discriminator classifies the prediction results of the NIDS and outputs probability values, which are used as rewards for the generator to create new adversarial mutated malicious traffic features; through adversarial training between the generator and the discriminator, the generator generates adversarial malicious traffic feature vectors that circumvent the NIDS.

Description

Technical Field

[0001] This invention relates to a method and apparatus for generating adversarial malicious traffic, belonging to the field of network security technology. Background Technology

[0002] In the current network environment, the detection and identification of encrypted traffic has become one of the core challenges in building an effective network protection system. As attackers increasingly utilize encryption technologies to conceal malicious behavior, traditional port- or load-based detection methods face significant challenges in handling complex encrypted traffic, struggling to effectively identify malicious activities hidden within it. Furthermore, the widespread application of advanced technologies such as deep learning and generative adversarial networks (GANs) enables attackers to generate adversarial samples to further circumvent existing detection methods, making adversarial encrypted traffic a critical issue that urgently needs to be addressed in network security. Therefore, improving the robustness of detection capabilities against adversarial encrypted traffic while simultaneously enhancing the performance of detection systems has become a crucial topic in the field of network security.

[0003] In addressing encrypted traffic detection, researchers both domestically and internationally have gradually shifted towards machine learning and deep learning methods to automatically extract features from encrypted traffic, improving the ability to identify potential malicious behavior. For example, models such as Convolutional Neural Networks (CNNs) and Long Short-Term Memory Networks (LSTMs) have been widely used to capture potential malicious features in network traffic, and feature selection and dimensionality reduction techniques (such as Principal Component Analysis (PCA)) are used to reduce redundant information and improve the computational efficiency of detection models. However, these traditional encrypted traffic detection systems still have significant limitations when facing adversarial examples because the payload portion of encrypted traffic is often unstructured data that is difficult to directly represent as variables. In contrast, non-payload features are more suitable for detecting attacks that rely on traffic behavior, such as DoS / DDoS, scanning, brute-force attacks, and botnet attacks, but are less effective against attacks involving specific content (such as SQL injection). Furthermore, polymorphic hybrid attacks can bypass payload-based anomaly detection; attackers can also evade detection by adding adversarial perturbations to malicious traffic, making it difficult for existing detection models to effectively identify these new adversarial examples. Therefore, how to deal with these complex perturbations during the detection process and improve the robustness of the model has become an important challenge in current research.

[0004] To address these challenges, researchers first attempted to build detection systems using techniques such as machine learning. Compared to traditional methods, machine learning techniques have lower false positive and false negative rates, but their robustness against adversarial attacks has not been fully considered and verified. The core challenge of this type of research lies in the fact that attackers may appropriately modify traffic while maintaining communication functionality and malicious characteristics, making it difficult for detection models to identify. For example, researchers are increasingly using generative models such as Generative Adversarial Networks (GANs) to generate adversarial encrypted traffic, modifying traffic characteristics to evade detection by existing systems. The core challenge of this type of research is how to appropriately modify traffic while maintaining communication functionality and malicious characteristics, making it difficult for detection models to identify. Many adversarial attack methods rely heavily on the attacker's comprehensive understanding of the target detection system, an assumption that is often difficult to meet in practical applications.

[0005] Meanwhile, some studies have also explored enhancing the anti-interference ability of detection models against adversarial attacks by introducing adversarial training and robust optimization. For example, multimodal feature fusion technology combines traffic features from the temporal, spatial, and protocol behaviors to build a more robust detection model; furthermore, adversarial training makes the model exhibit higher robustness when facing adversarial samples. To further improve the robustness of the detection system, researchers have also utilized ensemble learning techniques to combine the advantages of multiple detection models to build a more effective detection mechanism. By integrating multiple learning models, such as random forests and gradient boosting decision trees, combined with deep learning models, a multi-layered detection framework is established to effectively deal with malicious behavior in encrypted traffic. In addition, researchers are also exploring the development of more lightweight and efficient feature extraction and matching methods for low-knowledge attack scenarios that may exist in practical applications, in order to enhance the protection capability of the detection system under knowledge-constrained conditions. Therefore, future research needs to develop more flexible and robust malicious traffic generation mechanisms under low-knowledge conditions, and also needs to propose targeted detection strategies to deal with the complex strategies of attackers, thereby improving the adaptability and robustness of the detection system. Summary of the Invention

[0006] In view of this, the present invention proposes an adversarial malicious traffic generation method and apparatus, which combines generative adversarial networks, heuristic mutation techniques and reinforcement learning mechanisms to achieve diversified and covert processing of encrypted malicious traffic.

[0007] The technical solution for implementing the present invention is as follows:

[0008] Firstly, the present invention provides a method for generating adversarial malicious traffic, the specific process of which is as follows:

[0009] First, features are extracted from the traffic through feature extraction and preprocessing. The traffic data packets are converted into reversible high-dimensional metadata feature vectors, generating malicious traffic feature vectors and benign traffic feature vectors. Noise is then added to the malicious traffic feature vectors.

[0010] Secondly, the malicious traffic features with added noise are input into the generator. The pre-trained generator generates an adversarial malicious traffic feature vector and mutates the malicious traffic feature vector to generate a mutated malicious traffic feature vector.

[0011] Next, the mutated malicious traffic feature vector and benign traffic feature vector are input into the Intrusion Detection System (NIDS), and the prediction results of NIDS are input into the discriminator.

[0012] Finally, the discriminator classifies the prediction results of NIDS and outputs probability values, which are used as rewards for the generator to create new adversarial variant malicious traffic features.

[0013] Through adversarial training between the generator and the discriminator, the generator generates adversarial malicious traffic feature vectors to evade the Intrusion Detection System (NIDS).

[0014] Optionally, before the generator and discriminator form an adversarial training, the generator is pre-trained using a large-scale benign traffic feature vector.

[0015] Optionally, the loss function for adversarial training between the generator and discriminator in this invention includes adversarial loss and reconstruction loss. G ,

[0016]

[0017] Where f is the malicious traffic feature vector, z represents Gaussian distributed noise, and F mal Let L(f,z) represent the malicious traffic feature vector set, D represent the discriminator, G(f,z) represent the generator output, L(f,G(f,z)) represent the error between the generator input and output, and D(G(f,z)) represent the discriminator output.

[0018] The generator updates its parameters by maximizing the reward function J(θ):

[0019]

[0020] Where D(x) is the probability output by the discriminator for the generated sample x (i.e., the adversarial malicious traffic feature vector output by the generator), and π θ It is the parameterized generation strategy of the generator.

[0021] Optionally, the loss function of the discriminator described in this invention is:

[0022]

[0023] in, It is a benign traffic feature vector. λ is the feature vector of adversarial malicious traffic, λ is a hyperparameter controlling the strength of the gradient penalty, and D(f) represents the probability that the discriminator classifies the input feature f as genuine benign traffic. This represents a random interpolation point between genuine benign characteristics and adversarial malicious traffic characteristics. Indicates the expected value. Indicates the interpolation point gradient, Indicates the discriminator's relationship to the interpolation point The probability of judgment is given by ∥∥2, which represents the L2 norm.

[0024] Optionally, the random interpolation point between the genuine benign characteristics and the adversarial malicious traffic characteristics described in this invention for:

[0025]

[0026] Optionally, the objective function of the PPO algorithm used in this invention to optimize the generator is:

[0027]

[0028] Where, π θ (a t |s t ) represents a generator with parameter θ in state s t Take action a t The probability, A t It is the estimation of the advantage function. This indicates that before the parameters are updated to θ, the generator is in state s. t Take action a t The probability ∈ is a hyperparameter used to control the range of policy updates.

[0029] Optionally, the present invention employs the RFPMPSO traffic mutation optimization algorithm to mutate the malicious traffic feature vector. The RFPMPSO traffic mutation optimization algorithm is a particle swarm optimization algorithm with random mutation and dynamic sensing factor, which automatically identifies the best traffic mutation sample from the generated adversarial traffic samples.

[0030] Optionally, the specific process of mutation in the RFPMPSO traffic mutation optimization algorithm of the present invention is as follows:

[0031] The first step is to target the adversarial malicious traffic feature vector from location x. nReconstruct the mutated traffic by directly retrieving the original traffic and then using x. mal The timestamp in the middle is replaced to obtain the mutated feature vector; for the mutated feature vector, the protocol layer number that determines the protocol type is referenced.

[0032] The second step is to use an extractor to extract features from the mutated feature vector;

[0033] The third step is to calculate the distance between the extracted features and the input adversarial features to determine the mutation effect.

[0034] Optionally, the present invention also includes training the Intrusion Detection System (NIDS) using adversarial malicious traffic feature vectors generated by the generator, specifically by using an adaptive and iterative adversarial data augmentation method for training.

[0035] In a second aspect, the present invention provides an adversarial malicious traffic generation device, comprising: a processor, a generator, an identifier, and a data mutation module;

[0036] The processor is used to extract features from traffic and preprocess them, converting traffic packets into reversible high-dimensional metadata feature vectors, generating malicious traffic feature vectors and benign traffic feature vectors, and adding noise to the malicious traffic feature vectors.

[0037] A generator is used to receive malicious traffic features with added noise and generate adversarial malicious traffic feature vectors.

[0038] The data mutation module is used to mutate the malicious traffic feature vector to generate a mutated malicious traffic feature vector.

[0039] The discriminator receives the prediction results of the mutated malicious traffic feature vector and benign traffic feature vector from the intrusion detection system NIDS, outputs the prediction results for classification and outputs probability values, and uses them as rewards for the generator to create new adversarial mutated malicious traffic features.

[0040] Through adversarial training between the generator and the discriminator, the generator generates adversarial malicious traffic feature vectors to evade the Intrusion Detection System (NIDS).

[0041] Beneficial effects:

[0042] First, the generator continuously optimizes its generation strategy through reinforcement learning to improve the stealth and deceptiveness of adversarial traffic, making it more difficult for traditional network intrusion detection systems (NIDS) to effectively detect these variant traffic.

[0043] Secondly, this invention also proposes a highly robust detection model based on an adaptive and iterative adversarial data augmentation method, forming a complete network security solution to systematically improve the detection performance against adversarial encrypted malicious traffic. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 A framework for counter-encrypted malicious traffic attacks;

[0046] Figure 2 This is a flowchart of the attack framework;

[0047] Figure 3 This is a flowchart of the AADA method. Detailed Implementation

[0048] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0049] It should be noted that, in the absence of conflict, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0050] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0051] This invention first designs an attack framework for generating adversarial encrypted malicious traffic, aiming to generate adversarial malicious traffic samples capable of circumventing existing Network Intrusion Detection Systems (NIDS). The attack framework is designed as follows: Figure 1 As shown, the entire workflow and components of the system are described in detail.

[0052] This attack framework includes several key modules:

[0053] (1) Generator: Generate adversarial malicious traffic feature vectors based on malicious traffic features with added noise;

[0054] (2) Discriminator: Classifies benign traffic and malicious traffic, and feeds the classification results back to the generator as a reward for the generator to create new adversarial variant malicious traffic features;

[0055] (3) RMPFPSO algorithm module: RMPFPSO is a particle swarm optimization algorithm with random mutation and dynamic sensing factor. Its purpose is to automatically identify the best traffic mutation sample from the generated adversarial traffic samples.

[0056] This embodiment presents a method for generating adversarial malicious traffic, such as... Figure 2 As shown, the specific process is as follows:

[0057] First, features are extracted from the traffic through feature extraction and preprocessing. The traffic data packets are converted into reversible high-dimensional metadata feature vectors, generating malicious traffic feature vectors and benign traffic feature vectors. Noise is then added to the malicious traffic feature vectors.

[0058] Secondly, the malicious traffic features with added noise are input into the generator. The pre-trained generator generates an adversarial malicious traffic feature vector and mutates the malicious traffic feature vector to generate a mutated malicious traffic feature vector.

[0059] Next, the mutated malicious traffic feature vector and benign traffic feature vector are input into the Intrusion Detection System (NIDS), and the prediction results of NIDS are input into the discriminator.

[0060] Finally, the discriminator classifies the prediction results of NIDS and outputs probability values, which are used as rewards for the generator to create new adversarial variant malicious traffic features.

[0061] Through adversarial training between the generator and the discriminator, the generator generates adversarial malicious traffic feature vectors to evade the Intrusion Detection System (NIDS).

[0062] In this embodiment, the generator is pre-trained on the reversible high-dimensional metadata feature vector of benign traffic packets to generate adversarial malicious traffic feature vectors. The RFPMPSO algorithm is then used to mutate these malicious traffic feature vectors to create mutated malicious traffic feature vectors. The generated malicious and benign samples are simultaneously input into an Intrusion Detection System (NIDS) to simulate gray-box and black-box attacks. The NIDS prediction results are then input into a discriminator. The discriminator is implemented using a neural network classifier, outputting a probability value as a reward for the generator to create new adversarial mutated malicious traffic features. Through adversarial training between the generator and discriminator, adversarial malicious samples capable of circumventing the NIDS are generated, and these adversarial samples are used to build a robust classifier.

[0063] In this embodiment, the generator and discriminator are trained using a joint adversarial approach:

[0064] (1) Generator

[0065] The generator uses a Transformer-based model pre-trained on large-scale benign traffic data, leveraging a self-attention mechanism to enhance feature representation capabilities. The model comprises an input layer, an embedding layer, a self-attention mechanism, and a feedforward neural network. Through multi-head self-attention, the model computes the correlations between feature vectors in the input sequence, generating new feature representations. The feedforward neural network further performs non-linear transformations on these features, improving the complexity and accuracy of the feature representations. Pre-training uses benign traffic, then malicious feature vectors are input for adversarial training, transforming malicious traffic mutated feature vectors into adversarial mutated feature vectors that can be treated as benign traffic by the detection model.

[0066] During the adversarial training of the generator, the generator receives a malicious feature vector f and a Gaussian distribution p. z The noise vector of (z) is taken as input, and the generated feature vector G(f,z) is output. To train the generator, this embodiment defines a loss function l that combines adversarial loss and reconstruction loss. G And it is extended by additionally calculating the build error L between the input and output, as shown below:

[0067]

[0068] Among them, F mal This represents the original malicious feature set, where D is the discriminator, and l G The weights should be minimized. L(f,G(f,z)) represents the error between the generator input and output. Adversarial: maximize logD(G(f,z) (scam the discriminator); Fidelity: minimize L(f,G(f,z)) (preserve malice).

[0069] (2) Discriminator

[0070] The discriminator, acting as a substitute classifier (i.e., C(·)), is trained to distinguish between generated malicious and benign features. It is also a feedforward neural network, taking as input a benign feature vector Fben and a malicious feature vector Fgen generated by the generator, and outputting the probability that the input vector is generated (i.e., malicious). This probability serves as the reward for the generator to update its parameters, which are achieved by maximizing the following reward function J(θ):

[0071]

[0072] Where D(x) is the probability that the discriminator outputs for the generated sample x, and π θ It is the parameterized generation strategy of the generator, which represents how the generator generates adversarial examples G(f,z) based on the input (malicious features f and noise z).

[0073] The discriminator is trained to maximize the output of generated input vectors while minimizing the output of benign input vectors. To enhance the training stability and the diversity of generated features, this embodiment introduces a gradient penalty mechanism. Gradient penalty helps ensure smooth decision boundaries for the discriminator, preventing the generator from generating overly extreme features. The loss function of the discriminator is:

[0074]

[0075] in, It is a set of features extracted from benign traffic collected from networks controlled by attackers. λ is the feature set generated by the generator, λ is the hyperparameter that controls the intensity of the gradient penalty, D(f) represents the probability of the discriminator judging the input feature f, and λ represents the probability that the discriminator considers f to be a real benign sample. Represents random interpolation points between real benign features and generated features. This represents the expected value, indicating the operation on the mean of the data distribution. Indicates the interpolation point gradient, Indicates the discriminator's relationship to the interpolation point The decision probability, ∥∥2 represents the L2 norm, used to measure the gradient strength; gradient penalty term. Ensure that the gradient of the discriminator remains consistent around the interpolation point.

[0076]

[0077] The training process is an iterative optimization between the generator and the discriminator until convergence. The features generated by the generator can be used as adversarial features.

[0078] This invention employs a heuristic packet construction algorithm to generate mutated malicious traffic with reversible metadata characteristics. These mutated samples retain their original malicious characteristics while modifying the traffic features to evade identification by existing detection systems.

[0079] To further optimize the generator's performance, this embodiment uses the PPO algorithm. PPO is a policy optimization algorithm used in reinforcement learning. Its main goal is to optimize the agent's policy so that it can obtain higher cumulative rewards in a specific environment, solving the problem of "policy updates being too fast" in reinforcement learning. It also improves stability by limiting the magnitude of each update, thus optimizing the generator's performance in generating adversarial feature vectors.

[0080] The objective function for optimizing the generator using the PPO algorithm is:

[0081]

[0082] Where, π θ (a t |s t ) indicates that the generator is in state s t Take action a t The probability, A t ∈ is the advantage function estimate, and ∈ is a hyperparameter used to control the range of policy updates. The PPO algorithm can be used to optimize the generator's performance in generating adversarial feature vectors. This indicates the situation before the policy update, i.e., when the parameter is θ. old The generator in state s t Take action a t The probability. Policy updates are achieved by comparing the old and new policies (i.e., the policies before and after the update).

[0083] The specific processing procedure of the RFPMPSO traffic variation optimization algorithm in this embodiment is as follows:

[0084] To automatically and efficiently select the optimal traffic mutation samples from system-generated adversarial traffic, this invention designs an algorithm based on RMPFPSO (Particle Swarm Optimization with Random Mutation and Dynamic Sensing Factor). In this algorithm framework, each particle represents a potential traffic mutation, possessing a position and a velocity vector. Each position vector in the swarm represents a meta-information vector x. n (where n ranges from 1 to N) swarm N swarm (representing the total number of particles), the velocity vector is denoted as v. n Its structure is similar to x n The same applies. The algorithm using RMPFPSO will be explained in detail below.

[0085] Initialization: Initially, to ensure that the initial particles are uniformly distributed in the search space, x cat [] and x mal The fields within it are randomly initialized within their valid range. For x mal The timestamp in the data will be the maximum arrival time between consecutive raw data packets (compared to L). t (Related) is divided into m equal parts, and timestamps are randomly selected from these segments. Furthermore, v n Initially set to zero.

[0086] Performance evaluation: In each iteration, based on the particle's position x n (where n∈{1,2,…,N) swarm Assess its proximity to the target. The effect is defined by equation (5):

[0087]

[0088] in, A set (or feature library) representing the characteristics of malicious traffic. This set contains multiple "malicious feature vectors" that are predefined or extracted from historical malicious samples. R(x) n ) represents the particle position vector x n Specific flow variation samples generated after reconstruction or decoding. The position x of each particle in the search space. n This represents a set of metadata that, after being transformed by the function R, yields a simulated network traffic data instance. This instance can be used for subsequent feature extraction and evaluation. ε′ is a feature evaluation (or extraction) function. This function is derived from R(x n The generated traffic samples are used to extract feature vectors for comparison, and these features may be enhanced or normalized in some way. In this way, the resulting feature vectors can be compared with preset malicious feature vectors.

[0089] By calculating and generating traffic samples (from R(x)) n The reconstructed vector, after being processed by the feature extraction function ε′, is compared with the preset malicious feature vector f (from the malicious feature set). The difference between samples (extracted from or compared with the target malicious traffic) is used to measure the validity of the samples (i.e., their similarity to the target malicious features). This design provides an objective function for the particle swarm optimization algorithm, allowing the algorithm to automatically optimize traffic mutation samples during the search process, making them increasingly closer to or mimicking the characteristics of the target malicious traffic.

[0090] This process can be divided into three steps: The first step is to target the adversarial malicious traffic feature vector from position x. n Reconstruct the variability flow (denoted as R), retrieve the original flow directly, and then use x. malThe timestamp in the middle is replaced to obtain the mutated feature vector; for the mutated feature vector, after randomly determining its protocol type, refer to x. craft The protocol layer number in [i]. The second step is to extract features (denoted as ε) from the mutated feature vector using an alternative extractor. The third step is to calculate the distance between the extracted features and the input adversarial features according to formula (5) to determine the effect.

[0091] This embodiment ensures that the mutated traffic is legal in terms of protocol structure and conforms to actual network specifications by using a protocol template library. This solves the common protocol structure error problems in traditional traffic mutation methods (such as missing transport layer headers and illegal field values), thereby significantly improving the concealment of adversarial traffic and the success rate of attacks.

[0092] Update: x has been evaluated. n After determining the optimal effect, record the position where the effect is achieved as the individual's optimal position, denoted as b. n The best position in the group is called the global best position, denoted as g.

[0093] Subsequently, each particle updates its velocity v according to the following formula. n :

[0094] v nd =ω1v nd +r1c1(b nd -x nd )+r2c2(g d -x nd )+ω2r3(p if -x nd (6)

[0095] Here, the subscript d indicates the d-th dimension of the particle in the multidimensional search space. That is, when the particle's position, velocity, and optimal position are all vectors, d is used to indicate the value of a specific dimension within these vectors.

[0096] The first term represents the particle's "inertia," indicating its tendency to maintain its previous velocity. The second and third terms represent the particle's "cognitive" and "social" components, indicating its tendency to move towards its own historical best position and the group's historical best position. The fourth term is the random mutation component, representing the particle's exploration of its local space, enhancing its driving force, and enriching the diversity of the group. r1, r2, and r3 are random numbers ranging from [0,1]. To simplify the algorithm's complexity and enhance its later mining capabilities, ω1 and ω2 are set to be equal, both employing a non-linear decreasing weight strategy. if This represents randomly mutated particles, obtained through a simplified, complex method. Then, the particle position x is updated. nAt the same time, combined with the perception factor, particles can dynamically and adaptively control their spatial distance from other particles in the same dimension:

[0097]

[0098] in, d represents the average distance between particles. k ω3 represents the distance between particles within a specific dimension, and ω3 is the inertial weighting coefficient.

[0099] Iteration complete: The above two steps (evaluation and update) are repeated a fixed number of times, denoted as N. iter The traffic reconstructed from the current global best position g is identified as the best avoidable mutation.

[0100] This application provides an adversarial malicious traffic generation device, including a processor, a generator, an identifier, and a data mutation module;

[0101] The processor is used to extract features from traffic and preprocess them, converting traffic packets into reversible high-dimensional metadata feature vectors, generating malicious traffic feature vectors and benign traffic feature vectors, and adding noise to the malicious traffic feature vectors.

[0102] A generator is used to receive malicious traffic features with added noise and generate adversarial malicious traffic feature vectors.

[0103] The data mutation module is used to mutate the malicious traffic feature vector to generate a mutated malicious traffic feature vector.

[0104] The discriminator receives the prediction results of the mutated malicious traffic feature vector and benign traffic feature vector from the intrusion detection system NIDS, outputs the prediction results for classification and outputs probability values, and uses them as rewards for the generator to create new adversarial mutated malicious traffic features.

[0105] Through adversarial training between the generator and the discriminator, the generator generates adversarial malicious traffic feature vectors to evade the Intrusion Detection System (NIDS).

[0106] Furthermore, the NIDS model for detecting adversarial encrypted malicious traffic is trained to achieve adaptive and iterative adversarial data augmentation.

[0107] To address the challenges posed by adversarial encrypted malicious traffic to detection systems, this application proposes a highly robust encrypted traffic defense strategy: Adaptive and Iterative Adversarial Data Augmentation (AADA). This strategy dynamically adjusts the model's defense capabilities by continuously generating new adversarial samples and incorporating them into the training set. This approach combines automated testing and retraining frameworks to progressively enhance the robustness of NIDS.

[0108] The core idea of ​​AADA is to identify and exploit potential weaknesses in NIDS (National Information Disclosure System) to generate samples that enhance defense capabilities, thereby improving the adaptability and accuracy of detection systems against complex encrypted traffic attacks. Strategy design includes... Figure 3 As shown, the process includes the following:

[0109] 1. Identify potential weaknesses and target attack patterns

[0110] During training, NIDS analyzes different categories of encrypted traffic and classifies it based on statistical characteristics and patterns. However, due to the stealthy nature of encrypted traffic, these models often have weaknesses that are not fully learned, especially when facing adversarial encrypted traffic. These weaknesses may manifest as specific traffic characteristics or patterns that are easily deceived by malicious traffic through subtle perturbations.

[0111] AADA's first step is to identify these weaknesses through continuous training and testing. For example, if the NIDS detection model has a high false positive rate for a certain type of encrypted traffic, AADA will generate highly deceptive adversarial examples to address this false positive situation. The generation of these adversarial examples is not simply "optimization," but rather a dynamic adjustment of the generation strategy to ensure that each generated adversarial example effectively "approaches" the defense limits of the detection system, breaking the model's original robustness. Through iterative learning, these weaknesses are continuously analyzed, and appropriate adversarial examples are generated based on the analysis results. The generated examples not only strengthen the model's defense capabilities but also ensure that the characteristics of the traffic remain concealed during encryption, preventing easy identification by the detection model.

[0112] 2. Applications of deep generative models

[0113] AADA employs deep generative models (such as Generative Adversarial Networks, GANs) to generate adversarial examples.

[0114] Based on the existing traffic generation adversarial framework architecture, the generator's task is to generate "fake" data, while the discriminator (i.e., classifier) ​​is responsible for determining whether this data belongs to the real data category.

[0115] In AADA's defense strategy, the generator's task is to generate samples that can confuse NIDS and ensure that these samples are similar to the original encrypted traffic. The samples are also slightly perturbed to generate adversarial traffic samples that can deceive NIDS.

[0116] Unlike traditional adversarial example generation methods, AADA's generator focuses not only on the magnitude of the perturbation or its impact on model classification, but also on the naturalness and stealth of the generated examples. The generated adversarial examples must not only mislead the detection model, but also closely resemble the original encrypted traffic, thus avoiding significant distortion of traffic characteristics due to excessive interference.

[0117] 3. Combination of adversarial loss and feature loss

[0118] Another important aspect of the AADA method is its strategy of combining adversarial loss and feature loss. This strategy ensures that the generated adversarial examples not only effectively confuse the detection model, but also maintain the naturalness of the traffic and avoid excessive perturbation that leads to distortion of traffic features.

[0119] Adversarial Loss: This loss aims to maximize the misleading effect of generated samples on the detection model. Its core objective is to optimize the generator so that the generated adversarial examples cause the target model to make incorrect predictions. Similar to traditional adversarial training, the goal of generating samples is to make the model's output labels as different from the true labels as possible, or to predict a specific target label (i.e., a targeted attack).

[0120] Feature Loss: Unlike traditional adversarial loss, the purpose of feature loss is to ensure that the generated adversarial sample has similar characteristics to the original encrypted traffic. This is especially important for encrypted traffic because excessive perturbation can cause significant changes in traffic characteristics, resulting in a large difference in statistical features between the generated adversarial sample and the real traffic, thus making it detectable by the detection system. Therefore, AADA uses feature loss to ensure that the generated sample is structurally consistent with the original traffic, while effectively avoiding anomalous changes in the traffic.

[0121] 4. Dynamic adjustment and iterative optimization

[0122] AADA's generation process is not a one-time event, but a dynamic optimization process. After each adversarial example is generated, the model provides feedback on its performance, and the generator and discriminator adjust based on the effectiveness of the generated examples. Specifically, in each training round, AADA dynamically adjusts its generation strategy based on the current model's attack success rate and the fidelity of traffic features to approach the defense limits of the detection system.

[0123] Each adversarial example generation is fine-tuned based on the target model's misjudgment patterns. If a generated adversarial example fails to fool the detection model in certain situations, AADA identifies its potential weaknesses and adjusts the generation strategy to improve effectiveness. For example, if some generated examples fail to effectively fool the detection system, AADA adjusts parameters such as the generator's network structure, the weights of the adversarial loss, or the perturbation size. AADA ensures that the generated adversarial examples are more effective in subsequent training rounds and can gradually improve the attack success rate, thus enhancing the system's robustness against different adversarial examples. This dynamic optimization approach ensures that the defense system continuously improves its adaptability and robustness as attack patterns evolve. By adjusting parameters such as the generator's network structure, the weights of the adversarial loss, or the perturbation size, AADA ensures that the generated adversarial examples are more effective in subsequent training rounds and can gradually improve the system's attack success rate.

[0124] 5. Preservation and concealment of encrypted traffic characteristics

[0125] A key characteristic of encrypted traffic is its difficulty in direct external analysis, making it an ideal vector for malicious attacks. Malicious activity within encrypted traffic can only be identified through decryption or analysis of specific statistical characteristics. Therefore, AADA (Anti-Domain Advisory Authority) pays particular attention to the stealth of generated adversarial examples within encrypted traffic. These examples must not only deceive detection models but also remain concealed within the overall characteristics of the encrypted traffic, failing to trigger alarms in detection systems.

[0126] To achieve this, AADA introduced a perturbation size control mechanism to ensure that the perturbation of each generated adversarial sample is within an acceptable range, thereby avoiding excessive interference that could lead to abnormal fluctuations in traffic. This ensures that the generated adversarial samples maintain consistency with the original traffic in terms of the statistical characteristics of encrypted traffic, thus effectively improving the defense capabilities of the detection system and preventing malicious traffic from being easily identified.

[0127] 6. Continuously iterate and improve the model's defensive capabilities.

[0128] The AADA (Adaptive Generative Adversarial Examples) method continuously enhances the defensive capabilities of a Network Intrusion Detection System (NIDS) through iterative training. Unlike traditional single-training methods, the core of AADA lies in dynamically adding each generated adversarial example to the training set, enabling the detection model to maintain high efficiency in the face of new adversarial encrypted traffic.

[0129] In each iteration, NIDS retrains with new adversarial examples, optimizing model parameters to improve its ability to identify new attack patterns. This retraining process allows the detection model to learn from new samples and update its internal parameters, gradually enhancing its robustness against adversarial encrypted traffic. With an ever-increasing amount of training data containing adversarial examples, NIDS can progressively improve its sensitivity to encrypted malicious traffic, reducing the probability of false positives and false negatives, ultimately enhancing its ability to cope with various complex attacks in real-world environments.

[0130] This iterative training mechanism not only enhances the detection system's ability to cope with new adversarial attacks, but also enables NIDS to continuously adapt to the evolution of attack patterns. With each round of training and the update of adversarial examples, AADA enables the system to handle increasingly complex adversarial encrypted traffic, ensuring stable and efficient detection performance even under heavy attack pressure.

[0131] Through this continuously optimized training strategy, AADA provides N IDS with powerful adaptive capabilities, enabling the detection system to maintain high accuracy and robustness in the face of constantly changing and increasingly complex encrypted malicious traffic, preventing malicious traffic from bypassing the detection system through constantly changing adversarial strategies.

[0132] In summary, the above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for generating adversarial malicious traffic, characterized in that, The specific process is as follows: First, features are extracted from the traffic through feature extraction and preprocessing. The traffic data packets are converted into reversible high-dimensional metadata feature vectors, generating malicious traffic feature vectors and benign traffic feature vectors. Noise is added to the malicious traffic feature vectors. Secondly, the malicious traffic features with added noise are input into the generator. The pre-trained generator generates an adversarial malicious traffic feature vector and mutates the malicious traffic feature vector to generate a mutated malicious traffic feature vector. Next, the mutated malicious traffic feature vector and benign traffic feature vector are input into the Intrusion Detection System (NIDS), and the prediction results of NIDS are input into the discriminator. Finally, the discriminator classifies the prediction results of NIDS and outputs probability values, which are used as rewards for the generator to create new adversarial variant malicious traffic features. Through adversarial training between the generator and the discriminator, the generator generates adversarial malicious traffic feature vectors to evade the Intrusion Detection System (NIDS). The malicious traffic feature vector is mutated using the RFPMPSO traffic mutation optimization algorithm, which is a particle swarm optimization algorithm with random mutation and dynamic sensing factor, and automatically identifies the best traffic mutation sample from the generated adversarial traffic samples. The specific process of the RFPMPSO traffic mutation optimization algorithm is as follows: The first step is to target the adversarial malicious traffic feature vectors, starting from location. Reconstruct the mutated traffic by directly retrieving the original traffic and then using... The timestamp in the middle is replaced to obtain the mutated feature vector; for the mutated feature vector, the protocol layer number that determines the protocol type is referenced. The second step is to use an extractor to extract features from the mutated feature vector; The third step is to calculate the distance between the extracted features and the input adversarial features to determine the mutation effect; It also includes training the Intrusion Detection System (NIDS) using adversarial malicious traffic feature vectors generated by the generator, specifically by using adaptive and iterative adversarial data augmentation.

2. The method for generating adversarial malicious traffic according to claim 1, characterized in that, The specific process is as follows: Before the generator and discriminator form an adversarial training, the generator is pre-trained using a large-scale benign traffic feature vector.

3. The method for generating adversarial malicious traffic according to claim 2, characterized in that, The loss function for adversarial training between the generator and the discriminator includes adversarial loss and reconstruction loss. , in, This is a feature vector for malicious traffic. Indicates Gaussian noise distribution. Represents a set of feature vectors for malicious traffic. Indicates the discriminator, This represents the output of the generator. This represents the error between the generator's input and output. This indicates the output of the discriminator; The generator maximizes the reward function. To update its parameters: in, It is the discriminator's evaluation of the samples generated by the generator. The probability of the output. It is the parameterized generation strategy of the generator.

4. The method for generating adversarial malicious traffic according to claim 3, characterized in that, The loss function of the discriminator is: in, It is a benign traffic feature vector. It is an adversarial malicious traffic feature vector. It is a hyperparameter that controls the strength of the gradient penalty. This indicates that the discriminator recognizes the input features. The probability of judgment indicates that the discriminator considers... The probability that the traffic is genuine and of good quality. This represents a random interpolation point between genuine benign characteristics and adversarial malicious traffic characteristics. Indicates the expected value. Indicates the interpolation point gradient, Indicates the discriminator's relationship to the interpolation point The probability of judgment, express .

5. The method for generating adversarial malicious traffic according to claim 4, characterized in that, The random interpolation point between the true benign characteristics and the adversarial malicious traffic characteristics for: +(1 ) U [0,1]。 6. The method for generating adversarial malicious traffic according to any one of claims 1-5, characterized in that, Used The objective function of the algorithm optimization generator is: in, The parameter is The generator in state Take action below The probability, It is the estimation of the advantage function. Indicates that the parameter is updated to Previously, the generator was in state Take action below The probability, It is a hyperparameter used to control the range of policy updates.

7. A device for generating adversarial malicious traffic, characterized in that, Includes a processor, generator, discriminator, and data mutation module; The processor is used to extract features from traffic and preprocess them, converting traffic packets into reversible high-dimensional metadata feature vectors, generating malicious traffic feature vectors and benign traffic feature vectors, and adding noise to the malicious traffic feature vectors. A generator is used to receive malicious traffic features with added noise and generate adversarial malicious traffic feature vectors. The data mutation module is used to mutate the malicious traffic feature vector to generate a mutated malicious traffic feature vector. The discriminator receives the prediction results of the mutated malicious traffic feature vector and benign traffic feature vector from the intrusion detection system NIDS, outputs the prediction results for classification and outputs probability values, and uses them as rewards for the generator to create new adversarial mutated malicious traffic features. Through adversarial training between the generator and the discriminator, the generator generates adversarial malicious traffic feature vectors to circumvent the Intrusion Detection System (NIDS). The adversarial malicious traffic feature vectors generated by the generator are then used to train the NIDS, specifically by using adaptive and iterative adversarial data augmentation. The malicious traffic feature vector is mutated using the RFPMPSO traffic mutation optimization algorithm, which is a particle swarm optimization algorithm with random mutation and dynamic sensing factor, and automatically identifies the best traffic mutation sample from the generated adversarial traffic samples. The specific process of the RFPMPSO traffic mutation optimization algorithm is as follows: The first step is to target the adversarial malicious traffic feature vectors, starting from location. Reconstruct the mutated traffic by directly retrieving the original traffic and then using... The timestamp in the middle is replaced to obtain the mutated feature vector; for the mutated feature vector, the protocol layer number that determines the protocol type is referenced. The second step is to use an extractor to extract features from the mutated feature vector; The third step is to calculate the distance between the extracted features and the input adversarial features to determine the mutation effect.

Images