Traffic data desensitization method, model training method and device based on deep learning

Abstract

The present application proposes a traffic data desensitization method, model training method and device based on deep learning. Among them, the traffic data desensitization method includes: using the transport layer quintuple to divide the original network traffic data into multiple data streams, performing feature extraction and format conversion on at least one time sequence unit in the same data stream, and obtaining a grayscale image of each time sequence unit; inputting the grayscale image of each time sequence unit in each data stream into a pre-trained traffic data desensitization model for desensitization processing, and obtaining a traffic data desensitized reconstructed image of each time sequence unit output by the traffic data desensitization model; performing inverse quantization processing on the traffic data desensitized reconstructed image of each time sequence unit in each data stream to restore it to a binary data stream, and obtaining desensitized traffic data corresponding to the original network traffic data. The present application can achieve effective desensitization of traffic data under the premise of ensuring traffic availability.

Description

Technical Field

[0001] The present application relates to the fields of data processing, network security, and artificial intelligence technologies such as deep learning, and in particular to a traffic data desensitization method, model training method, and device based on deep learning. Background Art

[0002] In cybersecurity experiments, real network traffic is crucial for simulating realistic network environments. With the widespread use of encrypted traffic, it's widely believed that encryption algorithms effectively protect traffic privacy. However, traffic owners are often reluctant to provide raw traffic directly, and even encrypted traffic still poses the risk of data leakage.

[0003] Before data is delivered to experimenters, it must be desensitized to conceal private information within encrypted traffic. However, desensitization must ensure data security while also avoiding the destruction of key traffic characteristics, such as application behavior patterns, transmission characteristics, and traffic statistics. These characteristics play a crucial role in downstream tasks such as background traffic replay and traffic behavior analysis. Summary of the Invention

[0004] The embodiments of the present application provide a traffic data desensitization method, model training method and device based on deep learning.

[0005] According to a first aspect of an embodiment of the present application, a traffic data desensitization method based on deep learning is provided, comprising:

[0006] The original network traffic data is divided into multiple data streams using the transport layer quintuple. Feature extraction and format conversion are performed on at least one time sequence unit in the same data stream to obtain a grayscale image of each time sequence unit. Each time sequence unit contains multiple consecutive data packets.

[0007] Input the grayscale image of each time series unit in each data stream into a pre-trained traffic data desensitization model for desensitization processing, and obtain the traffic data desensitization reconstructed image of each time series unit output by the traffic data desensitization model; wherein the traffic data desensitization model is a traffic feature reconstruction model for privacy protection;

[0008] The desensitized reconstructed image of the traffic data of each time sequence unit in each data stream is dequantized to restore it to a binary data stream, and the desensitized traffic data corresponding to the original network traffic data is obtained.

[0009] According to a second aspect of an embodiment of the present application, a training method for a traffic data desensitization model is provided. The network structure of the traffic data desensitization model is a deep autoencoding network built based on a visual Transformer, including an encoder and a decoder. The training method includes:

[0010] The network traffic sample data is divided into multiple data streams using the transport layer quintuple. Feature extraction and format conversion are performed on at least one time sequence unit in the same data stream to obtain a grayscale image of each time sequence unit. Each time sequence unit contains multiple consecutive data packets.

[0011] Based on the grayscale image of each time series unit in each data stream, the traffic data desensitization model is pre-trained using the first reconstruction loss value;

[0012] On the basis of pre-training, the pre-trained traffic classifier is used as the discriminator, and the traffic data desensitization model is trained based on the discriminator using the statistical loss value, classification loss value and second reconstruction loss value to obtain the trained traffic data desensitization model.

[0013] According to a third aspect of an embodiment of the present application, a traffic data desensitization device based on deep learning is provided, comprising:

[0014] The acquisition module is used to divide the original network traffic data into multiple data streams using the transport layer quintuple, perform feature extraction and format conversion on at least one time sequence unit in the same data stream, and obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets;

[0015] A desensitization module is used to input the grayscale image of each time series unit in each data stream into a pre-trained traffic data desensitization model for desensitization processing, and obtain a desensitized reconstructed image of the traffic data of each time series unit output by the traffic data desensitization model; wherein the traffic data desensitization model is a traffic feature reconstruction model for privacy protection;

[0016] The post-processing module is used to de-quantize the traffic data desensitized and reconstructed image of each time sequence unit in each data stream to restore it to a binary data stream, and obtain the desensitized traffic data corresponding to the original network traffic data.

[0017] According to a fourth aspect of an embodiment of the present application, a training device for a traffic data desensitization model is provided. The network structure of the traffic data desensitization model is a deep autoencoding network built based on a visual Transformer, including an encoder and a decoder. The training device includes:

[0018] The data preprocessing module is used to divide the network traffic sample data into multiple data streams using the transport layer quintuple, perform feature extraction and format conversion on at least one time sequence unit in the same data stream, and obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets;

[0019] A pre-training module, configured to pre-train a traffic data desensitization model using a first reconstruction loss value based on a grayscale image of each time series unit in each data stream;

[0020] The fine-tuning module is used to use the pre-trained traffic classifier as a discriminator on the basis of pre-training, and to train the traffic data desensitization model based on the discriminator by comprehensively using the statistical loss value, classification loss value and the second reconstruction loss value to obtain a trained traffic data desensitization model.

[0021] According to a fifth aspect of the embodiments of the present application, there is provided an electronic device, including:

[0022] at least one processor;

[0023] a memory communicatively connected to the at least one processor; wherein,

[0024] The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect.

[0025] According to a sixth aspect of an embodiment of the present application, a storage medium is provided, wherein the storage medium stores instructions. When the instructions are executed on an electronic device, the electronic device executes the method described in the first aspect above.

[0026] According to the seventh aspect of the embodiment of the present application, a program product is provided, comprising at least one of a program and an instruction, wherein when the at least one of the program and the instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0027] According to the technical solution of this application, not only can the authenticity and reliability of network security experiments be improved, but also effective support can be provided in terms of privacy protection and data sharing, which can bring significant value to network security research and practical applications. It can be applied to network attack and defense drills, traffic behavior analysis and other application scenarios that need to take into account both data security and functional availability.

[0028] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0030] Figure 1 A flow chart of a traffic data desensitization method based on deep learning provided in an embodiment of the present application;

[0031] Figure 2 A flow chart of a method for training a traffic data desensitization model according to an embodiment of the present application;

[0032] Figure 3 This is an example flow chart of the deep learning-based traffic data desensitization method provided in an embodiment of the present application;

[0033] Figure 4 A block diagram of a traffic data desensitization device based on deep learning provided in an embodiment of the present application;

[0034] Figure 5 A block diagram of a training device for a traffic data desensitization model provided in an embodiment of the present application;

[0035] Figure 6 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0037] It should be noted that the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the technical solution of this application comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0038] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0039] It should also be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned. They should be regarded as exemplary and their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0040] In cybersecurity experiments, real network traffic is crucial for simulating realistic network environments. With the widespread use of encrypted traffic, it's widely believed that encryption algorithms effectively protect traffic privacy. However, traffic owners are often reluctant to provide raw traffic directly, and even encrypted traffic still poses the risk of data leakage.

[0041] Before delivering data to experimenters, it must be desensitized to conceal private information within encrypted traffic. However, desensitization must ensure data security while also avoiding damaging key characteristics of encrypted traffic, such as application behavior patterns, transmission characteristics, and traffic statistics. These characteristics play a crucial role in downstream tasks such as background traffic replay and traffic behavior analysis.

[0042] In related technologies, traffic data desensitization is typically achieved using two algorithms: traffic generation algorithms and data desensitization algorithms. Traffic generation algorithms are implemented using generative models (such as generative adversarial networks (GANs) or diffusion models) to synthesize virtual network traffic, thereby avoiding security issues associated with the original traffic. Data desensitization algorithms are implemented using desensitization strategies, such as random substitution or the addition of random noise, to desensitize traffic data.

[0043] However, traffic generation algorithms are typically based on random noise synthesis. While they can simulate real traffic to a certain extent, the generated traffic struggles to accurately replicate the complex behavioral characteristics of actual network environments. This limits their practical applicability in scenarios such as network security experiments and attack and defense drills. Furthermore, generative models typically have high computational complexity, while network traffic data itself is massive and requires high real-time performance. Existing traffic generation algorithms often struggle to meet the demands of efficient response and large-scale traffic processing.

[0044] Data masking algorithms are common in natural language processing and are typically applied to structured or parsable text data. However, directly applying random data masking methods to traffic can disrupt key traffic characteristics, such as timing patterns, traffic distribution, and application-layer behavioral characteristics. This disruption renders traffic ineffective for downstream tasks (such as traffic replay, attack detection, and protocol analysis), making it difficult to meet the data authenticity and availability requirements of cybersecurity experiments.

[0045] Based on this, the embodiments of the present application provide a traffic data desensitization method, model training method and device based on deep learning, which can not only improve the authenticity and reliability of network security tests, but also provide effective support for privacy protection and data sharing. It can bring significant value to network security research and practical applications, and can be suitable for application scenarios such as network attack and defense drills, traffic behavior analysis, etc. that need to take into account both data security and functional availability.

[0046] The following describes the traffic data desensitization method, model training method and device based on deep learning in an embodiment of the present application with reference to the accompanying drawings.

[0047] It should be noted that the executor of the traffic data desensitization method based on deep learning in the embodiment of the present disclosure can be a traffic data desensitization device based on deep learning, which can be implemented by software and / or hardware. The device can be configured in an electronic device, which may include but is not limited to a terminal, a server, etc.

[0048] Figure 1 This is a flow chart of the traffic data desensitization method based on deep learning provided in the embodiment of this application. Figure 1 As shown, the traffic data desensitization method based on deep learning may include but is not limited to the following steps.

[0049] In step 101, the original network traffic data is divided into multiple data streams using the transport layer quintuple, and feature extraction and format conversion are performed on at least one time sequence unit in the same data stream to obtain a grayscale image of each time sequence unit.

[0050] In some embodiments, the transport layer five-tuple may include a source IP address (represented by "src_ip"), a source port number (represented by "src_port"), a destination IP address (represented by "dest_ip"), a destination port number (represented by "dest_port"), and a protocol type. The protocol type may include, but is not limited to, UDP (User Datagram Protocol) or TCP (Transmission Control Protocol).

[0051] For example, raw network traffic data can be segmented into session flows (also called data flows) based on the transport layer quintuple (source IP, source port, destination IP, destination port, and protocol type), resulting in multiple data flows. Each data flow can be segmented using a sliding window mechanism to produce at least one time sequence unit. Each time sequence unit can contain multiple consecutive data packets, for example, five consecutive data packets. For each data packet in each time sequence unit, a protocol feature vector for each data packet within the time sequence unit can be extracted. Normalization is then performed to convert the binary sequence of the protocol feature vectors for each data packet within the time sequence unit into a grayscale image matrix of corresponding pixels, resulting in a grayscale image of the time sequence unit.

[0052] For example, for each data packet, a fixed-length protocol feature vector can be extracted. For example, the first 80 bytes contain protocol control information for the IP header and transport layer header (TCP / UDP), followed by a 240-byte payload data segment. This 320-byte binary sequence is converted into a grayscale image matrix of corresponding pixels (e.g., 40×40) through normalization, where each pixel corresponds to the decimal mapping of an 8-bit binary value. The grayscale image matrices of five consecutive data packets are combined to produce a grayscale image of a single time sequence unit, which can be used as the flow representation (MFR, also called multi-level flow representation) of that time sequence unit. This graphical representation method can fully preserve the protocol field structure, payload distribution pattern, and timing correlation characteristics of the data packet.

[0053] In some embodiments, the original network traffic data may be encrypted traffic data, but is not limited thereto. For example, the original network traffic data may also be non-encrypted traffic data.

[0054] In step 102, the grayscale image of each time series unit in each data stream is input into a pre-trained traffic data desensitization model for desensitization processing, and a traffic data desensitized reconstructed image of each time series unit output by the traffic data desensitization model is obtained.

[0055] In some embodiments, the traffic data desensitization model can be a privacy-preserving traffic feature reconstruction model. For example, the architecture of the traffic data desensitization model can be a two-stage masked autoencoder framework (including a pre-training stage and a fine-tuning stage), achieving a balance between privacy erasure and functional preservation through feature decoupling.

[0056] In some embodiments, the network structure of the traffic data desensitization model can be a deep autoencoding network built based on a visual Transformer, including an encoder and a decoder. The encoder can use a random mask mechanism to mask the input image, and use a multi-head self-attention mechanism to learn the global dependencies across blocks in the image, and construct a distributed representation of traffic features in the latent space based on the global dependencies across blocks. The decoder can reconstruct the complete traffic image through feature interpolation, that is, obtain a traffic data desensitized reconstructed image. Exemplarily, the traffic data desensitization model can be pre-trained using network traffic sample data, so that the traffic data desensitization model learns the mapping relationship between the graphical representation of the traffic data and the traffic data desensitized reconstructed image, that is, the traffic data desensitization model learns the ability to perform data desensitization reconstruction on the graphical representation of the traffic data.

[0057] In step 103, the desensitized reconstructed image of the traffic data of each time sequence unit in each data stream is subjected to inverse quantization processing to restore it to a binary data stream, thereby obtaining desensitized traffic data corresponding to the original network traffic data.

[0058] In an embodiment of the present application, after data desensitization is performed on each time sequence unit, the desensitized reconstructed image of the traffic data of each time sequence unit in each data stream can be dequantized to restore it to a binary data stream. For example, the desensitized reconstructed image of the traffic data can be dequantized according to 8-bit grayscale values ​​to restore it to a binary data stream. Optionally, the header in the binary data stream can be replaced (Replace) with the header in the original network traffic data, so that the desensitized traffic data corresponding to the original network traffic data can be obtained. In other words, after the traffic data is desensitized, it needs to be properly converted so that it can be restored to real forwardable traffic to ensure the normal use of the traffic in the application scenario. This process is crucial, as it determines whether the desensitized data can be transmitted smoothly in the actual network environment, thereby affecting the feasibility and practicality of the entire solution.

[0059] Optionally, in some embodiments, the binary data stream obtained after restoration can be verified by a protocol syntax tree. Exemplarily, the protocol syntax tree can be understood as a tree model that describes the structure of a network protocol, which is used to parse and verify the format of a data packet. In other words, the binary data stream obtained after restoration can be verified by the syntax tree to ensure that the IP and transport layer header fields comply with the RFC (Request for Comments) specification. Optionally, a flow state tracker can be set only for multiple processing units of the same session flow (data flow) to maintain quintuple consistency and dynamically calibrate timing-sensitive parameters (such as TCP sequence numbers, timestamp options, etc.).

[0060] By implementing the embodiments of the present application, not only can the authenticity and reliability of network security tests be improved, but also effective support can be provided in terms of privacy protection and data sharing, which can bring significant value to network security research and practical applications. It can be applicable to application scenarios such as network attack and defense drills, traffic behavior analysis, etc. that require a balance between data security and functional availability.

[0061] Figure 2 This is a flow chart of the training method of the traffic data desensitization model provided in the embodiment of the present application. Figure 2 As shown, the training method of the traffic data desensitization model may include but is not limited to the following steps.

[0062] In step 201, the network traffic sample data is divided into multiple data streams using a transport layer quintuple, and feature extraction and format conversion are performed on at least one time sequence unit in the same data stream to obtain a grayscale image of each time sequence unit, wherein each time sequence unit contains multiple consecutive data packets.

[0063] In an embodiment of the present application, the optional implementation method of processing the network traffic sample data in step 201 is similar to the implementation method of processing the original network traffic data in the above step 101. Please refer to the relevant description of the optional implementation method of processing the original network traffic data in the above step 101, and no further details will be given here.

[0064] In step 202, based on the grayscale image of each time sequence unit in each data stream, a traffic data desensitization model is pre-trained using a first reconstruction loss value.

[0065] In some embodiments, the grayscale image of each time sequence unit can be divided into multiple pixel block sequences; the multiple pixel block sequences are masked according to a first mask rate by an encoder; the masked pixel block sequence is processed using a multi-head self-attention mechanism to obtain global dependency information across blocks; a distributed representation of traffic features is constructed in a latent space based on the global dependency information across blocks; the distributed representation of traffic features output by the encoder is reconstructed by a decoder to obtain a desensitized reconstructed image of the traffic data of each time sequence unit; a first reconstruction loss value is determined based on the grayscale image of each time sequence unit and the desensitized reconstructed image of the traffic data of each time sequence unit, and the traffic data desensitization model is trained based on the first reconstruction loss value.

[0066] For example, the grayscale image of each time-series unit can be divided into a sequence of 16×16 pixel blocks. These blocks are then masked using a random masking mechanism at a first masking rate (e.g., 90%) to simulate the erasure of private information. The encoder can utilize a multi-head self-attention mechanism to learn global dependencies across blocks and construct a distributed representation of traffic features in the latent space. The decoder can reconstruct the distributed representation of traffic features output by the encoder through feature interpolation to obtain a desensitized reconstructed image of the traffic data for each time-series unit. During this pre-training phase, massive unlabeled traffic datasets can be used for training. The objective function is defined as the normalized mean squared error between the original image (i.e., grayscale image) and the reconstructed image (i.e., desensitized reconstructed image of the traffic data), enabling the model to grasp the inherent distribution patterns of encrypted traffic. For example, a first reconstruction loss value can be determined based on the grayscale image of each time series unit and the desensitized reconstruction image of the traffic data of each time series unit, and the first reconstruction loss value can be used to guide the traffic data desensitization model to learn the basic characteristics of the traffic, so that it can grasp the overall structure and distribution of the traffic data. This process is equivalent to allowing the model to establish a basic understanding of the traffic so that it can be fine-tuned more accurately in the future.

[0067] In step 203, based on the pre-training, the pre-trained traffic classifier is used as a discriminator, and the traffic data desensitization model is trained based on the discriminator using the statistical loss value, classification loss value and second reconstruction loss value to obtain a trained traffic data desensitization model.

[0068] In some embodiments, the grayscale image of each time series unit can be reconstructed by the traffic data desensitization model to obtain the traffic data desensitized reconstruction image and the second reconstruction loss value of each time series unit; the statistical loss value is determined based on the traffic data desensitized reconstruction image of each time series unit and the grayscale image of each time series unit; the traffic data desensitized reconstruction image of each time series unit is input into the discriminator for classification processing to obtain the classification result of each traffic data desensitized reconstruction image; the classification loss value is determined based on the classification result of each traffic data desensitized reconstruction image and the classification label of the network traffic sample data; the traffic data desensitization model is trained based on the statistical loss value, the classification loss value and the second reconstruction loss value. In the embodiment of the present application, the loss function for calculating the statistical loss value can adopt the mean square error loss function, but is not limited to this. The loss function for calculating the classification loss value can adopt the cross entropy loss function, but is not limited to this. In this stage, the grayscale image of each time series unit can be masked according to the mask rate of 0 by the traffic data desensitization model.

[0069] That is, after pre-training the traffic data desensitization model, the model can be fine-tuned. During the fine-tuning phase, a pre-trained traffic classifier (the traffic classification accuracy of which can be, for example, greater than 95%, but not limited to, this) can be loaded as a discriminator. For example, after the traffic data desensitization model sequentially masks (the masking rate can be 0) and reconstructs the grayscale image of each time series unit to obtain a desensitized reconstructed traffic data image and a second reconstruction loss value for each time series unit, a statistical loss value can be calculated using the mean square error loss function based on the desensitized reconstructed traffic data image and the grayscale image of each time series unit. The discriminator then performs classification processing on the desensitized reconstructed traffic data image of each time series unit to obtain a classification result for the desensitized reconstructed traffic data image. Based on the classification result of the desensitized reconstructed traffic data image and the classification labels of the network traffic sample data, a classification loss value is calculated using the cross-entropy loss function. The traffic data desensitization model can then be trained based on the statistical loss value, the classification loss value, and the second reconstruction loss value. The goal of fine-tuning is to minimize the reconstruction loss while preserving the application type and data distribution characteristics of the traffic, thereby desensitizing the traffic. This process ensures that the traffic maintains its usability and effectiveness while removing sensitive information.

[0070] In the above embodiment, by integrating computer vision and network protocol analysis technology, a traffic feature reconstruction model for privacy protection (i.e., a traffic data desensitization model) is constructed, the model is pre-trained using network traffic sample data, and after pre-training, the model is fine-tuned. During the fine-tuning stage, an adversarial training strategy is introduced to enhance the feature retention capability. While retaining the application type and data distribution characteristics of the traffic, the reconstruction loss is maximized, thereby achieving desensitization processing of the traffic, thereby ensuring that the traffic maintains its availability and effectiveness while removing sensitive information.

[0071] In order to facilitate those skilled in the art to more clearly understand the technical solution of this application, Figure 3 This application proposes a traffic data desensitization method based on deep learning, which can build a traffic feature reconstruction model for privacy protection by integrating computer vision and network protocol analysis technology. The core technical solution is implemented by the following three core modules:

[0072] like Figure 3 As shown in the figure, during the data preprocessing stage, a protocol-aware traffic structuring engine can be used to extract features and convert the format of raw network traffic data. The specific implementation process is as follows: The raw network traffic data is segmented into session flows based on the transport layer five-tuple (source IP, source port, destination IP, destination port, and protocol type). Each session flow is then segmented into time-series units consisting of N consecutive packets (e.g., N = 5) using a sliding window mechanism. For each packet, a fixed-length protocol feature vector is extracted. For example, the first 80 bytes, including the protocol control information of the IP header and transport layer header (TCP / UDP), and the subsequent 240 bytes of payload data are extracted. This 320-byte binary sequence is converted to a 40×40 pixel grayscale image matrix (Original MFR) through normalization, serving as the traffic representation. Each pixel corresponds to the decimal mapping of an 8-bit binary value. This visualization method fully preserves the packet's protocol field structure, payload distribution pattern, and temporal correlation characteristics.

[0073] like Figure 3As shown, during the model training phase, the traffic data desensitization model architecture adopts a two-stage masked autoencoder framework, achieving a balance between privacy erasure and functional preservation through feature decoupling. During the pre-training phase, a deep autoencoder network is constructed based on the visual Transformer. For example, the input image is divided into a sequence of 16×16 pixel blocks, and 90% (e.g., represented by a mask rate of 0.9) of the blocks are hidden using a random masking mechanism to simulate privacy erasure. The encoder network uses a multi-head self-attention mechanism (global attention can also be used) to learn global dependencies across blocks and construct a distributed representation of traffic features in the latent space. The decoder network (global attention can also be used) reconstructs the complete traffic image (desensitized MFR) through feature interpolation. This phase can be trained using massive unlabeled traffic datasets. The objective function is defined as the normalized mean squared error between the original image and the reconstructed image, enabling the model to grasp the inherent distribution patterns of encrypted traffic. During the fine-tuning phase, an adversarial training strategy is introduced to enhance feature retention capabilities. That is, a pre-trained traffic classifier (with a traffic classification accuracy higher than 95%) is loaded as the discriminator, and the classification results of the desensitized reconstructed traffic and the cross entropy loss of the original traffic label (Label) are dynamically integrated into the objective function. By jointly optimizing the feature reconstruction loss and the classification consistency loss, the model is forced to maintain the integrity of the traffic behavior fingerprint while erasing sensitive information. During the fine-tuning phase, the Mask Rate can be 0. Figure 3 As shown in the figure, in the fine-tuning stage, the attention mechanism adopted by the encoder in the traffic data desensitization model can be a packet-level attention mechanism (Packet attn.), and the attention mechanism adopted by the decoder in the traffic data desensitization model can be a flow-level attention mechanism (Flow attn.).

[0074] In the post-processing stage, a protocol compatibility verification mechanism can be used to complete the reverse conversion of desensitized traffic. For example, the reconstructed image output by the model can be dequantized into an 8-bit grayscale value and restored to a binary data stream. Optionally, the header in the binary data stream can be replaced with the header in the original network traffic data to obtain the desensitized traffic corresponding to the original traffic. Protocol syntax tree verification ensures that the IP and transport layer header fields comply with RFC specifications. For multiple processing units in the same session flow, a flow state tracker is set to maintain five-tuple consistency and dynamically calibrate timing-sensitive parameters (such as TCP sequence numbers and timestamp options).

[0075] That is to say, the traffic data desensitization method based on deep learning involved in this application mainly includes three stages to achieve traffic representation, model training and post-processing, so that the traffic can still be truly forwarded while being desensitized.

[0076] First, during the traffic representation phase, traffic is segmented using quintuples, dividing the original traffic into multiple independent data streams. Based on this, five consecutive packets within the same data stream are converted to generate a 40×40 grayscale image for feature representation. This approach effectively preserves the spatial and temporal characteristics of traffic, providing more intuitive data input for subsequent modeling.

[0077] Next comes the model training phase, which is divided into two key steps.

[0078] (1) Pre-training: Use reconstruction loss to guide the model to learn the basic characteristics of traffic, so that it can grasp the overall structure and distribution of traffic data. This process is equivalent to allowing the model to establish a basic understanding of traffic so that subsequent fine-tuning can be more accurate.

[0079] (2) Fine-tuning: Based on pre-training, further optimization is performed using a combination of statistical loss, classification loss, and reconstruction loss. The goal of fine-tuning is to maximize the reconstruction loss while preserving the application type and data distribution characteristics of the traffic, thereby achieving desensitization of the traffic. This process ensures that the traffic maintains its usability and effectiveness while removing sensitive information.

[0080] Finally, in the post-processing phase, after traffic desensitization is complete, it needs to be properly converted to restore it to real, forwardable traffic, ensuring normal use in the application scenario. This process is crucial, as it determines whether the desensitized data can be smoothly transmitted in the actual network environment, which in turn affects the feasibility and practicality of the overall solution.

[0081] In summary, the technical solution of this application has broad application value in the field of network security testing, ensuring data authenticity while providing an effective privacy protection mechanism. First, this technical solution can capture and process real network traffic to maximize the reproduction of the actual network environment. This is crucial for network security research, ensuring the authenticity of the experimental environment and enabling researchers to conduct security analysis, attack detection, and defense strategy evaluation based on real data, thereby improving the reliability of experimental results. Second, through an efficient desensitization mechanism, this technical solution maximizes the privacy and security of traffic while preserving the application type and data distribution characteristics of the traffic. Traditional traffic desensitization methods often cause data distribution to be disrupted, thus affecting experimental results. However, this solution can effectively remove sensitive information without affecting traffic availability, ensuring that data is not leaked when shared and utilized. Furthermore, the implementation of this technical solution helps promote the secure sharing of encrypted traffic data. In the current network environment, the proportion of encrypted traffic is gradually increasing. Enabling researchers to obtain high-quality traffic data while protecting user privacy is a major challenge. This technical solution, through deep learning modeling, provides a solution that balances data availability and security, enabling the secure sharing and utilization of encrypted traffic data in a wider range of research and application scenarios. Therefore, the technical solution of this application can not only improve the authenticity and reliability of network security experiments, but also provide effective support in privacy protection and data sharing, and can bring significant value to network security research and practical applications.

[0082] Figure 4 This is a block diagram of a traffic data desensitization device based on deep learning provided in an embodiment of the present application. Figure 4 As shown, the traffic data desensitization device based on deep learning may include: an acquisition module 401, a desensitization module 402 and a post-processing module 403.

[0083] Among them, the acquisition module 401 is used to use the transport layer quintuple to divide the original network traffic data into multiple data streams, perform feature extraction and format conversion on at least one time sequence unit in the same data stream, and obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets.

[0084] The desensitization module 402 is used to input the grayscale image of each time series unit in each data stream into a pre-trained traffic data desensitization model for desensitization processing, and obtain the traffic data desensitized reconstructed image of each time series unit output by the traffic data desensitization model; wherein, the traffic data desensitization model is a traffic feature reconstruction model for privacy protection.

[0085] The post-processing module 403 is used to perform inverse quantization processing on the desensitized reconstructed image of the traffic data of each time sequence unit in each data stream to restore it to a binary data stream, thereby obtaining desensitized traffic data corresponding to the original network traffic data.

[0086] In some embodiments, the acquisition module 401 is used to: divide each data stream into at least one timing unit through a sliding window mechanism; for each data packet of each timing unit, extract the protocol feature vector of each data packet in the timing unit, and convert the binary sequence of the protocol feature vector of each data packet in the timing unit into a grayscale image matrix of corresponding pixels through normalization processing to obtain a grayscale image of the timing unit.

[0087] In some embodiments, the network structure of the traffic data desensitization model is a deep autoencoding network built based on a visual Transformer, including an encoder and a decoder. In some embodiments, the traffic data desensitization device based on deep learning may include a model training module. Among them, the model training module is used to: use the transport layer quintuple to divide the network traffic sample data into multiple data streams, perform feature extraction and format conversion on at least one time sequence unit in the same data stream, and obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets; based on the grayscale image of each time sequence unit in each data stream, use the first reconstruction loss value to pre-train the traffic data desensitization model; on the basis of pre-training, use the pre-trained traffic classifier as a discriminator, and use the statistical loss value, classification loss value and second reconstruction loss value based on the discriminator to train the traffic data desensitization model to obtain a trained traffic data desensitization model.

[0088] In some embodiments, the model training module is used to: divide the grayscale image of each time sequence unit into multiple pixel block sequences; mask the multiple pixel block sequences according to a first mask rate through an encoder; use a multi-head self-attention mechanism to process the masked pixel block sequence to obtain global dependency information across blocks; construct a distributed representation of traffic features in a latent space based on the global dependency information across blocks; reconstruct the distributed representation of traffic features output by the encoder through a decoder to obtain a desensitized reconstructed image of the traffic data of each time sequence unit; determine a first reconstruction loss value based on the grayscale image of each time sequence unit and the desensitized reconstructed image of the traffic data of each time sequence unit, and train the traffic data desensitization model based on the first reconstruction loss value.

[0089] In some embodiments, the model training module is used to: reconstruct the grayscale image of each time series unit through the traffic data desensitization model to obtain the traffic data desensitized reconstructed image and the second reconstruction loss value of each time series unit; determine the statistical loss value based on the traffic data desensitized reconstructed image of each time series unit and the grayscale image of each time series unit; input the traffic data desensitized reconstructed image of each time series unit into the discriminator for classification processing to obtain the classification result of each traffic data desensitized reconstructed image; determine the classification loss value based on the classification result of each traffic data desensitized reconstructed image and the classification label of the network traffic sample data; train the traffic data desensitization model based on the statistical loss value, the classification loss value and the second reconstruction loss value.

[0090] In some embodiments, the post-processing module 403 is further configured to perform verification processing on the restored binary data stream using a protocol syntax tree.

[0091] It should be noted that the above explanation of the embodiment of the traffic data desensitization method based on deep learning is also applicable to the traffic data desensitization device based on deep learning in this embodiment, and will not be repeated here.

[0092] Figure 5 This is a block diagram of a training device for a traffic data desensitization model provided in an embodiment of the present application. Figure 5 As shown, the training device of the traffic data desensitization model may include: a data preprocessing module 501, a pre-training module 502 and a fine-tuning module 503.

[0093] Among them, the data preprocessing module 501 is used to use the transport layer quintuple to divide the network traffic sample data into multiple data streams, perform feature extraction and format conversion on at least one time sequence unit in the same data stream, and obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets.

[0094] The pre-training module 502 is used to pre-train the traffic data desensitization model based on the grayscale image of each time sequence unit in each data stream using a first reconstruction loss value.

[0095] The fine-tuning module 503 is used to use the pre-trained traffic classifier as a discriminator on the basis of pre-training, and to train the traffic data desensitization model based on the discriminator by comprehensively using the statistical loss value, classification loss value and the second reconstruction loss value to obtain a trained traffic data desensitization model.

[0096] In some embodiments, the pre-training module 502 is used to: divide the grayscale image of each time sequence unit into multiple pixel block sequences; mask the multiple pixel block sequences according to a first mask rate through an encoder; use a multi-head self-attention mechanism to process the masked pixel block sequence to obtain global dependency information across blocks; construct a distributed representation of traffic features in a latent space based on the global dependency information across blocks; reconstruct the distributed representation of traffic features output by the encoder through a decoder to obtain a desensitized reconstructed image of the traffic data of each time sequence unit; determine a first reconstruction loss value based on the grayscale image of each time sequence unit and the desensitized reconstructed image of the traffic data of each time sequence unit, and train the traffic data desensitization model based on the first reconstruction loss value.

[0097] In some embodiments, the fine-tuning module 503 is used to: reconstruct the grayscale image of each time series unit through the traffic data desensitization model to obtain the traffic data desensitized reconstructed image and the second reconstruction loss value of each time series unit; determine the statistical loss value based on the traffic data desensitized reconstructed image of each time series unit and the grayscale image of each time series unit; input the traffic data desensitized reconstructed image of each time series unit into the discriminator for classification processing to obtain the classification result of each traffic data desensitized reconstructed image; determine the classification loss value based on the classification result of each traffic data desensitized reconstructed image and the classification label of the network traffic sample data; train the traffic data desensitization model based on the statistical loss value, the classification loss value and the second reconstruction loss value.

[0098] It should be noted that the above explanation of the embodiment of the training method of the traffic data desensitization model is also applicable to the training device of the traffic data desensitization model of this embodiment, and will not be repeated here.

[0099] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0100] like Figure 6 , is a block diagram of an electronic device according to an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. Alternatively, the electronic device may also be a gateway device, etc., but is not limited thereto. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0101] like Figure 6As shown, the electronic device includes: one or more processors 601, a memory 602, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display graphical information of a GUI on an external input / output device (such as a display device coupled to the interface). In other embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 601 is taken as an example.

[0102] Memory 602 is the non-transitory computer-readable storage medium provided in this application. The memory stores instructions executable by at least one processor to enable the at least one processor to execute the traffic data desensitization method based on deep learning or the training method for a traffic data desensitization model provided in this application. The non-transitory computer-readable storage medium of this application stores computer instructions for enabling a computer to execute the traffic data desensitization method based on deep learning or the training method for a traffic data desensitization model provided in this application.

[0103] The memory 602 is a non-transient computer-readable storage medium that can be used to store non-transient software programs, non-transient computer executable programs and modules, such as the program instructions / modules corresponding to the traffic data desensitization method based on deep learning or the training method of the traffic data desensitization model in the embodiment of the present application (for example, the attached Figure 4 The acquisition module 401, desensitization module 402 and post-processing module 403 shown in FIG. Figure 5 The processor 601 executes the non-transient software programs, instructions, and modules stored in the memory 602 to execute various functional applications and data processing of the server, that is, to implement the traffic data desensitization method based on deep learning or the training method of the traffic data desensitization model in the above method embodiment.

[0104] The memory 602 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device, etc. In addition, the memory 602 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 602 may optionally include a memory remotely located relative to the processor 601, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0105] The electronic device may further include: an input device 603 and an output device 604. The processor 601, the memory 602, the input device 603 and the output device 604 may be connected via a bus or other means. Figure 6 The bus connection is taken as an example.

[0106] The input device 603 can receive input digital or character information and generate key signal input related to user settings and function control of the electronic device. Examples include a touch screen, keypad, mouse, trackpad, touchpad, pointing stick, one or more mouse buttons, trackball, joystick, and other input devices. The output device 604 may include a display device, auxiliary lighting devices (e.g., LEDs), and tactile feedback devices (e.g., vibration motors). The display device may include, but is not limited to, a liquid crystal display (LCD), a light-emitting diode (LED) display, and a plasma display. In some embodiments, the display device may be a touch screen.

[0107] Various implementations of the systems and techniques described herein can be realized in digital electronic circuitry, integrated circuitry, dedicated ASICs (application specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0108] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for programmable processors and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., a magnetic disk, an optical disk, a memory, a programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0109] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0110] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0111] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, establishing a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a host product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical servers and VPS services ("Virtual Private Servers" or "VPS"). The server may also be a server in a distributed system or a server integrated with blockchain.

[0112] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this application can be achieved. This is not a limitation herein.

[0113] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A traffic data desensitization method based on deep learning, characterized in that: include: The original network traffic data is divided into multiple data streams using a transport layer quintuple, and feature extraction and format conversion are performed on at least one time sequence unit in the same data stream to obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets; Inputting the grayscale image of each time series unit in each of the data streams into a pre-trained traffic data desensitization model for desensitization processing, and obtaining a traffic data desensitized reconstructed image of each time series unit output by the traffic data desensitization model; wherein the traffic data desensitization model is a traffic feature reconstruction model oriented to privacy protection; De-quantize the desensitized reconstructed image of the traffic data of each time sequence unit in each data stream to restore it to a binary data stream, and obtain desensitized traffic data corresponding to the original network traffic data; The network structure of the traffic data desensitization model is a deep autoencoding network built based on the visual Transformer, including an encoder and a decoder. The traffic data desensitization model is trained in the following way: The network traffic sample data is divided into multiple data streams using a transport layer quintuple, and feature extraction and format conversion are performed on at least one time sequence unit in the same data stream to obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets; Based on the grayscale image of each of the time sequence units in each of the data streams, a traffic data desensitization model is pre-trained using a first reconstruction loss value, including: dividing the grayscale image of each of the time sequence units into multiple pixel block sequences; masking the multiple pixel block sequences according to a first mask rate by the encoder; processing the masked pixel block sequences using a multi-head self-attention mechanism to obtain global dependency information across blocks; constructing a distributed representation of traffic features in a latent space based on the global dependency information across blocks; reconstructing the distributed representation of traffic features output by the encoder by the decoder to obtain a traffic data desensitized reconstructed image of each of the time sequence units; determining a first reconstruction loss value based on the grayscale image of each of the time sequence units and the traffic data desensitized reconstructed image of each of the time sequence units, and training the traffic data desensitization model based on the first reconstruction loss value; On the basis of pre-training, the pre-trained traffic classifier is used as a discriminator, and the traffic data desensitization model is trained based on the discriminator using a comprehensive statistical loss value, a classification loss value and a second reconstruction loss value to obtain a trained traffic data desensitization model.

2. The method according to claim 1, wherein The step of performing feature extraction and format conversion on at least one time sequence unit in the same data stream to obtain a grayscale image of each time sequence unit includes: Dividing each of the data streams into at least one of the time sequence units through a sliding window mechanism; For each data packet of each of the timing units, the protocol feature vector of each data packet in the timing unit is extracted, and the binary sequence of the protocol feature vector of each data packet in the timing unit is converted into a grayscale image matrix of corresponding pixels through normalization processing to obtain a grayscale image of the timing unit.

3. The method according to claim 1, wherein The training of the traffic data desensitization model based on the discriminator by comprehensively using the statistical loss value, the classification loss value and the second reconstruction loss value includes: Reconstructing the grayscale image of each of the time sequence units using the traffic data desensitization model to obtain a traffic data desensitized reconstructed image of each of the time sequence units and a second reconstruction loss value; Determine a statistical loss value according to a desensitized reconstructed image of the flow data of each of the time sequence units and a grayscale image of each of the time sequence units; Inputting the desensitized and reconstructed image of the traffic data of each time series unit into the discriminator for classification processing to obtain a classification result of each desensitized and reconstructed image of the traffic data; Determining a classification loss value based on the classification result of each of the traffic data desensitized reconstructed images and the classification label of the network traffic sample data; A traffic data desensitization model is trained based on the statistical loss value, the classification loss value, and the second reconstruction loss value.

4. The method according to any one of claims 1 to 3, wherein The method further comprises: The restored binary data stream is verified through the protocol syntax tree.

5. A traffic data desensitization device based on deep learning, characterized in that: include: An acquisition module is configured to divide the original network traffic data into multiple data streams using a transport layer quintuple, perform feature extraction and format conversion on at least one time sequence unit in the same data stream, and obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets; A desensitization module is used to input the grayscale image of each time series unit in each of the data streams into a pre-trained traffic data desensitization model for desensitization processing, and obtain a desensitized reconstructed image of the traffic data of each time series unit output by the traffic data desensitization model; wherein the traffic data desensitization model is a traffic feature reconstruction model for privacy protection; A post-processing module is used to perform dequantization processing on the desensitized reconstructed image of the traffic data of each time sequence unit in each of the data streams to restore it to a binary data stream, thereby obtaining desensitized traffic data corresponding to the original network traffic data; The network structure of the traffic data desensitization model is a deep autoencoding network built based on a visual Transformer, including an encoder and a decoder; the device also includes a model training module, which is used to: The network traffic sample data is divided into multiple data streams using a transport layer quintuple, and feature extraction and format conversion are performed on at least one time sequence unit in the same data stream to obtain a grayscale image of each time sequence unit; each time sequence unit contains multiple consecutive data packets; Based on the grayscale image of each of the time sequence units in each of the data streams, a traffic data desensitization model is pre-trained using a first reconstruction loss value, including: dividing the grayscale image of each of the time sequence units into multiple pixel block sequences; masking the multiple pixel block sequences according to a first mask rate by the encoder; processing the masked pixel block sequences using a multi-head self-attention mechanism to obtain global dependency information across blocks; constructing a distributed representation of traffic features in a latent space based on the global dependency information across blocks; reconstructing the distributed representation of traffic features output by the encoder by the decoder to obtain a traffic data desensitized reconstructed image of each of the time sequence units; determining a first reconstruction loss value based on the grayscale image of each of the time sequence units and the traffic data desensitized reconstructed image of each of the time sequence units, and training the traffic data desensitization model based on the first reconstruction loss value; On the basis of pre-training, the pre-trained traffic classifier is used as a discriminator, and the traffic data desensitization model is trained based on the discriminator using a comprehensive statistical loss value, a classification loss value and a second reconstruction loss value to obtain a trained traffic data desensitization model.

6. An electronic device, characterized in that: include: at least one processor; a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 4.

Images