Network security malicious traffic tracing method based on generative adversarial network

Abstract

The invention discloses a network security malicious traffic tracing method based on a generative adversarial network, which comprises the following steps: collecting network traffic data, selecting a target traffic sample, extracting a protocol behavior, a communication structure and a time evolution characteristic of the target traffic sample, and carrying out semantic coding; mapping the multiple types of features to a unified embedding space through a multi-view fusion mode; constructing a manifold set based on known malicious samples, and generating an intermediate state sample sequence; constructing an attack context and path disturbance information in combination with the target sample, and generating a guide vector; inputting the guide vector and the random variable into a generator, and outputting a potential malicious sample representation; identifying the authenticity of the sample and evaluating the path similarity by using a discrimination network; and finally, constructing an attack path graph according to the similarity and the spatial relationship, and calculating a shortest path sequence to a known malicious sample to realize traceability identification of potential malicious behaviors. According to the invention, tracking analysis of malicious traffic sources is realized by using the generative adversarial network.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security malicious traffic tracing method based on a generative adversarial network. Background Art

[0002] With the continuous evolution of information technology and the rapid expansion of network systems, cybersecurity threats are becoming increasingly complex and diverse. Malicious traffic is becoming increasingly disguised and concealed, seriously impacting the operational stability and information security of network systems. Against this backdrop, the precise identification of malicious traffic and accurate tracing of attack paths have become key and challenging areas of network security research.

[0003] In existing technologies, mainstream malicious traffic tracing methods generally rely on technical means such as rule matching, traffic statistics, or static feature analysis. These methods have the following shortcomings in practical applications: 1. Limited feature expression capabilities: Traditional methods are mostly based on shallow semantic features and cannot effectively capture the deep-level protocol behavior patterns, communication structure evolution, and time series changes in traffic data, resulting in insufficient accuracy in tracing results.

[0004] 2. Fragmented perspectives and lack of integration: Existing methods mostly focus on a single perspective (such as traffic packet sequences or communication structures) and fail to achieve unified modeling of multi-dimensional features. This leads to insufficient utilization of semantic information and makes it difficult to accurately portray the full picture of attack behavior.

[0005] 3. Lack of generation capabilities and deduction mechanisms: Traditional methods generally lack the ability to model and generate potential variant behaviors in the attack path. They are unable to simulate unobserved but reasonable behavioral stages in the attack chain, and the traceability path is incomplete.

[0006] 4. Disconnection between discrimination and reasoning: Existing methods usually separate malicious sample discrimination from attack path analysis and lack a unified embedding space evaluation mechanism, resulting in limited traceability credibility and continuity.

[0007] Therefore, how to provide a network security malicious traffic tracing method based on generative adversarial networks is a problem that technicians in this field urgently need to solve. Summary of the Invention

[0008] One purpose of the present invention is to propose a network security malicious traffic tracing method based on generative adversarial networks. The present invention integrates multi-dimensional traffic features, constructs a unified low-dimensional embedding space, generates potential malicious traffic samples, performs path perturbation coding and attack context modeling, and realizes dynamic reconstruction and precise tracing of complex attack chains. It has the advantages of rich feature expression, strong attack behavior deduction capability and high tracing path accuracy.

[0009] The network security malicious traffic traceability method based on a generative adversarial network according to an embodiment of the present invention includes the following steps: S1. Collect network traffic data, select a target traffic sample to be traced, extract protocol behavior features, communication structure features, and time evolution features, perform semantic encoding respectively, and generate protocol behavior embedding representations, communication structure embedding representations, and time evolution embedding representations; S2. Input the protocol behavior embedding representations, communication structure embedding representations, and time evolution embedding representations into a multi-perspective fusion process, construct semantic correspondence relationships, and uniformly map them to a low-dimensional embedding space; S3. In the low-dimensional embedding space, construct a segmented embedding manifold set based on multiple labeled malicious traffic samples, perform an interpolation operation to generate intermediate state embedding representations, and form an embedded traffic sample sequence; S4. Generate an attack context embedding representation based on the target traffic sample, perform perturbation path encoding on the embedded traffic sample sequence, generate a perturbation path embedding representation, and combine it with the attack context embedding representation to form a guiding conditional vector; S5. Input the guiding conditional vector and a random latent variable sampled based on a preset distribution into a generator, and the generator performs joint encoding and outputs a latent malicious traffic sample embedding representation; S6. Input the latent malicious traffic sample embedding representation into an embedded consistency discriminant network, perform true / false identification, and perform path similarity scoring; S7. According to the path similarity scoring and the positional relationship of the latent malicious traffic sample embedding representation in the low-dimensional embedding space, construct an attack chain path graph, and calculate the shortest path sequence to the labeled malicious traffic sample embedding representation.

[0010] Optionally, the S1 specifically includes: S11. Collect raw network traffic data within a preset time window, construct a five-tuple key value based on the source Internet protocol address, destination Internet protocol address, source port number, destination port number, and network protocol type, perform flow-level recombination on the raw network data packets, and generate an ordered network session sequence; S12. In the ordered network session sequence, select a target network traffic sample to be traced based on a behavior matching strategy, and the behavior matching strategy includes a rule comparison strategy based on a known malicious feature template; S13. Extract protocol behavior features for the target network traffic sample, and the protocol behavior features include the packet interaction direction sequence, packet length sequence, and protocol field change sequence in the network session; S14. Extract communication structure features for the target network traffic sample, and the communication structure features construct a communication graph model based on the end-to-end network entity interaction relationship, and extract graph structure parameters such as connection relationship density, path length distribution, node centrality, and structural nesting level; S15. Extract time evolution features for the target network traffic sample. The time evolution features include the distribution of inter-packet time intervals, the frequency distribution of emergency time windows, and the active time period sequence. S16. Input the protocol behavior features, communication structure features, and time evolution features into the protocol behavior semantic encoding structure, communication structure semantic encoding structure, and time evolution semantic encoding structure respectively, and perform embedded expression mapping. The semantic encoding structure includes a normalization layer, a structure parsing layer, and an embedded output layer. S17. Output the protocol behavior embedded representation, communication structure embedded representation, and time evolution embedded representation respectively.

[0011] Optionally, S2 specifically includes: S21. Receive the protocol behavior embedded representation, communication structure embedded representation, and time evolution embedded representation, and perform unified scale normalization processing on the three types of embedded representations to keep the feature amplitudes and statistical distributions consistent. S22. Input the normalized protocol behavior embedded representation, communication structure embedded representation, and time evolution embedded representation into the multi-perspective semantic alignment structure. The multi-perspective semantic alignment structure includes three-way cross-attention channels, and obtain the saliency mapping relationship between cross-embedded channels by calculating the semantic interaction matrix between feature dimensions. S23. In the multi-perspective semantic alignment structure, construct a feature guidance channel, use the protocol behavior embedded representation as the dominant channel, and perform attention weight weighted fusion on the communication structure embedded representation and time evolution embedded representation to generate a fused feature representation. The fusion process maintains the context structure guidance role of the protocol behavior main perspective. S24. Input the fused feature representation into the unified low-dimensional embedded space mapping structure. The mapping structure includes a multi-layer non-linear transformation module with inter-layer residual connections, and set a semantic distance preservation constraint to maintain the spatial geometric relationship between the original three types of embeddings.

[0012] Optionally, S3 specifically includes: S31. Obtain the embedded representations of multiple labeled malicious traffic samples in the unified low-dimensional embedded space. Based on the attack behavior labels, spatial distribution positions, and behavior time series coding results corresponding to each labeled malicious traffic sample embedded representation, perform joint clustering operations to construct a clustering set of malicious behavior embedded samples. S32. For each clustering set of malicious behavior embedded samples, based on the change in the semantic similarity distribution between adjacent labeled malicious traffic sample embedded representations in the clustering set and the stage span information of the attack stage labels, identify the segmentation boundary points, and divide each clustering set of malicious behavior embedded samples into several local embedded manifold sub-segments. S33. Combine all local embedded manifold sub - segments into a segmented embedded manifold set according to the time sequence of attack behaviors and the relationship with the attack chain structure. The segmented embedded manifold set represents a set of embedded path structures composed of multiple local embedded manifold sub - segments with structural continuity relationships; S34. Select an interpolation control path based on the attack context embedding representation generated from the target traffic sample. Perform interpolation operations along the interpolation control path in the segmented embedded manifold set, perform equidistant interpolation operations inside the local embedded manifold sub - segments, and perform perturbation - controlled interpolation operations between different local embedded manifold sub - segments to generate an intermediate - state embedding representation; S35. Combine multiple intermediate - state embedding representations with the corresponding embedded representations of labeled malicious traffic samples to form an embedded traffic sample sequence, which is used as the guiding basis for constructing potential malicious traffic samples in the input space of the subsequent generative adversarial network.

[0013] Optionally, the specific steps of S4 are as follows: S41. Input the protocol behavior embedding representation, communication structure embedding representation, and time - evolution embedding representation of the target network traffic sample into the attack context modeling structure. The attack context modeling structure includes time - series feature extraction and behavior intention modeling, which is used to encode the behavior evolution and structural features of the target network traffic sample to generate an attack context embedding representation; S42. Input the embedded traffic sample sequence into the path perturbation encoding structure. The path perturbation encoding structure includes path - order perception encoding and perturbation injection control. The path - order perception encoding encodes the relative time - series order and the embedding space offset relationship between the embedded representations of each malicious traffic sample in the embedded traffic sample sequence to obtain an initial path encoding representation; S43. The perturbation injection control uses the attack context embedding representation as a reference to apply a control perturbation to the initial path encoding representation. The control perturbation includes defining the perturbation direction and amplitude in the semantic embedding space, and outputs a perturbed path embedding representation; S44. Input the attack context embedding representation and the perturbed path embedding representation into the guiding - condition fusion structure. The guiding - condition fusion structure adopts a gated residual fusion method and outputs a guiding - condition vector, which contains both context attack intention and embedded path perturbation information.

[0014] Optionally, the gated residual fusion method includes: inputting the attack context embedding representation into a first fusion channel, and inputting the perturbation path embedding representation into a second fusion channel. The first fusion channel includes a residual mapping unit for performing an identity mapping on the attack context embedding representation and maintaining the integrity of its feature expression. The second fusion channel includes a gated activation unit for performing a gated weight generation operation on the perturbation path embedding representation. The gated weight is determined based on an attention coefficient matrix between the attack context embedding representation and the perturbation path embedding representation. The weighted perturbation path embedding representation output by the gated activation unit is element-wise weighted and fused with the attack context embedding representation output by the residual mapping unit to obtain a fused embedding representation, which is used as a guiding conditional vector and input into the generator structure of the generative adversarial network.

[0015] Optionally, the specific steps of S5 include: S51. Perform random sampling on the latent variable space based on a preset standard normal distribution to generate a random latent variable vector. The preset standard normal distribution is a Gaussian distribution with a mean of zero and a variance of one, which is used to introduce perturbations in the latent space. S52. Input the guiding conditional vector and the random latent variable vector into a feature-guided connection structure. The feature-guided connection structure includes a channel selection structure and a weight regulation structure. The channel selection structure performs a dimension screening operation according to the differences between the attack context semantic features and the embedded path perturbation features in the guiding conditional vector to determine the channels to be fused. The weight regulation structure generates fusion gating parameters based on the correlation distribution of each dimension element in the channels to be fused, and generates a joint input vector in a weighted fusion manner. S53. Input the joint input vector into the generator structure. The generator structure consists of multiple nested linear transformation layers, non-linear activation layers, and batch normalization layers, which sequentially extract fused features. S54. Set a cross-residual connection path in the generator structure to connect the initial features of the guiding conditional vector and the random latent variable vector with the intermediate hidden layer nodes respectively, and introduce an attention mechanism at a specified fusion layer to complete feature coupling enhancement. S55. Output the embedded representation of the potential malicious traffic sample, which is used as the input of the subsequent embedded consistency discriminant network for true / false identification and path similarity scoring.

[0016] Optionally, the specific steps of S6 include: S61. Construct an embedded consistency discriminant network. The embedded consistency discriminant network includes a true / false discrimination sub-structure and a path consistency evaluation sub-structure. The true / false discrimination sub-structure is used to judge the embedded semantic differences between the embedded representation of the potential malicious traffic sample and the embedded representation of the labeled true traffic sample. The path consistency evaluation sub-structure is used to evaluate the similar path structure between the embedded representation of the potential malicious traffic sample and the embedded representations in the embedded traffic sample sequence. S62. Embed the potential malicious traffic sample representation into the true / false discrimination sub-structure, and output a discrimination probability label based on the embedding representation feature distribution extracted by the multi-layer discrimination network; S63. Jointly input the potential malicious traffic sample representation and the embedded traffic sample sequence into the path consistency evaluation sub-structure, and calculate the matching score between the potential malicious traffic sample representation and the sample path by using the established sequential structure relationship and embedded spatial position coordinates of the embedded traffic sample sequence, and generate a path similarity score.

[0017] Optionally, the S7 specifically includes: S71. In the unified low-dimensional embedding space, obtain the embedding space position relationship between the potential malicious traffic sample representation and the embedded representations of multiple labeled malicious traffic samples, where the embedding space position relationship includes Euclidean distance, embedding trajectory angle, and local density distribution characteristics; S72. Combine the path similarity score result and the embedding space position relationship to construct an attack chain path graph, where the attack chain path graph takes the potential malicious traffic sample representation as the starting node and the embedded representations of labeled malicious traffic samples as the ending nodes, and the edge weights between nodes are comprehensively determined by the path similarity score and spatial position metric; S73. In the attack chain path graph, execute the weighted shortest path search algorithm to obtain the shortest path sequence between the potential malicious traffic sample representation and the embedded representations of each labeled malicious traffic sample, and construct multiple candidate traceability paths according to the shortest path sequence; S74. Calculate the confidence score for the multiple candidate traceability paths, where the confidence score is determined based on the path similarity scores of the embedded representations of each node in the path; S75. Screen the paths with confidence scores higher than the preset threshold as candidate valid paths, and output the candidate valid paths to construct the network attack chain traceability result.

[0018] The beneficial effects of the present invention are: (1) By constructing a multi-perspective low-dimensional embedding space that integrates protocol behavior features, communication structure features, and time evolution features, and combining embedding semantic alignment and path perturbation modeling, the present invention improves the structured expression ability of network malicious traffic, enabling the traceability process to accurately capture the potential connections between attack behaviors and effectively cope with complex and changing attack paths.

[0019] (2) By introducing potential space perturbation and guided condition control mechanisms through the generative adversarial network, and combining attack context modeling and embedded path perturbation encoding, the system has the ability of dynamic behavior simulation and evolution for target malicious traffic samples, realizes the accurate generation and authenticity discrimination of potential attack samples, thereby improving the accuracy and integrity of the traceability path construction.

[0020] (3) The present invention utilizes the relative positional relationship between the path consistency score and the low-dimensional embedding space, and combines the construction of the attack chain path graph and the shortest path inference mechanism, which not only improves the interpretability and tracing ability of the malicious traffic behavior chain, but also enhances the system's recognition and linkage traceability effect for multi-stage attack behaviors, and solves the problems of weak recognition ability of attack behavior chain segments and lack of behavior evolution modeling in traditional methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings are used to provide a further understanding of the present invention, and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention, and do not constitute a limitation to the present invention. In the drawings: Figure 1 is a flowchart of the network security malicious traffic traceability method based on the generative adversarial network proposed by the present invention; Figure 2 is a schematic flow diagram of network traffic feature extraction and multi-perspective fusion proposed by the present invention; Figure 3 is a schematic diagram of the process of constructing a segmented embedding manifold and generating an embedded traffic sample sequence proposed by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0022] Now, the present invention will be further described in detail with reference to the drawings. These drawings are all simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, so they only show the components related to the present invention.

[0023] Refer to Figures 1-3 , the network security malicious traffic traceability method based on the generative adversarial network includes the following steps: S1. Collect network traffic data, select the target traffic sample to be traced, extract protocol behavior features, communication structure features, and time evolution features, and perform semantic encoding respectively to generate protocol behavior embedding representations, communication structure embedding representations, and time evolution embedding representations; S2. Input the protocol behavior embedding representation, communication structure embedding representation, and time evolution embedding representation into the multi-perspective fusion process, construct semantic correspondence relationships, and uniformly map them to the low-dimensional embedding space; S3. In the low-dimensional embedding space, construct a set of segmented embedding manifolds based on multiple labeled malicious traffic samples, perform interpolation operations to generate intermediate state embedding representations, and form an embedded traffic sample sequence; S4. Generate an attack context embedding representation based on the target traffic sample, perform perturbation path encoding on the embedded traffic sample sequence to generate a perturbation path embedding representation, and combine it with the attack context embedding representation to form a guiding condition vector; S5. Input the guiding conditional vector and the randomly generated latent variable based on the preset distribution into the generator, and the generator performs joint encoding to output the embedded representation of the potential malicious traffic sample; S6. Input the embedded representation of the potential malicious traffic sample into the embedded consistency discriminant network, perform true / false recognition, and conduct path similarity scoring; S7. According to the path similarity scoring and the positional relationship of the embedded representation of the potential malicious traffic sample in the low-dimensional embedding space, construct an attack chain path graph and calculate the shortest path sequence to the embedded representation of the labeled malicious traffic sample.

[0024] In this embodiment, the specific steps of S1 include: S11. Collect the original network traffic data within a preset time window, construct a five-tuple key value based on the source Internet protocol address, destination Internet protocol address, source port number, destination port number, and network protocol type, and perform flow-level recombination on the original network data packets to generate an ordered network session sequence; S12. In the ordered network session sequence, select the target network traffic sample to be traced based on the behavior matching strategy, and the behavior matching strategy includes a rule comparison strategy based on known malicious feature templates; S13. Extract the protocol behavior features for the target network traffic sample, and the protocol behavior features include the data packet interaction direction sequence, data packet length sequence, and protocol field change sequence in the network session; S14. Extract the communication structure features for the target network traffic sample, and the communication structure features construct a communication graph model based on the end-to-end network entity interaction relationship and extract graph structure parameters such as connection relationship density, path length distribution, node centrality, and structure nesting level; S15. Extract the time evolution features for the target network traffic sample, and the time evolution features include the time interval distribution between data packets, the frequency distribution of the emergency time window, and the active time period sequence; S16. Input the protocol behavior features, communication structure features, and time evolution features into the protocol behavior semantic encoding structure, communication structure semantic encoding structure, and time evolution semantic encoding structure respectively, and perform embedded expression mapping. The semantic encoding structure includes a normalization layer, a structure parsing layer, and an embedded output layer; S17. Output the protocol behavior embedded representation, communication structure embedded representation, and time evolution embedded representation respectively.

[0025] In this embodiment, the original network traffic is reconstructed at the flow level by constructing five - tuple key - value pairs, generating an ordered network session sequence, and identifying target network traffic samples from it based on the malicious feature template matching strategy. Then, protocol behavior features, communication structure features, and time - evolution features are extracted respectively, and embedded mapping is performed through a semantic encoding structure. Finally, three types of embedded representations are output to achieve structured modeling and multi - dimensional characterization of malicious behaviors. This embodiment effectively improves the expression integrity and discrimination ability of malicious traffic samples, provides high - quality input for subsequent embedded fusion and traceability reasoning, and enhances the system's perception ability and analysis depth for complex network threats.

[0026] In this embodiment, S2 specifically includes: S21. Receive the protocol behavior embedded representation, communication structure embedded representation, and time - evolution embedded representation, and perform unified scale normalization processing on the three types of embedded representations to keep the feature amplitudes and statistical distributions consistent; S22. Input the normalized protocol behavior embedded representation, communication structure embedded representation, and time - evolution embedded representation into a multi - perspective semantic alignment structure. The multi - perspective semantic alignment structure includes three - way cross - attention channels, and obtain the saliency mapping relationship between cross - embedded channels by calculating the semantic interaction matrix between feature dimensions; S23. In the multi - perspective semantic alignment structure, construct a feature - guiding channel, use the protocol behavior embedded representation as the leading channel, and perform attention - weight weighted fusion on the communication structure embedded representation and time - evolution embedded representation to generate a fused feature representation. The fusion process maintains the context structure guiding role of the protocol behavior main perspective; S24. Input the fused feature representation into a unified low - dimensional embedded space mapping structure. The mapping structure includes a multi - layer non - linear transformation module with inter - layer residual connections, and set a semantic distance preservation constraint to maintain the spatial geometric relationship between the original three types of embeddings.

[0027] In this embodiment, by performing unified scale normalization processing on the protocol behavior embedded representation, communication structure embedded representation, and time - evolution embedded representation, and using three - way cross - attention channels in the multi - perspective semantic alignment structure to construct a semantic interaction matrix, the saliency alignment and fusion of the three types of features are realized. Taking the protocol behavior embedded representation as the leading channel, and using the attention - weighted method to guide other feature channels to generate a fused feature representation effectively strengthens the leading role of the protocol behavior perspective in the overall semantic fusion. Subsequently, a unified low - dimensional embedded mapping is completed through a non - linear transformation module with inter - layer residual connections, and a semantic distance preservation constraint is introduced to maintain the spatial relationship between features. This method not only improves the integration accuracy of multi - class network traffic semantic information, but also enhances the consistency and discrimination of attack behavior representations in the embedded space, providing a more stable and discriminative embedded basis for subsequent malicious traffic reasoning.

[0028] In this embodiment, step S3 specifically includes: S31. Obtain the embedded representations of multiple labeled malicious traffic samples in the unified low-dimensional embedding space. According to the attack behavior labels, spatial distribution positions, and behavioral timing coding results corresponding to each embedded representation of the labeled malicious traffic sample, perform joint clustering operations to construct a clustering set of malicious behavior embedded samples; S32. For each clustering set of malicious behavior embedded samples, based on the change in the semantic similarity distribution between adjacent embedded representations of the labeled malicious traffic samples in the clustering set and the stage span information of the attack stage labels, identify the segmentation boundary points, and divide each clustering set of malicious behavior embedded samples into several local embedded manifold sub-segments; S33. Combine all the local embedded manifold sub-segments into a segmented embedded manifold set according to the time sequence of the attack behavior and the relationship of the attack chain structure. The segmented embedded manifold set represents an embedded path structure set composed of multiple local embedded manifold sub-segments with a structural continuity relationship; S34. Select an interpolation control path according to the attack context embedded representation generated from the target traffic sample. Perform interpolation operations along the interpolation control path in the segmented embedded manifold set, perform equidistant interpolation operations inside the local embedded manifold sub-segments, and perform perturbation control interpolation operations between different local embedded manifold sub-segments to generate intermediate state embedded representations; S35. Combine multiple intermediate state embedded representations with the corresponding embedded representations of the labeled malicious traffic samples to form an embedded traffic sample sequence, which is used as a guiding basis for constructing potential malicious traffic samples in the input space of the subsequent generative adversarial network.

[0029] In this embodiment, in the unified low-dimensional embedding space, first, integrate the embedded representations of multiple labeled malicious traffic samples through a joint clustering algorithm, and construct a clustering set of malicious behavior embedded samples by combining attack behavior labels, spatial positions, and behavioral timing characteristics; then, identify the clustering boundaries based on the change in semantic similarity and attack stage span information, divide into clearly structured local embedded manifold sub-segments, and sequentially form a segmented embedded manifold set according to the time sequence and chain structure of the attack behavior; furthermore, determine the interpolation control path based on the attack context embedded representation of the target traffic sample, perform equidistant interpolation inside the sub-segments, and perform perturbation control interpolation between the sub-segments to generate intermediate state embedded representations expressing the intermediate state of the attack evolution; finally, combine to generate an embedded traffic sample sequence, providing a guiding basis for the subsequent generative adversarial network to model potential malicious samples. This embodiment effectively models the stage and evolution continuity of malicious attack behaviors, and improves the simulation ability of potential attack paths and the traceability of generated samples.

[0030] In this embodiment, step S4 specifically includes: S41. Input the protocol behavior embedding representation, communication structure embedding representation, and temporal evolution embedding representation based on the target network traffic sample into the attack context modeling structure. The attack context modeling structure includes temporal feature extraction and behavior intention modeling, which are used to encode the behavior evolution and structural features of the target network traffic sample and generate an attack context embedding representation. S42. Input the embedded traffic sample sequence into the path perturbation encoding structure. The path perturbation encoding structure includes path order-aware encoding and perturbation injection control. The path order-aware encoding encodes the relative temporal order and the embedding space offset relationship between the embedding representations of each malicious traffic sample in the embedded traffic sample sequence to obtain an initial path encoding representation. S43. The perturbation injection control takes the attack context embedding representation as a reference and applies a control perturbation to the initial path encoding representation. The control perturbation includes defining the perturbation direction and amplitude in the semantic embedding space and outputs a perturbed path embedding representation. S44. Input the attack context embedding representation and the perturbed path embedding representation into the guided conditional fusion structure. The guided conditional fusion structure adopts a gated residual fusion method and outputs a guided conditional vector, which contains both the context attack intention and the embedded path perturbation information.

[0031] In this embodiment, by inputting the protocol behavior embedding representation, communication structure embedding representation, and temporal evolution embedding representation of the target network traffic sample into the attack context modeling structure, the behavior evolution process and attack intention information are extracted. At the same time, the embedded traffic sample sequence is input into the path perturbation encoding structure, and the initial path encoding is formed by using the path order-aware and perturbation injection mechanisms. Combining the attack context embedding representation, the directionality and amplitude control are introduced to generate a perturbed path embedding representation. Subsequently, through the gated residual fusion structure, the context attack semantics and the path perturbation features are conditionally jointly encoded, and a guided conditional vector that comprehensively represents the attack behavior chain is output. This method enhances the generation model's understanding ability of the evolution path of malicious attack chains, improves the pertinence and controllability of the potential malicious traffic sample generation process, and provides a higher-confidence semantic basis for subsequent traceability mapping and generation discrimination.

[0032] In this embodiment, the gated residual fusion method includes: inputting the attack context embedding representation into the first fusion channel, and inputting the perturbation path embedding representation into the second fusion channel. The first fusion channel includes a residual mapping unit for performing an identity mapping on the attack context embedding representation and maintaining the integrity of its feature expression. The second fusion channel includes a gated activation unit for performing a gated weight generation operation on the perturbation path embedding representation. The gated weight is determined based on the attention coefficient matrix between the attack context embedding representation and the perturbation path embedding representation. The weighted perturbation path embedding representation output by the gated activation unit and the attack context embedding representation output by the residual mapping unit are element-wise weighted and fused to obtain a fused embedding representation, and the fused embedding representation is input into the generator structure of the generative adversarial network as a guiding conditional vector.

[0033] In this embodiment, by setting the residual mapping unit and the gated activation unit, the attack context embedding representation and the perturbation path embedding representation are respectively input into two fusion channels, realizing a dual-channel fusion mechanism for complete retention of context features and dynamic regulation of perturbation features. Among them, the residual mapping unit performs an identity mapping on the attack context embedding representation to ensure that its behavioral semantics are not weakened; the gated activation unit generates a fusion weight based on the attention coefficient matrix and performs weighted control on the perturbation path embedding representation to highlight the perturbation dimensions highly relevant to the context. Finally, the fused embedding representation is generated by element-wise weighted fusion and input into the generator structure as a guiding conditional vector, making the process of generating potential malicious traffic samples controllable and context-adaptive, effectively improving the pertinence and expression consistency of sample generation in the generative adversarial network, and enhancing the system's modeling ability and generalization ability for complex attack paths.

[0034] In this embodiment, S5 specifically includes: S51. Perform random sampling on the latent variable space based on a preset standard normal distribution to generate a random latent variable vector. The preset standard normal distribution is a Gaussian distribution with a mean of zero and a variance of one, which is used to introduce perturbations in the latent space. S52. Input the guiding conditional vector and the random latent variable vector into a feature-guided connection structure. The feature-guided connection structure includes a channel selection structure and a weight regulation structure. Among them, the channel selection structure performs a dimension screening operation according to the differences between the attack context semantic features and the embedding path perturbation features in the guiding conditional vector to determine the channels to be fused. The weight regulation structure generates fusion gating parameters based on the correlation distribution of each dimension element in the channels to be fused and generates a joint input vector in a weighted fusion manner. S53. Input the joint input vector into the generator structure. The generator structure is composed of multiple nested linear transformation layers, non-linear activation layers, and batch normalization layers, and sequentially extracts fusion features. S54. Set a cross-residual connection path in the generator structure to connect the guiding conditional vector and the initial features of the random latent variable vector to the intermediate hidden layer nodes respectively, and introduce an attention mechanism in the specified fusion layer to complete feature coupling enhancement; S55. Output the embedded representation of the potential malicious traffic sample, which is used as the input of the subsequent embedded consistency discrimination network for true / false identification and path similarity scoring.

[0035] In this embodiment, by constructing a feature guiding connection structure including a channel selection structure and a weight regulation structure, the guiding conditional vector is fused with the random latent variable vector generated by sampling based on the standard normal distribution, and the residual connection and the attention mechanism are introduced to enhance the feature coupling expression, so as to generate an embedded representation of the potential malicious traffic sample with collaborative features of attack context semantics and path perturbation features, realizing targeted encoding of guiding information and multi-dimensional potential perturbation modeling, effectively improving the expression accuracy and structural consistency of the generated samples, and providing a stable and discriminative input basis for subsequent embedded consistency discrimination and path inference.

[0036] In this embodiment, the specific steps of S6 are as follows: S61. Construct an embedded consistency discrimination network, which includes a true / false discrimination sub-structure and a path consistency scoring sub-structure. The true / false discrimination sub-structure is used to judge the embedded semantic difference between the embedded representation of the potential malicious traffic sample and the embedded representation of the labeled real traffic sample, and the path consistency scoring sub-structure is used to evaluate the similar path structure between the embedded representation of the potential malicious traffic sample and the embedded representation in the embedded traffic sample sequence; S62. Input the embedded representation of the potential malicious traffic sample into the true / false discrimination sub-structure, and output a discrimination probability label according to the embedded representation feature distribution extracted by the multi-layer discrimination network; S63. Input the embedded representation of the potential malicious traffic sample and the embedded traffic sample sequence into the path consistency scoring sub-structure together, and calculate the matching score between the embedded representation of the potential malicious traffic sample and the sample path by using the established sequential structure relationship and embedded space position coordinates of the embedded traffic sample sequence, and generate a path similarity score.

[0037] In this embodiment, by constructing an embedding consistency discrimination network and using the true / false discrimination sub-structure and the path consistency evaluation sub-structure in combination, first, the true / false recognition of the embedding semantic difference between the embedding representation of the potential malicious traffic sample and the embedding representation of the labeled true traffic sample is performed to output a discrimination probability label. At the same time, using the sequential structure and spatial position relationship of the embedding traffic sample sequence, the path structure matching analysis of the embedding representation of the potential malicious traffic sample is carried out to generate a path similarity score, realizing the multi-dimensional consistency judgment of the potential sample. This method comprehensively considers the traffic semantics and evolution path characteristics, improves the accuracy and credibility of malicious traffic recognition, provides a discrimination basis and path reference for subsequent attack chain analysis and traceability path construction, and enhances the system's perception and response capabilities for complex network attacks.

[0038] In this embodiment, the S7 specifically includes: S71. In the unified low-dimensional embedding space, obtain the embedding space position relationship between the embedding representation of the potential malicious traffic sample and the embedding representations of multiple labeled malicious traffic samples, where the embedding space position relationship includes Euclidean distance, embedding trajectory angle, and local density distribution characteristics; S72. Combine the path similarity score result and the embedding space position relationship to construct an attack chain path graph. The attack chain path graph takes the embedding representation of the potential malicious traffic sample as the starting node and the embedding representations of the labeled malicious traffic samples as the ending nodes, and the edge weights between the nodes are comprehensively determined by the path similarity score and the spatial position metric; S73. In the attack chain path graph, execute the weighted shortest path search algorithm to obtain the shortest path sequence between the embedding representation of the potential malicious traffic sample and the embedding representations of each labeled malicious traffic sample, and construct multiple traceability path candidates according to the shortest path sequence; S74. Calculate the confidence score for the multiple traceability path candidates, where the confidence score is determined based on the path similarity scores of the embedding representations of each node in the path; S75. Screen the paths with confidence scores higher than the preset threshold as candidate valid paths, and output the candidate valid paths to construct the network attack chain traceability result.

[0039] In this embodiment, by analyzing the spatial position relationship between the embedding representation of potential malicious traffic samples and the embedding representations of multiple labeled malicious traffic samples in a unified low-dimensional embedding space, and combining the path similarity score, a structured attack chain path graph is constructed; the weighted shortest path search algorithm is used to identify multiple possible attack tracing paths, and the confidence score is calculated based on the similarity between nodes, and the paths with higher confidence are selected as candidate valid paths. This method not only realizes the ability to depict the evolution process of potential attack behaviors from the spatial semantic dimension, but also effectively improves the accuracy and reliability of tracing path identification through path structure analysis, and has the advantages of efficient, automatic, and interpretable network attack chain reconstruction.

[0040] Example 1: To verify the feasibility of the present invention in implementation, the present invention is applied to the production network environment of a certain power dispatching center. The control instructions, telemetry information, and user access requests transmitted in real time constitute a complex network communication map. However, unknown source hosts frequently access the key dispatching instruction ports in the intranet of the dispatching center, and there is a suspected APT-class slow attack behavior. The conventional signature-based detection and fixed-rule intrusion detection systems fail to effectively locate the attack path and tracing information.

[0041] To solve the above problems, the center introduces the malicious traffic tracing method based on the generative adversarial network proposed by the present invention, which is deployed in the bypass flow control link of the north-south switching nodes. The system collects the original network traffic data from a seven-day sliding window, performs flow-level recombination based on the five-tuple, and constructs an ordered network session sequence. The target network traffic samples with control plane characteristics (such as continuously maintaining sessions, special protocol field jumps, etc.) are identified through the behavior matching strategy, and three types of features, namely protocol behavior, communication structure, and time evolution, are extracted and respectively fed into the semantic encoding structure for embedding representation.

[0042] The system inputs the three types of embedding representations into the multi-perspective fusion module, completes semantic alignment through the channel-level attention structure, and uniformly maps them into a 128-dimensional low-dimensional embedding space while maintaining the geometric relationship between the features. Using the historical labeled APT attack traffic samples (such as C&C connections, backdoor activation behaviors, etc.), a segmented embedding manifold set is generated based on the attack stage labels and embedding trajectories, and local linear interpolation is performed to generate intermediate state representations, forming an embedded traffic sample sequence.

[0043] The embedding representation of the target network traffic sample is used to generate an attack context vector, which is combined with the embedded traffic sample sequence. The perturbed path embedding representation is generated through the path perturbation modeling method. This representation is fused with the attack context to form a guiding conditional vector, which is then jointly input into the generator together with the latent variable sampled from the Gaussian distribution to output the embedding representation of the potential malicious traffic sample.

[0044] The potential embedding representation is input into the embedding consistency discrimination network to evaluate its true and false semantic differences and path structure consistency with the embedding traffic sample sequence respectively, and the discrimination label and path score are output. Starting from the potential sample, the system constructs an attack chain path graph in the known malicious sample embedding set, constructs the graph edge weights by combining the embedding space distance (Euclidean distance + angle + density) and similarity score, generates candidate paths through the shortest path search, and screens the effective traceability paths according to the path confidence. The following are the experimental deployment environment data and result statistics: Table 1 Comparison Results of Technical Applications of the Network Traceability System of the National Electric Power Dispatching Center ; To further illustrate the actual operation of this method, the following is the tracking situation of an attack path generated by the system: The traceability system captures a target network traffic sample that continuously accesses the dispatching instruction port remotely. The system determines that the similarity between its embedding representation and that of a "backdoor implantation sample" in the embedding space is 0.89, and automatically derives a complete attack path sequence with "DNS tunnel communication → remote activation → data backhaul" as the stages along the attack chain graph. Finally, it is recommended to mark a temporary task scheduling behavior of an internal Windows host as the traceability root node. The traceability time only takes 13.7 seconds, which is 78% shorter than the original process.

[0045] In summary, this embodiment demonstrates the multi-stage path tracking ability of the present invention for complex APT attacks in a high-strength security requirement environment, with full-link technical features such as unified feature fusion, embedding generation, path construction, confidence scoring, and interpretable graph output, significantly superior to the existing rule-based and graph mining methods, and applicable to network security scenarios in key industries such as power, energy, and government affairs.

[0046] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention, according to the technical solution and inventive concept of the present invention, makes equivalent substitutions or changes, and all should be covered by the protection scope of the present invention.

Claims

1. A method for tracing the origin of malicious network traffic based on a generative adversarial network, characterized in that, It includes the following steps: S1. Collect network traffic data, select the target traffic samples to be traced, extract protocol behavior features, communication structure features, and time evolution features, perform semantic encoding respectively, and generate protocol behavior embedding representations, communication structure embedding representations, and time evolution embedding representations; S2. Input the protocol behavior embedding representations, communication structure embedding representations, and time evolution embedding representations into the multi-perspective fusion process, construct semantic correspondence relationships, and uniformly map them to a low-dimensional embedding space; S3. In the low-dimensional embedding space, construct a segmented embedding manifold set based on multiple labeled malicious traffic samples, perform interpolation operations to generate intermediate state embedding representations, and form an embedded traffic sample sequence; S4. Generate an attack context embedding representation based on the target traffic samples, perform perturbation path encoding on the embedded traffic sample sequence to generate perturbation path embedding representations, and combine them with the attack context embedding representation to form a guiding conditional vector; S5. Input the guiding conditional vector and a random latent variable generated by sampling based on a preset distribution into a generator, and the generator performs joint encoding to output a latent malicious traffic sample embedding representation; S6. Input the latent malicious traffic sample embedding representation into an embedded consistency discriminant network, perform true / false identification, and perform path similarity scoring; S7. According to the path similarity scoring and the positional relationship of the latent malicious traffic sample embedding representation in the low-dimensional embedding space, construct an attack chain path graph and calculate the shortest path sequence to the labeled malicious traffic sample embedding representation.

2. The method for tracing the origin of network security malicious traffic based on the generative adversarial network according to claim 1, wherein The specific content of S1 includes: S11. Collect the original network traffic data within a preset time window, construct a five-tuple key value based on the source Internet protocol address, destination Internet protocol address, source port number, destination port number, and network protocol type, perform flow-level recombination on the original network data packets, and generate an ordered network session sequence; S12. In the ordered network session sequence, select the target network traffic samples to be traced based on a behavior matching strategy, and the behavior matching strategy includes a rule comparison strategy based on known malicious feature templates; S13. Extract protocol behavior features for the target network traffic samples, and the protocol behavior features include the data packet interaction direction sequence, data packet length sequence, and protocol field change sequence in the network session; S14. Extract communication structure features for the target network traffic samples, and the communication structure features construct a communication graph model based on the end-to-end network entity interaction relationship, and extract connection relationship density, path length distribution, node centrality, and structure nesting level graph structure parameters; S15. Extract time evolution features for the target network traffic samples, and the time evolution features include the inter-packet time interval distribution, emergency event time window frequency distribution, and active time period sequence; S16. Input the protocol behavior features, communication structure features, and time evolution features into a protocol behavior semantic encoding structure, a communication structure semantic encoding structure, and a time evolution semantic encoding structure respectively, perform embedding expression mapping, and the semantic encoding structure includes a normalization layer, a structure parsing layer, and an embedding output layer; S17. Output protocol behavior embedding representations, communication structure embedding representations, and time evolution embedding representations respectively.

3. The method for tracing malicious network traffic in network security based on the generative adversarial network according to claim 1, characterized in that, The specific steps of S2 are as follows: S21: Receive the protocol behavior embedding representation, communication structure embedding representation, and time evolution embedding representation, and perform unified scale normalization processing on the three types of embedding representations; S22: Input the normalized protocol behavior embedding representation, communication structure embedding representation, and time evolution embedding representation into the multi-view semantic alignment structure. The multi-view semantic alignment structure includes three-way cross-attention channels. By calculating the semantic interaction matrix between feature dimensions, obtain the saliency mapping relationship between cross-embedding channels; S23: In the multi-view semantic alignment structure, construct a feature-guided channel. Use the protocol behavior embedding representation as the dominant channel, and perform attention-weighted fusion on the communication structure embedding representation and time evolution embedding representation to generate a fused feature representation; S24: Input the fused feature representation into the unified low-dimensional embedding space mapping structure. The mapping structure includes a multi-layer non-linear transformation module with inter-layer residual connections, and set semantic distance preservation constraints to maintain the spatial geometric relationship between the original three types of embeddings.

4. The method for tracing the source of malicious network traffic based on a generative adversarial network according to claim 1, characterized in that The specific steps of S3 are as follows: S31: Obtain the embedding representations of multiple labeled malicious traffic samples in the unified low-dimensional embedding space. Based on the attack behavior labels, spatial distribution positions, and behavior sequence coding results corresponding to each labeled malicious traffic sample embedding representation, perform joint clustering operations to construct a clustering set of malicious behavior embedding samples; S32: For each clustering set of malicious behavior embedding samples, based on the change in the semantic similarity distribution between adjacent labeled malicious traffic sample embedding representations in the clustering set and the stage span information of the attack stage labels, identify the segmentation boundary points, and divide each clustering set of malicious behavior embedding samples into several local embedding manifold sub-segments; S33: Combine all local embedding manifold sub-segments according to the attack behavior time sequence and the attack chain structure relationship to form a segmented embedding manifold set. The segmented embedding manifold set represents an embedding path structure set composed of multiple local embedding manifold sub-segments with structural continuity relationships; S34: Select an interpolation control path according to the attack context embedding representation generated by the target traffic sample. Perform interpolation operations along the interpolation control path in the segmented embedding manifold set, perform equidistant interpolation operations inside the local embedding manifold sub-segments, and perform perturbation control interpolation operations between different local embedding manifold sub-segments to generate intermediate state embedding representations; S35: Combine multiple intermediate state embedding representations with the corresponding labeled malicious traffic sample embedding representations to form an embedding traffic sample sequence.

5. The method for tracing the origin of network security malicious traffic based on the generative adversarial network according to claim 1, characterized in that, The specific steps of S4 are as follows: S41: Based on the protocol behavior embedding representation, communication structure embedding representation, and time evolution embedding representation of the target network traffic sample, input them into the attack context modeling structure. The attack context modeling structure includes time sequence feature extraction and behavior intention modeling, which are used to encode the behavior evolution and structural features of the target network traffic sample to generate an attack context embedding representation; S42. Input the embedded traffic sample sequence into the path perturbation encoding structure. The path perturbation encoding structure includes path order perception encoding and perturbation injection control. The path order perception encoding encodes the relative temporal order and the embedded space offset relationship between the embedded representations of each malicious traffic sample in the embedded traffic sample sequence to obtain an initial path encoding representation. S43. The perturbation injection control uses the attack context embedded representation as a reference to apply a control perturbation to the initial path encoding representation. The control perturbation includes specifying the perturbation direction and perturbation amplitude in the semantic embedding space, and outputs a perturbed path embedded representation. S44. Input the attack context embedded representation and the perturbed path embedded representation into the guided condition fusion structure. The guided condition fusion structure adopts a gated residual fusion method and outputs a guided condition vector, which simultaneously contains the context attack intention and the embedded path perturbation information.

6. The method for tracing the origin of network security malicious traffic based on a generative adversarial network according to claim 5, characterized in that, The gated residual fusion method includes: inputting the attack context embedded representation into the first fusion channel, and inputting the perturbed path embedded representation into the second fusion channel. The first fusion channel includes a residual mapping unit for performing an identity mapping on the attack context embedded representation and maintaining the integrity of its feature expression. The second fusion channel includes a gated activation unit for performing a gated weight generation operation on the perturbed path embedded representation. The gated weight is determined based on the attention coefficient matrix between the attack context embedded representation and the perturbed path embedded representation. The weighted perturbed path embedded representation output by the gated activation unit and the attack context embedded representation output by the residual mapping unit are element-wise weighted fused to obtain a fused embedded representation. The fused embedded representation is input into the generator structure of the generative adversarial network as the guided condition vector.

7. The method for tracing malicious network traffic in network security based on a generative adversarial network according to claim 1, wherein The specific steps of S5 are as follows: S51. Perform random sampling on the latent variable space based on a preset standard normal distribution to generate a random latent variable vector. The preset standard normal distribution is a Gaussian distribution with a mean of zero and a variance of one. S52. Input the guided condition vector and the random latent variable vector into the feature-guided connection structure. The feature-guided connection structure includes a channel selection structure and a weight regulation structure. The channel selection structure performs a dimension screening operation according to the difference between the attack context semantic features and the embedded path perturbation features in the guided condition vector to determine the channels to be fused. The weight regulation structure generates a fusion gating parameter based on the correlation distribution of each dimension element in the channels to be fused, and generates a joint input vector in a weighted fusion manner. S53. Input the joint input vector into the generator structure. The generator structure consists of multiple nested linear transformation layers, non-linear activation layers, and batch normalization layers, and sequentially extracts fused features. S54. Set a cross-residual connection path in the generator structure to connect the initial features and intermediate hidden layer nodes of the guided condition vector and the random latent variable vector respectively, and introduce an attention mechanism in the specified fusion layer to complete feature coupling enhancement. S55. Output the embedded representation of the potential malicious traffic sample.

8. The method for tracing malicious network traffic based on a generative adversarial network according to claim 1, characterized in that The specific steps of S6 are as follows: S61. Construct an embedding consistency discrimination network, where the embedding consistency discrimination network includes a true / false discrimination sub-structure and a path consistency evaluation sub-structure. The true / false discrimination sub-structure is used to judge the embedding semantic difference between the embedding representation of the potential malicious traffic sample and the embedding representation of the labeled true traffic sample, and the path consistency evaluation sub-structure is used to evaluate the similar path structure between the embedding representation of the potential malicious traffic sample and the embedding representations in the embedded traffic sample sequence; S62. Input the embedding representation of the potential malicious traffic sample into the true / false discrimination sub-structure, and output a discrimination probability label according to the embedding representation feature distribution extracted by the multi-layer discrimination network; S63. Input the embedding representation of the potential malicious traffic sample and the embedded traffic sample sequence into the path consistency evaluation sub-structure together, and use the established sequential structure relationship and embedding space position coordinates of the embedded traffic sample sequence to calculate the matching score between the embedding representation of the potential malicious traffic sample and the sample path, and generate a path similarity score.

9. The method for tracing the origin of malicious network traffic based on a generative adversarial network according to claim 1, characterized in that, The specific steps of S7 are as follows: S71. In the unified low-dimensional embedding space, obtain the embedding space position relationship between the embedding representation of the potential malicious traffic sample and the embedding representations of multiple labeled malicious traffic samples. The embedding space position relationship includes Euclidean distance, embedding trajectory angle, and local density distribution characteristics; S72. Combine the path similarity score result and the embedding space position relationship to construct an attack chain path graph. The attack chain path graph takes the embedding representation of the potential malicious traffic sample as the starting node and the embedding representations of the labeled malicious traffic samples as the ending nodes, and the edge weights between the nodes are comprehensively determined by the path similarity score and the space position metric; S73. In the attack chain path graph, execute the weighted shortest path search algorithm to obtain the shortest path sequence between the embedding representation of the potential malicious traffic sample and the embedding representations of each labeled malicious traffic sample, and construct multiple candidate tracing paths according to the shortest path sequence; S74. Calculate the confidence score for the multiple candidate tracing paths. The confidence score is determined according to the path similarity scores of the embedding representations of each node in the path; S75. Screen the paths with confidence scores higher than the preset threshold as candidate valid paths, and output the candidate valid paths to construct the network attack chain tracing result.

Images