Network traffic packet header track synthesis method and device, server and storage medium

Abstract

The invention relates to a network traffic packet header track synthesis method and device, a server and a storage medium, and the method comprises the steps: obtaining a real network traffic data packet and real traffic; the real network traffic data packet and the real traffic are utilized to train a pre-constructed initial network traffic packet header trajectory synthesis model to obtain a final network traffic packet header trajectory synthesis model, and the initial network traffic packet header trajectory synthesis model is composed of a pre-processor, a generator, a discriminator and a training controller; and using the final network traffic packet header trajectory synthesis model to obtain a network traffic packet header trajectory satisfying a preset real trajectory feature packet granularity and flow granularity feature distribution condition. Therefore, the problems that in related technologies, in rule and expert knowledge-driven network traffic packet header track synthesis, the labor cost is high, and professional knowledge is relied on, so that the simulation ability in a complex network environment is restricted, and in network model-driven network traffic packet header track synthesis, the simulation ability in a complex network environment is limited, and in the network model-driven network traffic packet header track synthesis, the simulation ability in a complex network environment is influenced by the adaptation degree of a model and network traffic are solved. And the flexibility is poor.

Description

Technical Field

[0001] The present application relates to the technical field of electronic digital data processing, and in particular to a method, device, server and storage medium for synthesizing a network traffic packet header trajectory. Background Art

[0002] Modern networks increasingly rely on supervised machine learning to assist with network security and network quality of service (QoS) management tasks, such as classification-based network intrusion detection and application type identification under encrypted traffic. Class-labeled network traffic header traces can be used to develop network security and QoS management tools based on supervised machine learning models. For example, class-labeled network traffic header traces containing attack traffic such as distributed denial of service (DDoS), port scanning, or brute force attacks can be used to train and test IPS systems. By identifying attack categories, IPS systems can determine the threat level and respond accordingly. Class-labeled network traffic header traces containing multiple application traffic can help identify application service types under encrypted traffic (such as TLS) and anonymous protocols (such as VPNs and Tor), providing more fine-grained network monitoring and traffic control for different application services to ensure their security and quality.

[0003] Network operators and organizations with proprietary networks can capture large amounts of up-to-date, real-world network traffic packet header traces through network traffic capture. These traces can be labeled using existing classification models combined with manual annotation. However, due to potential policy, privacy, and commercial restrictions, network operators and other internet entities with large amounts of labeled network traffic traces cannot directly share this data, which may contain sensitive user information (such as IP addresses). Network traffic trace synthesis technology can be used to address the issue of sharing labeled network traffic trace datasets.

[0004] However, in related technologies, the selection of parameters in the network traffic header trajectory synthesis driven by rules and expert knowledge requires the participation of a large amount of manpower and expert knowledge, which restricts its ability to simulate complex network environments; in the network traffic header trajectory synthesis driven by network models, the generation effect depends on the degree of adaptation between the model and the network traffic, making it difficult to flexibly respond to different network scenarios and complex traffic distributions, and urgently needs to be improved. Summary of the Invention

[0005] The present application provides a method, device, server, and storage medium for synthesizing network traffic packet header trajectories to address the technical issues in related technologies. In rule- and expert-knowledge-driven network traffic packet header trajectory synthesis, the labor cost is high and the reliance on professional knowledge restricts the simulation capabilities in complex network environments. In network model-driven network traffic packet header trajectory synthesis, the reliance on the adaptability of the model to the network traffic leads to poor flexibility.

[0006] The first aspect of the present application provides a method for synthesizing a network traffic packet header trajectory, which is applied to a server, wherein the method includes the following steps: obtaining real network traffic data packets and real traffic; using the real network traffic data packets and the real traffic to train a pre-constructed initial network traffic packet header trajectory synthesis model to obtain a final network traffic packet header trajectory synthesis model, wherein the initial network traffic packet header trajectory synthesis model is composed of a pre-processor, a generator, a discriminator and a training controller; using the final network traffic packet header trajectory synthesis model, a network traffic packet header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions is obtained.

[0007] Optionally, in one embodiment of the present application, the use of the real network traffic data packets and the real traffic to train a pre-constructed initial network traffic header trajectory synthesis model to obtain a final network traffic header trajectory synthesis model includes: using the pre-processor to reversibly bin the sequence of the real network traffic data packets to obtain a bin sequence that meets preset conditions, and unifying the attribute values ​​of the bin sequence into category features; obtaining the length of the traffic from the real traffic, and using the preset category label and the length as input of the generator to obtain a generated sequence; performing word vector processing on the bin sequence and the generated sequence, and inputting them into the discriminator to obtain a discrimination result; using the training controller to receive the discrimination result and calculate the corresponding loss value, so as to use the loss value to guide the generator and the discriminator to optimize, so as to obtain the final network traffic header trajectory synthesis model.

[0008] Optionally, in one embodiment of the present application, the loss value is used to guide the optimization of the generator and the discriminator to obtain the final network traffic packet header trajectory synthesis model, including: using the training controller to sample different length prefixes of the generated sequence to obtain a sampled generated sequence; inputting the sampled generated sequence into the discriminator to obtain an optimized discrimination result, and using the optimized discrimination result to update the loss value until the loss value meets the preset iteration termination condition to obtain the final network traffic packet header trajectory synthesis model.

[0009] Optionally, in one embodiment of the present application, the pre-processor is used to reversibly bin the real network traffic data packet sequence to obtain a bin sequence that meets preset conditions, and the attribute values ​​of the bin sequence are unified into category features, including: obtaining the attribute values ​​of the real network traffic data packets with category labels under multiple categories from the sequence of real network traffic data packets; calculating the chi-square value of the attribute value of the real network traffic data packet; and using the chi-square value to bin the value range of the attribute value of the real network traffic data packet to unify the attribute value of the real network traffic data packet into the category feature.

[0010] Optionally, in one embodiment of the present application, the length of the traffic is obtained from the real traffic, and the preset category label and the length are used as inputs of the generator to obtain a generated sequence, including: obtaining the previous complete sequence value, wherein the complete sequence value is a sequence value in which all target attribute values ​​have been embedded, and the sequence value is a vector composed of target attribute values ​​extracted from any data table in the real network traffic data packet; combining the previous complete sequence value, the preset category label and the length, using the sequence feature probability to generate a path, and embedding any target attribute value into the current sequence value; based on the target attribute value already in the current sequence value, using the conditional probability feature to generate a bypass, and embedding all unembedded target attribute values ​​into the current sequence value until the generated sequence is obtained.

[0011] Optionally, in one embodiment of the present application, the calculation expression of the loss value of the discriminator includes:

[0012]

[0013] in, represents the final loss value of the discriminator, Represents the loss value of the discriminator’s discrimination result on real data, Represents the loss value of the discriminator for the generated sequence discrimination result, represents the gradient penalty term, λ represents the weight, and x represents the real data. represents the generated sequence, E represents the expected value, P x represents the distribution of real data, D(x) represents the discriminant result of the discriminator for the real data, P G represents the distribution of the generated sequence, Represents the discrimination result of the discriminator for the generated sequence.

[0014] The second aspect of the present application provides a network traffic packet header trajectory synthesis device, which is applied to a server, wherein the device includes: an acquisition module, which is used to obtain real network traffic data packets and real traffic; a training module, which is used to use the real network traffic data packets and the real traffic to train a pre-constructed initial network traffic packet header trajectory synthesis model to obtain a final network traffic packet header trajectory synthesis model, wherein the initial network traffic packet header trajectory synthesis model is composed of a pre-processor, a generator, a discriminator and a training controller; and a synthesis module, which is used to use the final network traffic packet header trajectory synthesis model to obtain a network traffic packet header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions.

[0015] Optionally, in one embodiment of the present application, the training module includes: a pre-processing unit, used to use the pre-processor to reversibly bin the sequence of the real network traffic data packets to obtain a bin sequence that meets preset conditions, and unify the attribute values ​​of the bin sequence into category features; a generation unit, used to obtain the length of the traffic from the real traffic, and use the preset category label and the length as input of the generator to obtain a generated sequence; a discriminant unit, used to perform word vector processing on the bin sequence and the generated sequence, and input them into the discriminator to obtain a discrimination result; an optimization unit, used to use the training controller to receive the discrimination result and calculate the corresponding loss value, so as to use the loss value to guide the optimization of the generator and the discriminator to obtain the final network traffic packet header trajectory synthesis model.

[0016] Optionally, in one embodiment of the present application, the optimization unit includes: a sampling subunit, used to use the training controller to sample prefixes of different lengths of the generated sequence to obtain a sampled generated sequence; an optimization subunit, used to input the sampled generated sequence into the discriminator to obtain an optimized discrimination result, and to use the optimized discrimination result to update the loss value until the loss value meets the preset iteration termination condition, thereby obtaining the final network traffic packet header trajectory synthesis model.

[0017] Optionally, in one embodiment of the present application, the pre-processing unit includes: a first acquisition sub-unit, used to obtain the attribute values ​​of the real network traffic data packets with category labels under multiple categories from the sequence of the real network traffic data packets; a calculation sub-unit, used to calculate the chi-square value of the attribute value of the real network traffic data packet; and a processing sub-unit, used to use the chi-square value to bin the value range of the attribute value of the real network traffic data packet to unify the attribute value of the real network traffic data packet into the category feature.

[0018] Optionally, in one embodiment of the present application, the generation unit includes: a second acquisition sub-unit, used to obtain the previous complete sequence value, wherein the complete sequence value is a sequence value in which all target attribute values ​​have been embedded, and the sequence value is a vector composed of target attribute values ​​extracted from any data table in the real network traffic data packet; a first embedding sub-unit, used to combine the previous complete sequence value, the preset category label and the length, and use the sequence feature probability to generate a path to embed any target attribute value into the current sequence value; a second embedding sub-unit, used to generate a bypass based on the target attribute value already in the current sequence value using conditional probability features, and embed all non-embedded target attribute values ​​into the current sequence value until the generated sequence is obtained.

[0019] Optionally, in one embodiment of the present application, the calculation expression of the loss value of the discriminator includes:

[0020]

[0021] in, represents the final loss value of the discriminator, Represents the loss value of the discriminator’s discrimination result on real data, Represents the loss value of the discriminator for the generated sequence discrimination result, represents the gradient penalty term, λ represents the weight, and x represents the real data. represents the generated sequence, E represents the expected value, P x represents the distribution of real data, D(x) represents the discriminant result of the discriminator for the real data, P G represents the distribution of the generated sequence, Represents the discrimination result of the discriminator for the generated sequence.

[0022] The third aspect of the present application provides a server, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network traffic packet header trajectory synthesis method as described in the above embodiment.

[0023] The fourth aspect of the present application provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the network traffic packet header trajectory synthesis method as described in the above embodiment.

[0024] The fifth aspect of the present application provides a computer program product, including a computer program, which, when executed, is used to implement the above-mentioned network traffic packet header trajectory synthesis method.

[0025] The embodiment of the present application can use real network traffic data packets and real traffic to train a pre-built initial network traffic header trajectory synthesis model to obtain a final network traffic header trajectory synthesis model, so as to use the final network traffic header trajectory synthesis model to obtain a network traffic header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions. Through the network traffic header trajectory synthesis method driven by machine learning, features are automatically learned from existing real network traffic, while retaining real features. Changes are introduced to synthesize new traffic, which can save the cost of manual feature extraction. At the same time, it can also better learn complex feature distributions and improve the consistency of the synthesized network traffic header trajectory with category labels with the real trajectory feature distribution. Therefore, it solves the technical problems in the related art that in the network traffic header trajectory synthesis driven by rules and expert knowledge, the labor cost is high and it relies on professional knowledge, thereby restricting the simulation ability in complex network environments, and in the network model driven network traffic header trajectory synthesis, it relies on the adaptability of the model to the network traffic and has poor flexibility.

[0026] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0028] Figure 1 A schematic diagram of the problem of destruction of flow granularity time series or statistical value features caused by synthesizing a single attribute as a numerical feature or a categorical feature in related technologies;

[0029] Figure 2 This is a flow chart of a method for synthesizing network traffic packet header trajectories according to an embodiment of the present application;

[0030] Figure 3 A schematic diagram of the principle of a method for synthesizing network traffic packet header traces according to one embodiment of the present application;

[0031] Figure 4 A schematic diagram of the chi-square merging and binning effect provided according to one embodiment of the present application;

[0032] Figure 5 A schematic diagram of a generator architecture and attribute value generation principle provided according to an embodiment of the present application;

[0033] Figure 6 A schematic diagram of a discriminator architecture and loss value calculation principle provided according to one embodiment of the present application;

[0034] Figure 7A schematic diagram of the structure of a network traffic packet header trajectory synthesis device provided according to an embodiment of the present application;

[0035] Figure 8 A schematic diagram of the structure of a server provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following describes in detail embodiments of the present application, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0037] The following describes a network traffic packet header trajectory synthesis method, apparatus, server, and storage medium according to an embodiment of the present application with reference to the accompanying drawings. In response to the related technologies mentioned in the background art, rule- and expert knowledge-driven network traffic packet header trajectory synthesis has high labor costs and relies on professional knowledge, thereby restricting the simulation capabilities in complex network environments. In network model-driven network traffic packet header trajectory synthesis, it relies on the adaptability of the model to network traffic and has poor flexibility. The present application provides a network traffic packet header trajectory synthesis method, in which a pre-built initial network traffic packet header trajectory synthesis model can be trained using real network traffic data packets and real traffic to obtain a final network traffic packet header trajectory synthesis model. The final network traffic packet header trajectory synthesis model is used to obtain a network traffic packet header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions. Through machine learning-driven network traffic packet header trajectory synthesis, features are automatically learned from existing real network traffic, changes are introduced while retaining the real features, and new traffic is synthesized. This can save the cost of manual feature extraction and can also better learn complex feature distributions, thereby improving the consistency of the synthesized network traffic packet header trajectory with category labels with the real trajectory feature distribution. This solves the technical problems in related technologies: in the synthesis of network traffic header trajectories driven by rules and expert knowledge, the labor cost is high and it relies on professional knowledge, which restricts the simulation capabilities in complex network environments; in the synthesis of network traffic header trajectories driven by network models, it relies on the adaptability of the model to the network traffic and has poor flexibility.

[0038] A network traffic header trace is a sequence of packet header fields extracted from network communications and recorded in a specific format. It records information about routing and transport layer fields at the packet level, along with timestamps and packet length information. This information can reveal protocol behavior and traffic characteristics during communication.

[0039] Class-labeled network traffic header traces can be used to develop network security and network service quality management tools based on supervised machine learning models. To ensure the usability of these supervised machine learning-based network security and network service quality management tools in real-world network environments, the characteristics of the class-labeled network traffic header traces used to assist in development must be consistent with real-world traffic. Supervised machine learning models must learn the joint values, statistics, and time-varying characteristics of the corresponding traffic header fields from traces similar to real-world traffic to accurately classify network traffic.

[0040] However, developers of network security and network service quality management tools may lack access to datasets of network traffic header traces with category labels that reflect real-world network traffic. Some internet organizations, such as the Center for Applied Internet Data Analysis (CAIDA) and the Information Security Center of Excellence (ISCX), have provided public datasets of network traffic header traces to developers worldwide. However, these datasets are static and only cover a subset of network attack types, application categories, and encryption protocols. This makes it difficult for them to accurately reflect current changes in internet traffic.

[0041] Conversely, network operators and organizations with proprietary networks can capture large amounts of up-to-date, real-world network traffic packet headers through network traffic capture. These data can then be provided as traffic labels using existing classification models combined with manual annotation. However, due to potential policy, privacy, and commercial restrictions, network operators and other internet entities with large amounts of labeled network traffic traces cannot directly share this data, which may contain sensitive user information (such as IP addresses).

[0042] Among them, network traffic trajectory synthesis technology can, to a certain extent, solve the problem of sharing network traffic trajectory datasets with category labels. This method aims to synthesize packet header trajectories that do not contain sensitive information but conform to the characteristics of real traffic based on communication events or real network traffic trajectories in real network traffic scenarios. Existing network traffic packet header trajectory synthesis technologies mainly include the following categories:

[0043] (1) Synthesis of network traffic header traces driven by rules and expert knowledge. Existing network simulation tools (such as NS-3 and OPNET) can simulate network environments by configuring a series of parameters and generate network traffic header traces in an event-driven manner. However, the selection of parameters requires a lot of manpower and expert knowledge, which restricts its ability to simulate complex network environments.

[0044] (2) Network model-driven network traffic packet header trajectory synthesis. This type of tool builds a statistical model for network traffic and extracts parameters from real traffic to simulate the network traffic distribution in a specific environment. Harpoon generates traffic similar to the real traffic distribution by extracting parameters from real traffic. Swing chooses to extract traffic feature distributions at different levels to generate network traffic. LitGen statistically models wireless traffic based on users and applications to simulate unlimited traffic of P2P and email. Tmix generates corresponding TCP connections by simulating the socket-level behavior of the source application. These works have data-driven traffic generation capabilities to a certain extent, avoiding excessive manpower investment. However, since its generation effect depends on the degree of adaptation of the model to the network traffic, it is difficult to flexibly respond to different network scenarios and complex traffic distributions.

[0045] (3) Machine learning-driven network traffic header trace synthesis. This type of tool uses machine learning models to automatically learn features from existing real network traffic, introduces changes while retaining the real features, and synthesizes new traffic. This type of work can save the cost of manual feature extraction and can also better learn complex feature distributions.

[0046] However, there are still problems with the machine learning-driven network traffic header trace synthesis model in related technologies.

[0047] The machine learning-driven network traffic header trajectory synthesis model uses PCAP-formatted packet header traces collected and annotated in real-world network environments as input. Packets with the same or opposite IP addresses and port numbers and the same transport layer protocol over a period of time are considered a bidirectional network flow. Based on the requirements of downstream network security and quality of service management tasks based on network traffic header traces and existing network traffic header trajectory generation work, the synthesized network traffic header traces for each category must be consistent with the real-world data for the following packet and flow granularity distributions:

[0048] (1) Packet-granular header attributes. Header attributes are defined as the header fields (port, TCP flags, etc.) and measurement values ​​(packet length, timestamp) required for downstream classification tasks. For machine learning-driven network traffic header trajectory synthesis models, the header attributes of the synthesized trajectory need to maintain the same marginal distribution and joint distribution as the real trajectory.

[0049] (2) Flow granularity time series and statistics. The time series composed of the same flow header trajectory can be used as a direct reflection of its protocol status and application interaction process, including frequency domain characteristics and sequence segment characteristics. The statistical values ​​obtained after aggregation at the flow granularity, such as the number of bytes in the flow, average packet length, minimum packet interval, and other distribution characteristics, can also serve as an important basis for classifying the application and protocol to which the traffic belongs. Therefore, synthetic data needs to restore the distribution characteristics of the real network traffic header trajectory in the flow granularity time series and statistics.

[0050] Early machine learning-driven network traffic header trajectory synthesis models were mostly based on packet-granularity synthesis. This involves treating each packet in the network traffic header trajectory as a row of table data, with different header attributes as different columns, and synthesizing new network traffic header trajectories while only considering the attribute distribution at the packet level. While these techniques (such as PAC-GAN and PacketCGAN) can effectively maintain the consistency of the header attributes in the synthesized network traffic header trajectory with the real traffic distribution, they completely ignore the time series and statistical characteristics of the flow granularity.

[0051] Flow-granular network traffic header trajectory synthesis models can achieve the generation of both packet-granular header attributes and flow-granular time series and statistics. However, unlike unlabeled traffic generation, which only focuses on the overall feature distribution of the dataset, category-labeled traffic generation must maintain the feature distribution of each category. This requires network traffic generation models to more sophisticatedly model and process the different types of feature values ​​contained in network traffic. Existing flow-granular network traffic header trajectory synthesis models generally classify attribute values ​​into either numerical or categorical features based on whether the values ​​have metric significance. Numerical features have clear metric significance, and similar feature values ​​have similar properties. Categorical features, on the other hand, do not have clear metric significance, and the properties corresponding to similar feature values ​​may differ significantly. However, for category-labeled network traffic header trajectories, simply classifying them into numerical or categorical features can disrupt the feature distribution of the synthesized header trajectories, particularly with respect to flow-granular time series and statistical features.

[0052] In a network traffic generation scenario with category annotations, even the same feature value may have the characteristics of both numerical and category characteristics. First, the same dimension feature value may have different characteristics in different categories. For example, for port numbers that are often treated as category features, they may be distributed within a continuous range in some P2P applications (such as Bittorrent, etc.), showing certain numerical characteristics. Second, the same dimension feature value may also have different characteristics under different value ranges in the same category. For example, for SMTP protocol applications (e-mail, etc.), smaller packet lengths correspond to signaling data packets, and there are only a few specific packet length values, showing the characteristics of category characteristics. Larger packet lengths correspond to payload data packets, and the values ​​are more continuous and random, showing the characteristics of numerical characteristics.

[0053] Figure 1 Taking the packet length attribute as an example, this paper demonstrates the problem of corrupting flow granularity time series or statistical value features caused by synthesizing a single attribute as a numerical or categorical feature. In this example, smaller packet lengths exhibit the characteristics of categorical features, resulting in some flows having packet length sequence segments with specific patterns. Larger packet lengths exhibit the characteristics of numerical features, resulting in their maximum packet lengths being continuously distributed within a certain range. The generative model is trained on datasets sampled from the network and generates datasets as either categorical or numerical features. (i) Generating attribute values ​​as numerical features causes the model to tend to generate data with a value of 61 between packet lengths of 60 and 62, even though such attribute values ​​do not exist in the real data. (ii) Generating attribute values ​​as numerical features, on the other hand, only generates values ​​that exist in the sampled data, resulting in a previously continuous range of values ​​becoming discrete. This problem is particularly prominent for sparsely distributed feature values ​​such as maximum packet length. Because the characteristics of these feature values ​​are often directly related to the implementation of the protocols, scripts, or applications corresponding to different types of network traffic, corrupting their characteristics can affect the accuracy of downstream classification tasks.

[0054] As a commonly used model for data generation, Generative Adversarial Network (GAN) has been introduced into the problem of network traffic generation by multiple existing works. However, the GAN architecture used by existing network traffic models is mostly designed for continuous numerical features, which makes it difficult to generate attribute values ​​with categorical characteristics. In the GAN model of existing work, the generator directly generates a feature sequence through a deterministic transformation controlled by parameters. This output is handed over to the discriminator to generate a loss value, which guides the model parameters for subtle optimization. However, for discrete categorical features, subtle optimization of parameters may not cause changes in the generated data, which in turn makes model optimization impossible.

[0055] The Sequence Generative Adversarial Network (SeqGAN) model based on reinforcement learning is a model proposed for the problem of generating categorical feature sequences. Compared to conventional GAN ​​models, its core changes are: (i) it generates the probability distribution of the feature value at each step in the sequence under the existing prefix, rather than the feature sequence itself; (ii) it incorporates reinforcement learning, using Markov Chain Monte Carlo sampling on the existing prefix of the sequence to obtain the categorical feature sequence, and using the discriminator's judgment result as a reward to calculate the quality of the generated probability distribution. This transforms the discrete categorical feature generation problem into the continuous probability value generation problem, avoiding the model optimization problem associated with discrete value generation. Furthermore, this generation method generates new packets based on the state of the existing flow-granular packet header trajectory sequence prefix, simulating the changes in sequence features caused by changes in the state of the network traffic packet header trajectory at the flow granularity. Therefore, this model is an effective solution for the problem of generating sequences with categorical attribute values ​​in network traffic. Finally, the reinforcement learning-based loss calculation method can prioritize the quality of the generated network traffic sequence prefix, which is particularly important for downstream applications requiring real-time classification.

[0056] In response to the above challenges, the embodiment of the present application introduces the idea of ​​reinforcement learning into the field of network traffic header trajectory synthesis, and combines data binning technology to unify the mixed numerical features and category features in the attribute values ​​of the network traffic header trajectory. In addition, based on the original sequence generation adversarial model, the embodiment of the present application adds a conditional probability feature generation bypass in the generator to solve the problem of too many output layer parameters of the sequence generation adversarial model when generating multi-attribute network traffic header trajectories. Finally, the embodiment of the present application combines the pre-trained word vector model to implement a discriminator based on the Wasserstein loss value, which greatly enhances the stability of the model training. Compared with the most advanced network traffic header trajectory synthesis model, the embodiment of the present application improves the consistency of the synthesized network traffic header trajectory with category labels with the real trajectory feature distribution.

[0057] In summary, the embodiments of the present application utilize a network traffic header trajectory synthesis model with category labels that can be deployed, trained, and synthesized on a general-purpose server. This model can learn the feature distribution corresponding to categories from provided real network traffic header trajectories, synthesizing network traffic header trajectories that conform to the feature distribution of real trajectory packet granularity and flow granularity. Furthermore, users can adjust the proportion of network traffic header trajectories corresponding to different category labels as needed.

[0058] Specifically, Figure 2 A flowchart of a method for synthesizing network traffic packet header traces provided in an embodiment of the present application.

[0059] like Figure 2As shown, the network traffic packet header trajectory synthesis method is applied to a server, wherein the method includes the following steps:

[0060] In step S201, real network traffic data packets and real traffic are obtained.

[0061] Real network traffic packets are the smallest unit of data transmission in network communications, carrying specific information from the source device to the destination device. Transmitted as binary signals over physical media (such as optical fibers and cables), they are the cornerstone of internet communications. Traffic data is a macro-quantitative indicator of network activity, reflecting the total amount, rate, and distribution of data transmitted per unit time. It is used to assess network performance, security status, and user behavior.

[0062] The embodiments of the present application can obtain real network traffic data packets and real traffic to automatically learn features from existing real network traffic in subsequent model training, introduce changes while retaining real features, and synthesize new traffic.

[0063] In step S202, a pre-built initial network traffic packet header trajectory synthesis model is trained using real network traffic data packets and real traffic to obtain a final network traffic packet header trajectory synthesis model, wherein the initial network traffic packet header trajectory synthesis model consists of a pre-processor, a generator, a discriminator and a training controller.

[0064] Furthermore, the embodiments of the present application can train the pre-built initial network traffic packet header trajectory synthesis model by obtaining real network traffic data packets and real traffic, so that the final network traffic packet header trajectory synthesis model can automatically learn features from the existing real network traffic.

[0065] Optionally, in one embodiment of the present application, a pre-constructed initial network traffic header trajectory synthesis model is trained using real network traffic data packets and real traffic to obtain a final network traffic header trajectory synthesis model, including: using a pre-processor to reversibly bin the sequence of real network traffic data packets to obtain a bin sequence that meets preset conditions, and unifying the attribute values ​​of the bin sequence into category features; obtaining the length of the traffic from the real traffic, and using the preset category label and length as input to the generator to obtain a generated sequence; performing word vector processing on the bin sequence and the generated sequence, and inputting them into the discriminator to obtain a discrimination result; using a training controller to receive the discrimination result and calculate the corresponding loss value, so as to use the loss value to guide the generator and discriminator to optimize, so as to obtain the final network traffic header trajectory synthesis model.

[0066] In the actual implementation process, the embodiment of the present application can model the network traffic packet header trajectory with category annotation as a multi-attribute time series + category form, as follows:

[0067] (1) Network traffic packet header trajectory dataset D = {(x, y)}, (x, y) is a sample, x is real data (feature values ​​of downstream applications such as protocol fields and measurement values ​​extracted from real network traffic), its data type is the aggregated bidirectional flow, and y is the corresponding category;

[0068] (2)x={(f1,f2,...,f l ), l}, l is the length of the bidirectional flow (number of packets in the flow), f i is the multidimensional feature value of the i-th data packet in the flow, which together constitute a multidimensional feature value sequence;

[0069] (3)f i =(a1,...,a m ),a j These are the feature values ​​that may be used for classification in downstream applications, including packet length, direction, time information, field values, etc.

[0070] Figure 3 The framework and training process of the network traffic packet header trajectory synthesis model in the embodiment of this application are presented. The core components include four parts: pre-processor, generator, discriminator, and training controller. The training process is divided into the following steps:

[0071] In step S1, the pre-processor reversibly bins the real network traffic data packet sequence into bin sequences that can maintain numerical features while significantly reducing the value space, and unify the attribute values ​​into category features.

[0072] In step S2, the generator takes the category label and length of the generated traffic as input, generates paths using sequence probability features, and generates bypasses using conditional probabilities. This generates the conditional distribution of each attribute in the multi-attribute sequence value under the sequence prefix and existing attribute values, and then obtains the generated sequence through sampling. The category label ratio can be controlled by the user, and the length distribution can be sampled from real traffic.

[0073] In step S3, the discriminator takes the binned real data and the sampled generated sequence as input after word vector processing, and the discriminator determines whether the real data matches the corresponding label.

[0074] In step S4, the discrimination result is finally received by the training controller, and its Wasserstein loss value is used as the reward value of reinforcement learning and the loss value of the discriminator to guide the optimization of the generator and discriminator.

[0075] When optimizing the generator and discriminator, the training controller can obtain multiple sampled generated sequences, that is, the generated sequences of real network traffic data packets, by performing Markov Chain-Monte Carlo (MCMC) sampling of prefixes of different lengths of the generated sequence.

[0076] Optionally, in one embodiment of the present application, a pre-processor is used to reversibly bin a sequence of real network traffic data packets to obtain a bin sequence that meets preset conditions, and the attribute values ​​of the bin sequence are unified into category features, including: obtaining attribute values ​​of real network traffic data packets with category labels under multiple categories from the sequence of real network traffic data packets; calculating the chi-square value of the attribute value of the real network traffic data packet; and using the chi-square value to bin the value range of the attribute value of the real network traffic data packet to unify the attribute value of the real network traffic data packet into category features.

[0077] In order to unify the attribute values ​​of the mixed numerical features and category features of the network traffic packet header trajectory, an embodiment of the present application proposes an improved chi-square merge (ChiMerge) feature value reversible binning method for sparse distribution intervals. By binning the value range of the attribute value (the attribute value of the real network traffic data packet), the attribute value is converted into a category feature, which can be uniformly processed by the sequence generation adversarial network based on reinforcement learning. In addition, the chi-square merging method ensures that the attribute value is approximately uniformly distributed in the interval after binning, so that the attribute value with the same distribution as before binning can be reversibly restored by random sampling, which ensures that the binned sequence synthesized by the model can be restored to the packet header trajectory attribute value sequence, that is, the sequence of attribute values ​​of the real network traffic data packet, where the packet header trajectory is the captured data packet.

[0078] Chi-square merging is to merge a series of non-intersecting intervals based on the chi-square test. The chi-square test uses a statistical method to test whether the actual distribution is the same as the expected distribution. For k non-intersecting intervals, assume that the merged intervals conform to the distribution P. E , let O i is the actual observation frequency of the ith interval, E i is the expected distribution P of the i-th interval E The frequency on the distribution. Then we can calculate the chi-square value χ that represents the similarity between the actual distribution and the expected distribution 2 as follows:

[0079]

[0080] When the chi-square value is small enough, the actual distribution can be approximately considered to be the same as the expected distribution. Then the data in the k non-overlapping intervals can be replaced with data that conforms to the expected distribution after the merger.

[0081] In order to facilitate the calculation of the chi-square value during merging and the recovery of reversible data, the embodiment of the present application sets the expected distribution P after merging E The chi-square value of the network traffic trajectory attribute values ​​(real network traffic data packet attribute values) with category labels under n categories is calculated as follows:

[0082] For two adjacent intervals I1 and I2 that may have a blank area in the middle, let the blank area in the middle be I e . Assume that the lengths of the above intervals are L(I1), L(I2), L(I e ), the frequency of the corresponding attribute value under category label i is C(I1,i), C(I2,i), 0 (the empty interval does not contain any data). Then the expected distribution frequency E of the data under category label i in the merged interval is i for:

[0083]

[0084] The chi-square value χ of the distribution before and after the interval merger 2 It can be expressed as:

[0085]

[0086] However, ChiMerge performs poorly on intervals where the distribution of values ​​is too sparse. When the distribution of attribute values ​​in a specific interval is too sparse (for example, there is only one data point in two adjacent intervals, and there is an extremely long blank interval in between), the calculated chi-square value will be too large. For this reason, the embodiment of the present application adds a frequency threshold-based merge before the chi-square merge, directly merging intervals with a frequency below a specific threshold (the default is 1).

[0087] Figure 4 This figure shows the improved chi-square merging and binning effect for sparse data under a single category and a single attribute. Initially, all numerical points with attribute values ​​are divided into independent intervals. For areas with sparse data distribution, threshold merging is first performed to avoid overly detailed binning and excessive blank intervals. After that, all intervals are merged using the chi-square merging algorithm, merging intervals with chi-square values ​​below a certain threshold (determined by the chi-square test confidence interval) until the chi-square values ​​calculated for all adjacent intervals are above the threshold.

[0088] Using a reversible binning method based on chi-squared merging of eigenvalues ​​for sparsely distributed intervals, the attribute values ​​of network traffic packet header traces containing mixed categorical and numerical features are binned by attribute and used as categorical feature input for model training and generation. This method also ensures that the generated binned sequence can be restored to the attribute value sequence through random sampling of the binned intervals, completing the synthesis of network traffic packet header traces.

[0089] In summary, the embodiments of the present application can uniformly convert network traffic packet header trajectories that have both numerical and categorical features of a single attribute into categorical feature generation through a sequence conditional generative adversarial network based on reinforcement learning and a data binning algorithm designed for network traffic packet header trajectories, thereby avoiding the problem of flow granularity feature destruction caused by existing methods that synthesize a single attribute as a numerical feature or a categorical feature.

[0090] Optionally, in one embodiment of the present application, the length of the traffic is obtained from the actual traffic, and the preset category label and length are used as input to the generator to obtain a generated sequence, including: obtaining the previous complete sequence value, wherein the complete sequence value is a sequence value in which all target attribute values ​​have been embedded, and the sequence value is a vector composed of target attribute values ​​extracted from any data table in the actual network traffic data packet; combining the previous complete sequence value, the preset category label and length, using the sequence feature probability to generate a path, and embedding any target attribute value into the current sequence value; based on the target attribute value already in the current sequence value, using the conditional probability feature to generate a bypass, and embedding all unembedded target attribute values ​​into the current sequence value until the generated sequence is obtained.

[0091] In view of the characteristics of the multi-attribute value sequence of the network traffic packet header trajectory, the embodiment of the present application proposes a reinforcement learning generator that adds a conditional probability feature generation bypass. Unlike the text sequence of a single attribute, the sequence value of network traffic contains multiple attributes at the same time. For m attributes (a1,...,a m ), let the number of possible values ​​corresponding to a single attribute be (v1,...,v m ). Then the number of possible values ​​of the joint distribution of all attributes is

[0092] Therefore, even if the attribute value ranges are previously binned and merged, the possible value combinations of all attributes may reach more than one billion. The number of parameters in the model output layer is proportional to the length of the probability distribution vector. If the model directly outputs the probability distribution of these value combinations, it will be difficult to train due to the excessive number of parameters in the output layer. A vector of target attribute values ​​extracted from a data packet

[0093] The embodiment of the present application can choose to convert the joint distribution p(a1,...,a1) of different attributes of the sequence value (a vector composed of target attribute values ​​extracted from a data packet) into m ) is decomposed into conditional distributions p(a1), p(a2|a1), p(a m |a1,...,a m-1 ). During a round of sampling, the generator generates the probability distribution of the remaining attributes of the current sequence value based on the existing sequence prefix and the existing attributes of the current sequence value.

[0094] The architecture of the generator and the process of generating an attribute value are as follows Figure 5 The generator can be divided into two main data processing and generation paths: a sequence probability feature generation path starting with the previous complete sequence value (the sequence value after attribute generation) and a conditional probability feature generation bypass path starting with the existing sequence attribute value. In addition, the sequence length and category label are input into the generator as generation conditions.

[0095] (1) Sequence probability feature generation path. The complete sequence value is first split into different attribute values ​​and processed by the word embedding layer corresponding to the attribute. The sequence value after word embedding is spliced ​​with the processed sequence length value, and the corresponding linear layer selected by the category label is processed as a hidden feature. The processed data is input into the LSTM (Long Short-Term Memory) as a hidden feature. The LSTM also accepts the hidden state of the previous step. After completing the state transfer, the current sequence feature is generated by the input hidden feature. In this step, the current hidden state of the LSTM will be retained for state transfer when generating the next sequence value feature. The sequence feature is merged with the conditional probability generation bypass output, and after probability processing, the output is the conditional probability distribution vector of the next attribute value. Finally, the conditional probability distribution vector is sampled to obtain the next attribute value.

[0096] (2) Conditional probability feature generation bypass. The generator uses the existing attribute value of the current sequence value as a condition. The existing attribute value is also first processed by the word embedding layer corresponding to the attribute. The attribute value after word embedding is processed by a linear layer different from the sequence probability generation path. The processing result is spliced ​​with the sequence feature and fed into the sequence probability generation path.

[0097] The above process describes how the generator generates a single attribute value. The generated attribute value is concatenated with the existing attribute value to serve as the condition for generating the next sequence value or attribute value. This process is repeated until all attribute values ​​for all sequence values ​​of the expected sequence length are generated.

[0098] In summary, the embodiments of the present application can introduce a conditional probability feature generation bypass to transform the joint probability generation problem of multiple attribute sequence values ​​of the network traffic packet header trajectory into the conditional probability generation problem of the current attribute under the existing attribute value, thereby greatly reducing the length of the probability distribution vector output by the generator, and thus avoiding the problem of too many parameters in the generator output layer under multiple attribute sequence values.

[0099] Optionally, in one embodiment of the present application, the loss value is used to guide the generator and the discriminator for optimization to obtain the final network traffic packet header trajectory synthesis model, including: using a training controller to sample prefixes of different lengths of the generated sequence to obtain a sampled generated sequence; inputting the sampled generated sequence into the discriminator to obtain an optimized discrimination result, and using the optimized discrimination result to update the loss value until the loss value meets the preset iteration termination condition to obtain the final network traffic packet header trajectory synthesis model.

[0100] The generator training process is based on reinforcement learning, and the reward value of reinforcement learning is the classification result of the classifier. To ensure the stability of training, the embodiment of this application uses the classification result Wasserstein loss as the reward value. The generator optimization process of a round of training process is as follows:

[0101] Step S1, sequence generation: obtain the generated complete sequence (generated sequence)

[0102] Step S2, sequence prefix sampling: generate sequence Prefix The generator fills it to l, repeats N times, and obtains a sequence of N(l+1) samples.

[0103] Step S3, classification: input the N(l+1) sampled sequences into the classifier D for classification

[0104] Step S4, probability sequence generation: without sampling, directly obtain the probability value sequence s = (p1, p2, ..., p l ).

[0105] Step S5, loss value calculation: generator loss value The calculation formula is as follows:

[0106]

[0107] Step S6: Gradient calculation and model parameter update to complete one round of training.

[0108] Through this process, the trained generator can learn the conditional distribution of current attribute values ​​for network traffic header traces under specific category labels, given existing sequence value prefixes and attribute values. This not only ensures that the synthesized network traffic header traces conform to the joint distribution of attribute values ​​at different packet granularities within the same data packet, but also allows the generator to use the existing sequence value prefix as state, simulating the attribute value changes that occur when the state of the same network traffic header trace changes within the flow.

[0109] Optionally, in one embodiment of the present application, the calculation expression of the loss value of the discriminator includes:

[0110]

[0111] in, Represents the final loss value of the discriminator, Represents the loss value of the discriminator's discrimination result on the real data, Represents the loss value of the discriminator for the generated sequence discrimination result, represents the gradient penalty term, λ represents the weight, and x represents the real data. represents the generated sequence, E represents the expected value, P x represents the distribution of real data, D(x) represents the discriminant result of the real data, P G represents the distribution of generated sequences, Represents the discriminator's judgment result on the generated sequence.

[0112] The embodiment of the present application realizes a post-binning network traffic packet header trajectory discriminator based on Wasserstein loss by combining a pre-trained word vector model. The generative adversarial network (WGAN) based on Wasserstein loss value is designed to solve the problem of gradient disappearance or mode collapse that may occur in the training process of the GAN (Generative Adversarial Networks) model. For network traffic data sets with uneven category samples, gradient disappearance or mode collapse will cause the network traffic data synthesized by the model on categories with fewer samples to be inconsistent with the real data, or tend to generate repeated data patterns. Using Wasserstein loss value for training can greatly improve the stability of model training.

[0113] The use of Wasserstein loss requires that the discriminator satisfies the K-Lipschitz condition. This is generally achieved by using gradient penalty, that is, adding a gradient penalty term to the discriminator loss value as follows:

[0114]

[0115] in, is the real data x and the synthetic data The interpolation of However, the interpolation operation can only take effect on numerical features with metric meaning, and has no meaning for the generated categorical features after binning. The embodiment of the present application uses a pre-trained word vector model to achieve this. The word vector model processes the categorical feature sequence into a measurable numerical vector one by one. The closer the properties of the two sequence values ​​are, the closer their corresponding word vectors are in space. This makes the generated word vector sequence have metric meaning and can be directly used for interpolation.

[0116] Figure 6 The architecture of the discriminator of the embodiment of the present application and the calculation process of the Wasserstern loss value during training are described. Before formal training, the embodiment of the present application uses the binned network traffic sequence to train the word vector model. During training, the binned real data and the generated sequence synthesized by the generator are input into the word vector model, and the model maps the feature value sequence to the word vector sequence. Subsequently, three types of word vector sequences are input into the discriminator, namely the real vector sequence, the generated vector sequence, and the interpolation sequence generated by random interpolation of the two (used to calculate the gradient penalty term). The word vector sequence is subjected to feature extraction by the sequence feature extractor, and is discriminated together with the processed sequence length by the input layer corresponding to the sequence category. After the training controller receives the discrimination result, it calculates the Wasserstern loss value of the discriminator for the real data and the generated sequence discrimination result. And the corresponding gradient penalty and its weight λ. The final loss value of the discriminator The calculation is as follows:

[0117]

[0118] in, It means that the function with random variable x as independent variable is distributed in P x The expected value under Represented by random variables The function of the independent variable is distributed in The expected value under , where x is the real data, To generate sequences, that is, synthetic data.

[0119] In summary, the embodiments of the present application achieve flexible conversion between categorical features and numerical features through a pre-trained word vector model, avoiding the interpolation problem when calculating the Wasserstein loss value for categorical features. By introducing the Wasserstein loss value, the discriminator can significantly improve the training stability of the embodiments of the present application on network traffic packet header trajectories with multiple category labels and uneven distribution, ensuring the authenticity and diversity of the synthetic network traffic packet header trajectories. By combining the pre-trained word vector model, the embodiments of the present application can implement a discriminator and training control based on the Wasserstein loss value, significantly improving the stability of the model during training.

[0120] In step S203, the final network traffic packet header trajectory synthesis model is used to obtain a network traffic packet header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions.

[0121] By using the trained final network traffic packet header trajectory synthesis model, the embodiment of the present application can synthesize a network traffic packet header trajectory that conforms to the distribution of the actual trajectory characteristic packet granularity and flow granularity characteristics.

[0122] According to the network traffic packet header trajectory synthesis method proposed in the embodiment of the present application, the initial network traffic packet header trajectory synthesis model constructed in advance can be trained using real network traffic data packets and real traffic to obtain the final network traffic packet header trajectory synthesis model, so as to use the final network traffic packet header trajectory synthesis model to obtain a network traffic packet header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions. Through the network traffic packet header trajectory synthesis method driven by machine learning, features are automatically learned from existing real network traffic, while retaining real features, changes are introduced to synthesize new traffic, which can save the cost of manual feature extraction. At the same time, it can also better learn complex feature distributions and improve the consistency of the synthesized network traffic packet header trajectory with category labels with the real trajectory feature distribution. Thus, the technical problems in the related art that in the network traffic packet header trajectory synthesis driven by rules and expert knowledge, the labor cost is high and it relies on professional knowledge, thereby restricting the simulation capability in complex network environments, and in the network model driven network traffic packet header trajectory synthesis, it relies on the adaptability of the model to the network traffic and has poor flexibility.

[0123] Next, a network traffic packet header trajectory synthesis device proposed according to an embodiment of the present application will be described with reference to the accompanying drawings.

[0124] Figure 7 It is a block diagram of a network traffic packet header trajectory synthesis device according to an embodiment of the present application.

[0125] like Figure 7 As shown, the network traffic packet header trajectory synthesis device 10 includes: an acquisition module 100, a training module 200 and a synthesis module 300.

[0126] Specifically, the acquisition module 100 is used to obtain real network traffic data packets and real traffic.

[0127] The training module 200 is used to train a pre-built initial network traffic packet header trajectory synthesis model using real network traffic data packets and real traffic to obtain a final network traffic packet header trajectory synthesis model, wherein the initial network traffic packet header trajectory synthesis model consists of a pre-processor, a generator, a discriminator and a training controller.

[0128] The synthesis module 300 is used to use the final network traffic packet header trajectory synthesis model to obtain a network traffic packet header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions.

[0129] Optionally, in one embodiment of the present application, the training module 200 includes: a pre-processing unit, a generation unit, a discrimination unit and an optimization unit.

[0130] Among them, the pre-processing unit is used to use the pre-processor to reversibly bin the sequence of real network traffic data packets to obtain a bin sequence that meets preset conditions, and unify the attribute values ​​of the bin sequence into category features.

[0131] The generation unit is used to obtain the length of the traffic from the real traffic, and the preset category label and length are used as the input of the generator to obtain the generated sequence.

[0132] The discriminant unit is used to process the binned sequence and the generated sequence into word vectors and input them into the discriminator to obtain the discrimination result.

[0133] The optimization unit is used to receive the discrimination results using the training controller and calculate the corresponding loss value, so as to use the loss value to guide the generator and the discriminator to optimize, so as to obtain the final network traffic packet header trajectory synthesis model.

[0134] Optionally, in one embodiment of the present application, the optimization unit includes: a sampling subunit and an optimization subunit.

[0135] The sampling subunit is used to sample prefixes of different lengths of the generated sequence using the training controller to obtain the sampled generated sequence.

[0136] The optimization subunit is used to input the sampled generation sequence into the discriminator to obtain the optimized discrimination result, and use the optimized discrimination result to update the loss value until the loss value meets the preset iteration termination condition, thereby obtaining the final network traffic packet header trajectory synthesis model.

[0137] Optionally, in one embodiment of the present application, the pre-processing unit includes: a first acquisition subunit, a calculation subunit and a processing subunit.

[0138] The first acquisition subunit is configured to acquire attribute values ​​of real network traffic data packets with category labels under multiple categories from a sequence of real network traffic data packets.

[0139] The calculation subunit is used to calculate the chi-square value of the attribute value of the real network traffic data packet.

[0140] The processing subunit is used to bin the value ranges of the attribute values ​​of the real network traffic data packets using the chi-square value, so as to unify the attribute values ​​of the real network traffic data packets into category features.

[0141] Optionally, in one embodiment of the present application, the generating unit includes: a second acquiring subunit, a first embedding subunit and a second embedding subunit.

[0142] Among them, the second acquisition subunit is used to obtain the previous complete sequence value, wherein the complete sequence value is a sequence value in which all target attribute values ​​have been embedded, and the sequence value is a vector composed of target attribute values ​​extracted from any data table in the real network traffic data packet.

[0143] The first embedding subunit is used to combine the previous complete sequence value, the preset category label and length, generate a path using the sequence feature probability, and embed any target attribute value into the current sequence value.

[0144] The second embedding subunit is used to generate a bypass based on the target attribute value already in the current sequence value using the conditional probability feature, and embed all unembedded target attribute values ​​into the current sequence value until a generated sequence is obtained.

[0145] Optionally, in one embodiment of the present application, the calculation expression of the loss value of the discriminator includes:

[0146]

[0147] in, Represents the final loss value of the discriminator, Represents the loss value of the discriminator's discrimination result on the real data, Represents the loss value of the discriminator for the generated sequence discrimination result, represents the gradient penalty term, λ represents the weight, and x represents the real data. represents the generated sequence, E represents the expected value, P x represents the distribution of real data, D(x) represents the discriminant result of the real data, P G represents the distribution of generated sequences, Represents the discriminator's judgment result on the generated sequence.

[0148] It should be noted that the above explanation of the embodiment of the network traffic packet header trace synthesis method is also applicable to the network traffic packet header trace synthesis device of this embodiment, and will not be repeated here.

[0149] According to the network traffic packet header trajectory synthesis device proposed in the embodiment of the present application, the initial network traffic packet header trajectory synthesis model pre-built can be trained using real network traffic data packets and real traffic to obtain the final network traffic packet header trajectory synthesis model, so as to use the final network traffic packet header trajectory synthesis model to obtain a network traffic packet header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions. Through the network traffic packet header trajectory synthesis method driven by machine learning, features are automatically learned from existing real network traffic, while retaining real features, changes are introduced to synthesize new traffic, which can save the cost of manual feature extraction. At the same time, it can also better learn complex feature distributions and improve the consistency of the synthesized network traffic packet header trajectory with category labels with the real trajectory feature distribution. Thus, the technical problems in the related art that in the network traffic packet header trajectory synthesis driven by rules and expert knowledge, the labor cost is high and it relies on professional knowledge, thereby restricting the simulation capability in complex network environments, and in the network model driven network traffic packet header trajectory synthesis, it relies on the adaptability of the model to the network traffic and has poor flexibility.

[0150] Figure 8 This is a schematic diagram of the structure of the server provided in the embodiment of the present application. The server may include:

[0151] A memory 801 , a processor 802 , and a computer program stored in the memory 801 and executable on the processor 802 .

[0152] When the processor 802 executes the program, the network traffic packet header trace synthesis method provided in the above embodiment is implemented.

[0153] Furthermore, the server further includes:

[0154] The communication interface 803 is used for communication between the memory 801 and the processor 802 .

[0155] The memory 801 is used to store computer programs that can be run on the processor 802.

[0156] The memory 801 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0157] If the memory 801, processor 802, and communication interface 803 are implemented independently, the communication interface 803, memory 801, and processor 802 can be connected to each other via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0158] Optionally, in a specific implementation, if the memory 801, the processor 802 and the communication interface 803 are integrated on a chip, the memory 801, the processor 802 and the communication interface 803 can communicate with each other through an internal interface.

[0159] The processor 802 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0160] This embodiment also provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the above-mentioned network traffic packet header trace synthesis method is implemented.

[0161] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the network traffic packet header trace synthesis method provided in an embodiment of the present application.

[0162] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0163] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of this application, "N" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0164] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing a custom logical function or process step, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed in a different order than shown or discussed, including performing functions in a substantially simultaneous manner or in a reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application pertain.

[0165] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program can be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing it in other suitable ways as necessary, and then storing it in a computer memory.

[0166] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0167] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0168] In addition, the functional units in the various embodiments of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into a module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0169] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present application. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. A method for synthesizing network traffic packet header trajectories, characterized in that: Applied to a server, wherein the method comprises the following steps: Get real network traffic data packets and real traffic; Using the real network traffic data packets and the real traffic to train a pre-built initial network traffic packet header trajectory synthesis model to obtain a final network traffic packet header trajectory synthesis model, wherein the initial network traffic packet header trajectory synthesis model consists of a pre-processor, a generator, a discriminator and a training controller; The final network traffic packet header trajectory synthesis model is used to obtain a network traffic packet header trajectory that meets the preset real trajectory characteristic packet granularity and flow granularity characteristic distribution conditions.

2. The method according to claim 1, characterized in that The method of training a pre-built initial network traffic packet header trajectory synthesis model using the real network traffic data packet and the real traffic to obtain a final network traffic packet header trajectory synthesis model includes: Using the pre-processor to reversibly bin the sequence of the real network traffic data packets to obtain a bin sequence that meets preset conditions, and unifying the attribute values ​​of the bin sequence into category features; Obtaining the length of the traffic from the real traffic, and using the preset category label and the length as inputs of the generator to obtain a generated sequence; After word vector processing, the binned sequence and the generated sequence are input into the discriminator to obtain a discrimination result; The training controller is used to receive the discrimination result and calculate the corresponding loss value, so as to use the loss value to guide the generator and the discriminator to optimize, so as to obtain the final network traffic packet header trajectory synthesis model.

3. The method according to claim 2, characterized in that The using the loss value to guide the generator and the discriminator to optimize to obtain the final network traffic packet header trajectory synthesis model includes: Using the training controller to sample prefixes of different lengths of the generated sequence to obtain a sampled generated sequence; The sampled generated sequence is input into the discriminator to obtain an optimized discrimination result, and the loss value is updated using the optimized discrimination result until the loss value meets the preset iteration termination condition, thereby obtaining the final network traffic packet header trajectory synthesis model.

4. The method according to claim 2, characterized in that The method of using the pre-processor to reversibly bin the real network traffic data packet sequence to obtain a bin sequence that meets preset conditions, and unifying the attribute values ​​of the bin sequence into category features, includes: Acquire attribute values ​​of the real network traffic data packets with category labels under multiple categories from the sequence of the real network traffic data packets; Calculating a chi-square value of the attribute value of the real network traffic data packet; The chi-square value is used to bin the value range of the attribute value of the real network traffic data packet, so as to unify the attribute value of the real network traffic data packet into the category feature.

5. The method according to claim 2, characterized in that The step of obtaining the length of the traffic from the real traffic and using the preset category label and the length as inputs of the generator to obtain a generated sequence includes: Obtaining a previous complete sequence value, wherein the complete sequence value is a sequence value in which all target attribute values ​​have been embedded, and the sequence value is a vector composed of target attribute values ​​extracted from any data table in the real network traffic data packet; Combining the previous complete sequence value, the preset category label, and the length, using the sequence feature probability to generate a path, and embedding any target attribute value into the current sequence value; Based on the target attribute values ​​already in the current sequence value, a bypass is generated using conditional probability features to embed all unembedded target attribute values ​​into the current sequence value until the generated sequence is obtained.

6. The method according to claim 2, characterized in that The calculation expression of the loss value of the discriminator includes: in, represents the final loss value of the discriminator, Represents the loss value of the discriminator’s discrimination result on real data, Represents the loss value of the discriminator for the generated sequence discrimination result, represents the gradient penalty term, λ represents the weight, and x represents the real data. represents the generated sequence, E represents the expected value, P x represents the distribution of real data, D(x) represents the discriminant result of the discriminator for the real data, P G represents the distribution of the generated sequence, Represents the discrimination result of the discriminator for the generated sequence.

7. A network traffic packet header trajectory synthesis device, characterized in that: Applied to a server, wherein the device comprises: Acquisition module, used to obtain real network traffic data packets and real traffic; A training module, configured to train a pre-built initial network traffic packet header trajectory synthesis model using the real network traffic data packet and the real traffic to obtain a final network traffic packet header trajectory synthesis model, wherein the initial network traffic packet header trajectory synthesis model is composed of a pre-processor, a generator, a discriminator, and a training controller; The synthesis module is used to use the final network traffic packet header trajectory synthesis model to obtain a network traffic packet header trajectory that meets the preset real trajectory feature packet granularity and flow granularity feature distribution conditions.

8. A server, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network traffic packet header trace synthesis method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the network traffic packet header trace synthesis method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed, it is used to implement the network traffic packet header trace synthesis method according to any one of claims 1 to 6.

Images