Data security tracing method and system based on time sequence generative adversarial network

Abstract

The invention relates to the technical field of data security, provides a data security traceability method and system based on a time sequence generative adversarial network, and is used for solving the problem of poor data security traceability effect caused by lack of cross-modal association analysis, lack of dynamic coupling modeling, insufficient feature decoupling capability and the like in the prior art. The method comprises the following steps: aggregating and coding metadata to obtain flow characteristic representation, and identifying abnormal vibration signals from a vibration signal sequence; performing space-time alignment on abnormal vibration signals and flow characteristic representation; determining a normal traffic baseline through a game mechanism of a generator and a discriminator in the time sequence adversarial generative network; and identifying potential associated abnormal points in the space-time alignment data, and completing data security traceability detection. According to the technical scheme provided by the invention, the multi-modal space-time alignment analysis can be performed on the network flow metadata and the physical vibration signal, and the dynamic baseline is established through the time sequence adversarial generative network, so that the abnormal association point is accurately identified, and efficient data security traceability is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a data security tracing method and system based on a time sequence adversarial generation network. BACKGROUND

[0002] With the evolution of advanced sustainable threats and physical layer eavesdropping technology, infrastructure faces multi-dimensional attacks across networks and physical spaces. Attackers may manipulate network protocols and apply physical interference simultaneously, requiring identification of cross-domain associated anomalies, establishment of a dynamically evolving normal traffic baseline, millisecond-level spatio-temporal alignment, and multi-modal anomaly causal reasoning.

[0003] Existing solutions use a generative adversarial network to process single-modal time sequence data to learn normal patterns and detect deviations. A long short-term memory network is used as the basis for the generator and the discriminator. The generator reconstructs the input time sequence data, and the discriminator evaluates the authenticity of the data. The abnormal score is obtained by fusing the reconstruction error and the discriminator confidence. A distance optimization loss function is used to solve the problem of gradient disappearance and improve the stability of the model.

[0004] However, existing solutions only process single data sources and do not establish a multi-source coupling analysis mechanism. Secondly, the multi-source dynamic coupling relationship is not included in the baseline model, which leads to misjudgment of environmental interference as an attack, and there is also a problem of insufficient feature decoupling capability. SUMMARY

[0005] The present application provides a data security tracing method and system based on a time sequence adversarial generation network to solve the problem of poor data security tracing effect caused by the lack of cross-modal correlation analysis, the lack of dynamic coupling modeling, and insufficient feature decoupling capability in the prior art.

[0006] In a first aspect, the present application provides a data security tracing method based on a time sequence adversarial generation network, comprising: Collecting metadata of network traffic from network traffic, the metadata including protocol type, packet size, and transmission interval, and simultaneously obtaining a vibration signal sequence of a physical cable; Aggregating and encoding the metadata to obtain a traffic feature representation, and identifying an abnormal vibration signal from the vibration signal sequence; Performing spatio-temporal alignment on the abnormal vibration signal and the traffic feature representation to obtain spatio-temporal alignment data; Determining a normal traffic baseline through a game mechanism of a generator and a discriminator in a time sequence adversarial generation network according to the spatio-temporal alignment data; Based on the normal traffic baseline, identifying potential associated abnormal points in the spatio-temporal alignment data to complete data security tracing detection.

[0007] Optionally, the determining the normal traffic baseline according to the spatio-temporal alignment data through a game mechanism between a generator and a discriminator in a temporal adversarial generation network comprises: dividing the spatio-temporal alignment data according to a time window to obtain time window time series data; inputting random noise data into the generator to enable the generator to extract cross-domain correlation feature patterns and generate synthetic data streams according to the cross-domain correlation feature patterns; inputting the synthetic data streams and the time window time series data into the discriminator to compare and analyze feature distribution differences through the game mechanism between the generator and the discriminator to obtain distribution difference information; iteratively updating parameter weights of the generator and the discriminator based on the game mechanism and the distribution difference information to enable the synthetic data streams to conform to distribution characteristics of the time window time series data; when the discriminator cannot distinguish the synthetic data streams from the time window time series data, taking the parameter weights of the generator as the normal traffic baseline.

[0008] Optionally, the inputting the synthetic data streams and the time window time series data into the discriminator to compare and analyze feature distribution differences through the game mechanism between the generator and the discriminator to obtain distribution difference information comprises: inputting the synthetic data streams and the time window time series data into the discriminator to obtain discriminator input data, and constructing a joint distribution function based on the discriminator input data; calculating vibration spectrum entropy values of a physical domain and statistical quantities of traffic burst events of a network domain based on the joint distribution function; generating a joint probability density offset through the game mechanism by comparing joint probability density offsets of the vibration spectrum entropy values and the statistical quantities of the traffic burst events in a cross-domain correlation dimension; quantifying Mahalanobis distance differences of the synthetic data streams and the time window time series data in a coupling feature space based on a preset adversarial decision rule to obtain a Mahalanobis distance difference value; taking extreme point distribution information of the Mahalanobis distance difference value as the distribution difference information.

[0009] Optionally, the generating a joint probability density offset through the game mechanism by comparing joint probability density offsets of the vibration spectrum entropy values and the statistical quantities of the traffic burst events in a cross-domain correlation dimension comprises: dividing a coupling feature space of the vibration spectrum entropy values and the statistical quantities of the traffic burst events in the cross-domain correlation dimension through the game mechanism to establish a probability grid; Adjusting weight coefficients of the vibration spectrum entropy value and the statistical quantity respectively on the probability grid to obtain a weight coefficient combination; Based on the weight coefficient combination, calculating a density distribution deviation of the vibration spectrum entropy value and the statistical quantity of the traffic burst event on the probability grid; Performing cross-grid coupling integration on the density distribution deviations of all probability grids to generate a joint probability density deviation.

[0010] Optionally, based on the preset adversarial decision rule, quantifying a Mahalanobis distance difference of the synthetic data stream and the time window time series data in the coupling feature space to obtain a Mahalanobis distance difference value, including: Based on the preset adversarial decision rule, determining a distribution center of the time window time series data in the coupling feature space; Measuring a deviation distance of each data point in the synthetic data stream to the distribution center in the coupling feature space to obtain an original deviation distance set; Based on a preset sensitivity coefficient matrix, weighting and correcting the deviation distances in the original deviation distance set to generate a weighted deviation distance set; Aggregating all deviation distances in the weighted deviation distance set to generate a Mahalanobis distance difference value.

[0011] Optionally, the time-space alignment of the abnormal vibration signal and the traffic feature representation to obtain time-space alignment data, including: Based on an energy distribution peak timestamp of the abnormal vibration signal in a preset sensitive frequency band, identifying a mutation timestamp of a protocol jump event in the traffic feature representation; Establishing a matching point pair of the peak timestamp and the mutation timestamp; Based on a time offset of the matching point pair, performing window sliding compensation on the energy distribution of the abnormal vibration signal and the burst mode of the traffic feature representation; Merging the compensated energy distribution and burst mode according to the timestamp to obtain time-space alignment data.

[0012] Optionally, based on the normal traffic baseline, identifying potential associated abnormal points in the time-space alignment data, including: Inputting the time-space alignment data into a preset anomaly detection model to extract network traffic dimension features and physical vibration dimension features respectively; In the network traffic dimension, calculating a dynamic time warping distance of the traffic feature representation in the time-space alignment data and the normal traffic baseline to obtain a first deviation degree; In the physical vibration dimension, detecting a density gradient of an energy spectrum of the abnormal vibration signal in the time-space alignment data in a preset sensitive frequency band to obtain a second deviation degree; fusing the first deviation and the second deviation to generate a cross-domain correlation deviation coefficient; when the cross-domain correlation deviation coefficient exceeds a preset dynamic threshold, determining a corresponding data point as a potential correlation anomaly point.

[0013] In a second aspect, the present application provides a data security tracing system based on a time sequence generative adversarial network, comprising: a collection module configured to collect metadata of network traffic from network traffic, the metadata comprising: protocol type, packet size, and transmission interval, and simultaneously acquire a vibration signal sequence of a physical cable; an identification module configured to aggregate and encode the metadata to obtain a traffic feature representation, and identify an abnormal vibration signal from the vibration signal sequence; a space-time alignment module configured to perform space-time alignment on the abnormal vibration signal and the traffic feature representation to obtain space-time alignment data; a determination module configured to determine a normal traffic baseline based on the space-time alignment data through a game mechanism of a generator and a discriminator in a time sequence generative adversarial network; an identification module configured to identify potential correlation anomaly points in the space-time alignment data based on the normal traffic baseline to complete data security tracing detection.

[0014] In a third aspect, the present application provides a computing device comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a data security tracing method based on a time sequence generative adversarial network according to any one of the first aspect.

[0015] In a fourth aspect, the present application provides a computer storage medium storing a computer program, which, when executed by a computer, implements a data security tracing method based on a time sequence generative adversarial network according to any one of the first aspect.

[0016] In the present application, a data security tracing method based on a time sequence generative adversarial network is provided, which comprises: collecting metadata of network traffic from network traffic, the metadata comprising: protocol type, packet size, and transmission interval, and simultaneously acquiring a vibration signal sequence of a physical cable; aggregating and encoding the metadata to obtain a traffic feature representation, and identifying an abnormal vibration signal from the vibration signal sequence; performing space-time alignment on the abnormal vibration signal and the traffic feature representation to obtain space-time alignment data; determining a normal traffic baseline based on the space-time alignment data through a game mechanism of a generator and a discriminator in a time sequence generative adversarial network; and identifying potential correlation anomaly points in the space-time alignment data based on the normal traffic baseline to complete data security tracing detection.

[0017] Beneficial effects of this application: This application is based on the multimodal fusion of network traffic metadata and physical vibration signals. It generates a normal baseline for network dynamic modeling through spatiotemporal alignment and time series adversarial analysis, accurately identifies cross-domain correlation anomalies, and thus achieves efficient data security traceability.

[0018] Furthermore, after the time window is divided into time and space aligned data, the present application injects random noise into the generator to extract cross-domain correlation feature patterns and generate a synthetic data stream; the discriminator compares the distribution difference between the synthetic data stream and the real time window time series data, and iteratively optimizes the generator and discriminator parameter weights through a game mechanism until the discriminator cannot distinguish between the two, and then fixes the generator parameters to the dynamic normal traffic baseline. Among them, the distribution difference analysis specifically includes: constructing a joint distribution function to calculate the physical domain vibration spectrum entropy and the network domain traffic burst statistics, quantifying the cross-domain correlation anomalies through the joint probability density offset, and determining the feature offset based on the extreme point of the Mahalanobis distance difference value. Through the joint modeling of cross-domain features and the Mahalanobis distance quantification of the coupled feature space offset, the single-modal statistical limitations are broken through, and the dynamic correlation analysis of physical vibration and network traffic is realized; the adversarial game mechanism is used to adaptively optimize the generator parameters, and a highly robust dynamic baseline is constructed, which significantly improves the accurate tracing capability of covert cross-domain attacks.

[0019] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 A flowchart of a data security tracing method based on a temporal adversarial generation network provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of a data security traceability system based on a temporal adversarial generation network provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0023] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The serial numbers of the operations, such as 11, 12, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0024] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0025] In order to solve the problem of poor data security tracing effect caused by the lack of cross-modal correlation analysis, the lack of dynamic coupling modeling and insufficient feature decoupling capabilities in the existing technology, the embodiment of the present application provides a data security tracing method based on a time-series adversarial generation network. The method adopts the following ideas: to address the pain point that hidden cross-domain attacks are difficult to trace, the limitations of single-modal detection are broken through by synchronously collecting network traffic metadata and physical vibration signals; after aggregating the coded traffic features and identifying abnormal vibration signals, millisecond-level spatiotemporal alignment is performed to construct cross-domain correlation data; using the game mechanism of the time-series adversarial generation network, the generator and the discriminator learn the coupling distribution characteristics of normal traffic and vibration signals in dynamic confrontation, and adaptively establish a dynamic baseline; finally, the abnormal correlation points are accurately located through cross-domain feature offset analysis, so as to achieve accurate tracing of physical and network collaborative attacks.

[0026] Figure 1 A flowchart of a data security traceability method based on a time-series adversarial generation network is provided in an embodiment of the present application. Figure 1 As shown, the method includes: S11. Collect metadata of network traffic from the network traffic, where the metadata includes: protocol type, data packet size, and transmission interval, and simultaneously obtain a vibration signal sequence of the physical cable.

[0027] Wherein, the network traffic refers to a set of data packets transmitted through wired or wireless communication links. The protocol type refers to the communication rule standard followed by the data packets, including Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), etc. The traffic probe is deployed at the mirror port of the switch, and the network traffic can be collected through the traffic probe. The data packet size refers to the byte length of a single data load, reflecting the size of the transmission content. The transmission interval refers to the time difference between consecutive data packets, used to measure the transmission continuity. The physical cable refers to the physical medium such as copper cable or optical fiber that carries network signals. The vibration signal sequence refers to the time domain waveform of the mechanical vibration of the cable collected by the acceleration sensor.

[0028] In the embodiments of the present application, first, the original network traffic is captured by the sniffing module deployed in the network switching device, and the metadata is extracted, including the protocol type used by the communication parties, the byte size of each data packet, and the transmission time interval between consecutive data packets; at the same time, a high-precision acceleration sensor is installed on the surface of the physical cable to continuously collect the time domain waveform generated by the cable vibration, forming a vibration signal sequence.

[0029] S12, aggregate encoding is performed on the metadata to obtain a traffic feature representation, and an abnormal vibration signal is identified from the vibration signal sequence.

[0030] Wherein, the aggregate encoding refers to the operation performed on the original metadata according to the time window statistics mean, variance and other characteristics. The traffic feature representation can refer to the multi-dimensional vector formed after the aggregate encoding, describing the traffic behavior pattern. The abnormal vibration signal refers to the vibration peak segment that exceeds the normal energy range identified by the spectrum analysis. The upper and lower limits of the normal energy range can be set according to actual needs, for example, the lower limit of the normal energy range is equal to the difference between the baseline mean and the preset allowed difference, and the upper limit of the normal energy range is equal to the sum of the baseline mean and the preset allowed difference.

[0031] In the embodiments of the present application, secondly, the sliding window aggregation algorithm is used for the network traffic metadata, the protocol type is one-hot encoded, the mean, variance and quantile statistics of the data packet size and transmission interval are calculated respectively, and the multi-dimensional traffic feature representation is generated by fusion; at the same time, the wavelet transform and spectral kurtosis analysis are performed on the vibration signal sequence, the abnormal vibration peak segment that exceeds the preset energy threshold is identified, and is labeled as an abnormal vibration signal.

[0032] S13, the abnormal vibration signal and the traffic feature representation are spatio-temporally aligned to obtain spatio-temporally aligned data.

[0033] The space-time alignment data can refer to a joint data structure that binds the vibration anomaly timestamp and the corresponding network feature.

[0034] In the embodiment of the application, the abnormal vibration signal is aligned with the flow feature representation at a millisecond level based on a high-precision timestamp. Specifically, the start and end time points of the vibration anomaly peak segment are bound to the flow feature vector of the corresponding time window by compensating for the transmission delay through a dynamic time warping algorithm, and space-time alignment data containing the physical vibration label and the network feature vector are generated.

[0035] S14, determining a normal flow baseline through a game mechanism of a generator and a discriminator in a time-series generative adversarial network based on the space-time alignment data.

[0036] The time-series generative adversarial network can refer to a neural network obtained by modeling time-series data based on the game of the generator and the discriminator. The network can include a sequence generator, a sequence discriminator, a loss function, etc. The sequence generator can be referred to as the generator, and the sequence discriminator can be referred to as the discriminator. The generator can refer to a data generation module that reconstructs cross-domain associated features through noise input. The discriminator can refer to a classification module that evaluates the authenticity of the input data and quantifies the distribution difference. The game mechanism refers to the adversarial optimization process of the generator and the discriminator through the back propagation of the loss function. The normal flow baseline can refer to a dynamic normal behavior model defined by the generator parameters after the game converges. The expression of the loss function is not specifically limited in this embodiment. It should be noted that the model structure, construction process and training process of the network can refer to related technologies, which will not be described here.

[0037] In the embodiment of the application, the time-series generative adversarial network is used to process the space-time alignment data. Specifically, first, time windows are divided to generate time-series data subsets; the generator receives random noise and extracts cross-domain associated features, and outputs a synthetic data stream; the discriminator compares the joint distribution of the synthetic data stream and the real time-series data, calculates the joint probability density offset of the vibration spectrum entropy and the flow burst statistics, and quantifies the distribution deviation through the Mahalanobis distance difference value; finally, the generator and the discriminator parameters are iteratively optimized through gradient back propagation, and when the discriminator cannot distinguish between real and synthetic data, the generator parameters are solidified as a dynamically evolving normal flow baseline.

[0038] S15, based on the normal flow baseline, identifying potential associated abnormal points in the space-time alignment data to complete data security traceability detection.

[0039] The potential associated abnormal points refer to data points whose joint offset of physical vibration and network features exceeds the baseline. The data security traceability detection specifies the attack source and reconstructs the attack chain.

[0040] In the embodiment of the present application, the feature offset degree of the spatio-temporal alignment data is finally calculated based on the normal traffic baseline: the joint feature vector of the vibration spectrum entropy and the traffic burst statistics in each time window is extracted, and the extreme point of the Mahalanobis distance thereof from the baseline is calculated; the extreme points exceeding the adaptive threshold are selected as potential associated abnormal points, the physical vibration event is associated with the network behavior anomaly, and the tracing detection of the data leakage or attack path is completed.

[0041] The following is a specific example: first, the Hypertext Transfer Protocol (HTTP) and TCP protocol packets are captured through the core switch mirror port, the byte length and adjacent packet transmission delay of each packet are recorded, and the vibration waveform is collected using the piezoelectric sensor attached to the fiber distribution frame. Second, the packet size mean, transmission interval variance and protocol distribution entropy are calculated with a 5-second window to generate a traffic feature matrix; the vibration signal is subjected to fast Fourier transform to mark the abnormal section with energy exceeding the threshold. Then, the vibration abnormal timestamp and the traffic feature window are aligned according to the Peer-to-Peer (PTP) precision clock protocol to construct a spatio-temporal correlation data set. Next, the data set is input into the adversarial network containing the Long Short-Term Memory (LSTM) unit: the generator learns the correlation pattern of vibration spectrum entropy and traffic burstiness, and the discriminator calculates the joint distribution offset by the Wasserstein distance; after 200 iterations, the generator outputs a stable baseline. Finally, the joint Mahalanobis distance peak of vibration spectrum entropy and TCP retransmission rate in new data is detected to locate the abnormal traffic window caused by cable wiretapping, and the source is traced to the A12 port of the 3rd cabinet.

[0042] By performing S11-S15, the embodiment of the present application realizes cross-domain threat perception by synchronously analyzing network protocol features and physical vibration signals; effectively distinguishes environmental interference and real attacks by using adversarial game to establish a dynamic adaptive baseline; accurately locates the associated abnormal points of physical wiretapping and network attacks based on joint probability density offset and Mahalanobis distance extreme value detection, and improves the tracing ability in complex attack scenarios.

[0043] In a possible embodiment, S14, the normal traffic baseline is determined according to the spatio-temporal alignment data through the game mechanism of the generator and the discriminator in the time sequence adversarial generation network, including: Step 141, dividing the spatio-temporal alignment data according to the time window to obtain time window time sequence data.

[0044] The time window time series data refers to a time-space aligned data subset segmented by a fixed time length, including a sequence of physical vibration labels and network feature vectors arranged in chronological order. The embodiment of the present application does not specifically limit the size of the fixed time length.

[0045] In an embodiment of the present application, the spatiotemporal alignment data is first divided into continuous time segments according to a fixed duration, each segment contains a synchronously collected physical vibration signal and a network traffic feature vector, forming time window time series data arranged in chronological order.

[0046] Step 142: Input the random noise data into the generator so that the generator extracts the cross-domain correlation feature pattern and generates a synthetic data stream according to the cross-domain correlation feature pattern.

[0047] Random noise data refers to a random number matrix with a Gaussian or uniform distribution, which is used to stimulate the generator to learn data distribution patterns. Cross-domain correlation feature patterns can refer to the coupling between the physical vibration spectrum entropy and network traffic burst statistics, represented by the neural network weight parameters. Synthetic data streams can refer to simulated data reconstructed by the generator based on noise input, with the same dimensional structure and statistical characteristics as real data. In practical applications, cross-domain correlation feature patterns can be represented in the form of [a, b], where a is the physical vibration spectrum entropy and b is the traffic burst variance.

[0048] In an embodiment of the present application, random noise data that conforms to the Gaussian distribution is input into the generator, and the generator extracts the intrinsic correlation law between the physical vibration spectrum and the burstiness of network traffic through a multi-layer long short-term memory network, that is, the cross-domain correlation feature pattern, and reconstructs a synthetic data stream with the same dimensional characteristics based on the pattern.

[0049] Step 143: Input the synthesized data stream and the time window time series data into the discriminator, and compare and analyze the feature distribution differences through the game mechanism between the generator and the discriminator to obtain distribution difference information.

[0050] The distribution difference information refers to the distribution deviation between real data and synthetic data, which is quantified by the difference between the joint probability density offset and the Mahalanobis distance.

[0051] In an embodiment of the present application, the synthetic data stream and the real time window timing data are input into the discriminator in parallel; the discriminator first constructs a joint distribution function of the two in the physical domain and the network domain, calculates the vibration spectrum entropy value and the statistics of traffic bursts respectively, compares the joint probability density offset through an adversarial game mechanism, and quantifies the degree of feature space offset based on the Mahalanobis distance difference value, and finally outputs distribution difference information that characterizes the distribution deviation.

[0052] Step 144, based on the game mechanism and distribution difference information, iteratively update the parameter weights of the generator and the discriminator to make the synthetic data stream conform to the distribution characteristics of the time window time series data.

[0053] wherein the parameter weight refers to the adjustable coefficient of the convolution kernel and the fully connected layer in the neural network, which determines the feature extraction and data generation capability. The distribution characteristics can refer to the joint probability distribution law of the physical vibration spectrum entropy and the network traffic burst statistics.

[0054] In the embodiments of the present application, the loss function of the generator and the discriminator is calculated using the distribution difference information, and the convolutional neural network weight parameters of the generator and the fully connected layer parameter weights of the discriminator are updated by the gradient descent algorithm, so that the synthetic data stream output by the generator gradually approaches the multi-modal joint distribution characteristics of the real time window time series data.

[0055] Step 145, when the discriminator cannot distinguish between the synthetic data stream and the time window time series data, the parameter weight of the generator is taken as the normal traffic baseline.

[0056] wherein in the embodiments of the present application, the last continuous iterative optimization process is until the discrimination accuracy of the discriminator on the synthetic data stream and the real data is lower than the preset threshold, at this time the cross-domain correlation feature generation capability represented by the generator parameter weight is solidified as the dynamic evolution normal traffic baseline.

[0057] The following is a specific example: first, the data center fiber vibration and TCP traffic alignment data set is cut into 120-dimensional time series data blocks according to 10-second window. Secondly, the generator receives 128-dimensional Gaussian noise, extracts the correlation features of vibration spectrum entropy and TCP retransmission rate through three-layer LSTM, and outputs the synthetic data stream. Subsequently, the discriminator calculates the joint probability density of the synthetic data and the real data in the vibration band energy and the traffic burst variance, adopts the Wasserstein distance to measure the distribution offset and outputs the difference value. Then, the convolution kernel weight of the generator and the fully connected layer parameter of the discriminator are adjusted according to the difference value, and the vibration frequency domain envelope and the traffic burst distribution of the synthetic data stream are approximated to the real data through multiple iterations. Finally, when the accuracy of the discriminator is reduced to below 50%, the generator network parameters are solidified as a dynamic baseline model for real-time monitoring of cross-domain anomalies.

[0058] By performing steps 141-145, the embodiments of the present application dynamically optimize the cross-domain feature generation capability through the adversarial game mechanism, establish a joint distribution baseline that integrates physical vibration and network behavior, effectively capture the coupling difference between environmental interference and real attacks, and improve the robustness of anomaly detection in complex attack scenarios.

[0059] In a possible embodiment, step 143, the synthetic data stream and the time window time series data are input to the discriminator, and the feature distribution difference is compared and analyzed through the game mechanism of the generator and the discriminator to obtain distribution difference information, including: Step a1, input the synthetic data stream and the time window time series data to the discriminator to obtain discriminator input data, and construct a joint distribution function based on the discriminator input data.

[0060] The discriminator input data can refer to a merged data set containing the synthetic data stream output by the generator and the real time window time series data, which is used for distribution comparison and analysis. The joint distribution function can refer to a mathematical model describing the co-occurrence probability of physical domain vibration spectrum entropy and network domain traffic burst statistics, which is constructed based on kernel density estimation. The construction process of the model is not limited in the embodiment.

[0061] In the embodiment of the application, the synthetic data stream generated by the generator and the real time window time series data are input to the discriminator in parallel to form discriminator input data containing double-source data; then, based on the correlation between the physical vibration spectrum features and the network traffic burst features in the input data, a joint distribution function describing the joint probability density of the two is constructed by using a non-parametric kernel density estimation method.

[0062] Step a2, based on the joint distribution function, the vibration spectrum entropy value of the physical domain and the statistics of the traffic burst event of the network domain are calculated respectively.

[0063] The physical domain can refer to an analysis dimension representing the characteristics of the physical cable vibration signal, including features such as frequency spectrum energy distribution. The vibration spectrum entropy value can refer to an index of frequency band energy disorder calculated based on the Shannon entropy formula after the vibration signal is converted into frequency energy distribution by Fourier transform, reflecting the complexity of vibration components. The network domain refers to an analysis dimension representing the behavior characteristics of network traffic, including features such as transmission burstiness. The traffic burst event refers to an abnormal fluctuation phenomenon that the network data packet transmission rate exceeds the dynamic baseline within a unit time window.

[0064] In the embodiment of the application, from the physical domain dimension of the joint distribution function, the energy distribution of the vibration signal in the preset frequency band is extracted, and the frequency spectrum disorder index, i.e., the vibration spectrum entropy value, is calculated through the Shannon entropy formula; at the same time, from the network domain dimension, the number of abnormal transmission events, the duration and byte fluctuation variance exceeding the traffic baseline threshold within the time window are counted to generate the statistics of the traffic burst event.

[0065] Step a3, through the game mechanism, the joint probability density deviation of the vibration spectrum entropy value and the statistics of the traffic burst event in the cross-domain correlation dimension is compared to generate the joint probability density deviation.

[0066] The cross-domain correlation dimension can refer to a cross feature space considering the physical vibration spectrum entropy and network traffic burst statistics simultaneously. The joint probability density offset can refer to a probability distribution difference phenomenon of the real data and the synthetic data in the physical-network joint feature space. The joint probability density offset amount can refer to a relative offset degree value of the joint probability density quantified by a divergence algorithm.

[0067] In the embodiment of the application, through the adversarial game mechanism of the generator and the discriminator, the vibration spectrum entropy value and the traffic burst statistics of the real data and the synthetic data are compared in the cross-domain correlation dimension of the physical vibration and the network traffic. The divergence algorithm is used to calculate the relative offset degree of the joint probability density, and the quantized joint probability density offset amount is output.

[0068] In step a4, a Mahalanobis distance difference of the synthetic data stream and the time window time series data in the coupled feature space is quantified based on a preset adversarial decision rule, and a Mahalanobis distance difference value is obtained.

[0069] The preset adversarial decision rule can include a predefined covariance matrix and a Mahalanobis distance calculation formula, which is used for standardizing the feature space difference evaluation. The coupled feature space refers to a multi-dimensional correlation feature space formed by mapping the physical vibration spectrum entropy and the network traffic burst statistics. The Mahalanobis distance difference refers to a standardized measure reflecting the offset distance of the data points in the coupled feature space after eliminating the influence of the feature dimension. The Mahalanobis distance difference value can refer to an Euclidean distance value calculated by weighting the inverse matrix of the covariance, which is used to quantify the feature space offset degree.

[0070] In the embodiment of the application, based on the pre-trained feature covariance matrix in the adversarial decision rule, the synthetic data stream and the real time window time series data are mapped to the physical-network coupled feature space. The standardized Mahalanobis distance difference value is finally obtained by calculating the feature vector minus the mean vector, multiplied by the inverse matrix of the covariance, multiplied by the vector transpose, and then taking the square root.

[0071] In step a5, the extreme point distribution information of the Mahalanobis distance difference value is taken as the distribution difference information.

[0072] The extreme point distribution information can refer to a peak point set exceeding a statistical significance threshold in the Mahalanobis distance difference value sequence, including the time and space position and intensity attribute.

[0073] In the embodiment of the application, the Mahalanobis distance difference value sequence of the continuous time window is subjected to sliding window extreme value detection, the peak points exceeding three times the standard deviation range are extracted, and the timestamp position, intensity and duration information are integrated to form the extreme point distribution information.

[0074] The following is a specific example: first, the discriminator receives the vibration and flow data synthesized by the generator and the real data center 10-second window time series data, and uses Gaussian kernel density estimation to construct the joint distribution function of both in the 0-2kHz vibration frequency band and the TCP retransmission burst number. Second, calculate the vibration spectrum entropy value of the real data in the 500-800Hz frequency band, and count the burst number variance of the per-second baseline flow in the synthesized data. Then, through the divergence algorithm, the joint probability density of the physical-network is compared to generate the offset value. Subsequently, based on the covariance matrix trained by the historical normal data, the Mahalanobis distance difference value of the synthesized data and the real data in the vibration entropy and burst number two-dimensional space is calculated. Finally, detect the extreme value points in the difference value sequence that continuously exceed the statistical control limit, output the timestamp and the offset intensity distribution diagram.

[0075] By performing steps a1~a5, the embodiments of the present application accurately capture the coupling abnormal patterns of physical vibration and network behavior through joint probability density offset quantization and standardized feature space distance calculation, enhancing the recognition robustness and trace accuracy of the adversarial network against cross-domain covert attacks.

[0076] In one possible embodiment, step a3, through the game mechanism, the joint probability density offset of the vibration spectrum entropy value and the statistical quantity of the flow burst event in the cross-domain correlation dimension is generated, including: Step a31, through the game mechanism, the coupling feature space of the vibration spectrum entropy value and the statistical quantity of the flow burst event in the cross-domain correlation dimension is divided, and a probability grid is established.

[0077] Wherein, the probability grid refers to a set of discretization units divided at equal intervals in the two-dimensional feature space composed of the vibration spectrum entropy value in the physical domain and the flow burst statistical quantity in the network domain, used for quantizing the joint probability distribution.

[0078] Step a32, adjust the weight coefficients of the vibration spectrum entropy value and the statistical quantity on the probability grid to obtain a weight combination.

[0079] Wherein, the weight adjustment rule can be defined as a dynamic weight optimization mechanism based on the gradient descent of the adversarial loss. The weight combination refers to the set of contribution weights of the vibration spectrum entropy feature and the flow burst statistical quantity feature in the joint distribution determined by gradient descent optimization, used to correct the dimension difference of the feature quantity.

[0080] Step a33, based on the weight combination, calculate the density distribution deviation of the vibration spectrum entropy value and the statistical quantity of the flow burst event in the probability grid.

[0081] Wherein, the density distribution deviation refers to the difference between the real data sample density and the synthesized data sample density in the same probability grid unit, reflecting the degree of local feature space distribution offset.

[0082] Step a34, cross-grid coupling integration is performed on the density distribution deviation of all probability grids to generate a joint probability density deviation.

[0083] Wherein, the cross-grid coupling integration refers to the operation of spatially weighted summation of the density distribution deviations of adjacent probability grid units, for aggregating local deviations to form a global joint probability density deviation.

[0084] The following is a specific example: first, the vibration spectrum entropy value range is divided into 20 intervals of 0-10, and the traffic burst statistic range is divided into 20 intervals of 0-100, forming a 400-unit probability grid. Second, the entropy value and statistic weight coefficient are adjusted according to the Wasserstein loss output by the discriminator, and the optimal weight combination is determined after 10 iterations. Next, the sample proportion of real data center data and generator synthesized data in each grid unit is counted, and the unit density deviation is calculated. Finally, the adjacent grid deviation values are weighted by a Gaussian kernel, and a joint deviation is generated by double integration along the entropy value axis and the statistic axis, and output to the generator parameter optimization module.

[0085] By performing steps a31-a34, the embodiments of the present application accurately quantify the collaborative distribution deviation of physical vibration and network traffic in the multi-dimensional feature space through dynamic weight correction and spatial coupling integration, and improve the abnormal sensitivity and pattern recognition ability of the adversarial network to cross-domain covert attacks.

[0086] In one possible embodiment, step a4, based on the preset adversarial decision rule, quantize the Mahalanobis distance difference between the synthesized data stream and the time window time series data in the coupled feature space to obtain a Mahalanobis distance difference value, including: Step a41, based on the preset adversarial decision rule, determine the distribution center of the time window time series data in the coupled feature space.

[0087] Wherein, the distribution center of the time window time series data refers to the mean position vector of the real time series data sample points in the physical and network coupled feature space, reflecting the aggregation center of normal behavior patterns.

[0088] Step a42, measure the deviation distance of each data point in the synthesized data stream to the distribution center in the coupled feature space to obtain an original deviation distance set.

[0089] Wherein, the original deviation distance set refers to the uncorrected Euclidean distance value set of each point in the synthesized data stream to the distribution center in the feature space.

[0090] Step a43, based on the preset sensitivity coefficient matrix, weight and correct the deviation distances in the original deviation distance set to generate a weighted deviation distance set.

[0091] The preset sensitivity coefficient matrix can refer to a weighting factor matrix pre-trained based on feature correlation, and is used to eliminate the influence of dimension difference between vibration spectrum entropy and flow burst statistics on distance calculation. The set of weighted deviation distances refers to a set of standardized distance values obtained by weighting and correcting the original deviation distances by the sensitivity coefficient matrix. For example, the sensitivity coefficient matrix can be pre-trained based on a covariance inverse matrix.

[0092] Step a44, aggregate all deviation distances in the set of weighted deviation distances to generate a Mahalanobis distance difference value.

[0093] The following is a specific example: first, based on the historical normal data covariance matrix, the mean vector of the data center 10-second window time series data in the vibration entropy-burst frequency space is calculated as the distribution center. Second, the Euclidean distance of each point of the synthetic data stream to the center is measured to form an original set. Then, the original distance is multiplied by the product factor of the entropy value dimension weight and the burst frequency dimension weight in the sensitivity coefficient matrix to generate a weighted distance set. Finally, the average value of the weighted distance sum of squares is calculated and the square root is taken to output the Mahalanobis distance difference value to the discriminator decision module.

[0094] By performing steps a41-a44, the embodiment of the present application eliminates the dimension difference of cross-domain features by feature space distribution center positioning and sensitivity coefficient weighting correction, realizes the quantization of the standardized distribution deviation of synthetic data and real data, and improves the pattern recognition accuracy of the adversarial network for hidden anomalies.

[0095] In one possible embodiment, S13, the abnormal vibration signal and the flow feature representation are spatio-temporally aligned to obtain spatio-temporally aligned data, including: Step 131, identifying the mutation timestamp of the protocol jump event in the flow feature representation based on the energy distribution peak timestamp of the abnormal vibration signal in the preset sensitive frequency band.

[0096] The preset sensitive frequency band refers to a vibration frequency range pre-set for the characteristics of physical cable wiretapping attacks, for example, a 50-500Hz frequency band. The energy distribution peak timestamp refers to the accurate time mark corresponding to the local maximum value of the energy of the vibration signal in the sensitive frequency band. The mutation timestamp refers to the accurate time mark of the occurrence of the protocol jump event. The protocol jump event refers to an unexpected switching of network layer protocol types, which is used to identify abnormal communication behavior; the flow burst event refers to the burstiness of the transmission layer data rate, which is used to detect transmission size anomalies. Both of them are manifestations of network anomalies, but the protocol jump focuses on the change of protocol semantics, and the flow burst focuses on the fluctuation of transmission volume.

[0097] In the embodiment of the present application, firstly, the local maximum points of the energy distribution curve of the abnormal vibration signal in the preset sensitive frequency band are extracted, and the corresponding peak timestamp is recorded; at the same time, the occurrence time of the protocol type jump event in the flow feature representation is analyzed, and the mutation timestamp of the protocol state mutation is identified.

[0098] Step 132, establishing a matching point pair of the peak timestamp and the mutation timestamp.

[0099] Among them, the matching point pair refers to the spatiotemporal correspondence combination of the vibration peak timestamp and the protocol mutation timestamp established through correlation analysis.

[0100] In the embodiment of the present application, secondly, based on the time correlation principle, the vibration energy peak timestamp and the protocol jump mutation timestamp are aligned according to the nearest neighbor matching principle, and the matching point pair describing the causal correlation between physical vibration and network behavior is established.

[0101] Step 133, based on the time offset of the matching point pair, the energy distribution of the abnormal vibration signal and the burst mode of the flow feature representation are compensated by window sliding.

[0102] Among them, the time offset refers to the difference between the vibration peak and the protocol mutation occurrence time in the same matching point pair, reflecting the transmission delay of physical signals and network events. The burst mode refers to the statistical mode of the flow feature representation describing the abnormal fluctuation of the data packet transmission rate, including the burst number and amplitude variance. The window sliding compensation refers to the operation of shifting the vibration or flow data along the time axis by a certain offset, which is used to eliminate the influence of cross-domain data transmission delay.

[0103] In the embodiment of the present application, subsequently, the mean value of the time offset of the vibration peak and the protocol mutation in all matching point pairs is calculated, and based on the mean value, the energy distribution curve of the abnormal vibration signal and the burst mode statistical quantity of the flow feature representation are compensated by bidirectional window sliding: the vibration signal time axis is shifted by the mean value of the offset to align the network event time reference. The above bidirectional window sliding compensation process can refer to related technologies, which will not be described here.

[0104] Step 134, merging the compensated energy distribution and burst mode according to the timestamp to obtain spatiotemporally aligned data.

[0105] Among them, in the embodiment of the present application, finally, the compensated vibration energy distribution vector and the flow burst mode feature vector are merged into a multi-dimensional joint feature matrix according to the unified timestamp, and the spatiotemporally aligned data containing the physical-network cross-domain correlation characteristics are generated.

[0106] The following is a specific example: first, identify the energy peak timestamp of the data center fiber vibration in the 200-400Hz frequency band, and detect the mutation timestamp of the HTTP protocol jump to the ICMP protocol in the traffic feature. Second, match the vibration peak in the adjacent time window with the protocol mutation point by the minimum time difference to form a matching point pair. Then, calculate the average of the time offset of all point pairs as 15 milliseconds, and move the vibration signal time axis by 15 milliseconds as a whole to align the network event time reference. Finally, merge the compensated vibration energy envelope feature vector and the TCP retransmission burst statistics according to the millisecond level timestamp to generate a spatio-temporal alignment dataset input into the adversarial network.

[0107] By performing steps 131-134, the embodiment of the application eliminates the physical layer and network layer data transmission delay by precise matching of vibration energy peak and protocol jump and bidirectional time compensation, realizes millisecond-level spatio-temporal alignment, and fuses the compensated vibration energy distribution and traffic burst mode to construct a cross-domain correlation feature matrix, providing accurate input for cooperative attack detection.

[0108] In one possible embodiment, S15, based on the normal traffic baseline, identifies potential associated abnormal points in the spatio-temporal alignment data, including: Step 151, input the spatio-temporal alignment data into a preset anomaly detection model to extract network traffic dimension features and physical vibration dimension features respectively.

[0109] Among them, the preset anomaly detection model refers to a pre-trained multi-branch neural network model, which includes a network traffic analysis module and a physical vibration analysis module. The network traffic dimension feature refers to the protocol distribution entropy, packet size variance and other statistical features extracted from the traffic feature representation. The physical vibration dimension feature refers to the frequency band energy proportion, spectral kurtosis and other time-frequency domain features extracted from the vibration signal.

[0110] Step 152, in the network traffic dimension, calculate the dynamic time warping distance between the traffic feature representation in the spatio-temporal alignment data and the normal traffic baseline to obtain a first deviation degree.

[0111] Among them, the dynamic time warping distance refers to the optimal bending path cumulative distance of two time series data sequences calculated by the dynamic programming algorithm, which is used to measure the similarity under the time axis stretching. The first deviation degree refers to the dynamic time warping distance value of the traffic feature sequence and the normal baseline sequence, reflecting the degree of network behavior anomaly. The expression of the dynamic programming algorithm is not specifically limited in the embodiment of the application.

[0112] Step 153, in the physical vibration dimension, detect the density gradient of the energy spectrum of the abnormal vibration signal in the spatio-temporal alignment data in the preset sensitive frequency band to obtain a second deviation degree.

[0113] The energy spectrum refers to the energy distribution curve of each frequency band after Fourier transform of the vibration signal. The preset sensitive frequency band refers to the critical vibration frequency range pre-set for a specific attack type. The density gradient refers to the first-order derivative of the energy spectrum within the preset sensitive frequency band, reflecting the intensity of the sudden change in energy distribution. The second deviation refers to the integral value of the density gradient within the sensitive frequency band, reflecting the intensity of the physical vibration anomaly.

[0114] Step 154: Fuse the first deviation and the second deviation to generate a cross-domain correlation deviation coefficient.

[0115] The cross-domain correlation deviation coefficient is a composite indicator that combines network traffic and physical vibration deviation, used to quantify cross-domain coordination anomalies. Fusion can be understood as a weighted geometric average or other operations, which are not specifically limited in this embodiment.

[0116] Step 155: When the cross-domain correlation deviation coefficient exceeds a preset dynamic threshold, the corresponding data point is determined as a potential correlation anomaly point.

[0117] A data point refers to the joint physical and network feature vector corresponding to a specific time window in the spatiotemporally aligned data. The preset dynamic threshold, unlike the static threshold used in the prior art, is adjustable. For example, the preset dynamic threshold is equal to the sum of the threshold at the previous moment and the current deviation mean. The present embodiment does not impose any specific restrictions on the coefficients of these two factors.

[0118] The following is a specific example: First, the spatiotemporal alignment data is input into the dual-branch detection model to extract the TCP retransmission rate time series features and the 200-400Hz vibration energy spectrum features respectively. Secondly, the dynamic time regularization distance between the TCP retransmission rate sequence and the baseline sequence is calculated to obtain the first deviation. Subsequently, the density gradient integral of the vibration energy spectrum at the 250Hz frequency point is calculated to obtain the second deviation. Next, the two deviations are standardized and the cross-domain correlation deviation coefficient is generated by weighted geometric averaging. Finally, when the coefficient exceeds the dynamic threshold for three consecutive windows, the data point in this period is marked as an anomaly and traced back to the B3 fiber optic interface of the 5th cabinet.

[0119] By executing steps 151 to 155, the embodiment of the present application realizes accurate correlation analysis between physical vibration anomalies and network behavior anomalies through dual-dimensional feature deviation fusion and dynamic threshold judgment, effectively distinguishes environmental noise from real attacks, and improves the traceability detection capability of cross-domain collaborative attacks.

[0120] Figure 2 A structural diagram of a data security traceability system based on a time-series adversarial generation network provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the system includes: The acquisition module 21 is used to collect metadata of network traffic from the network traffic, the metadata including protocol type, data packet size and transmission interval, and simultaneously obtain the vibration signal sequence of the physical cable.

[0121] The identification module 22 is used to aggregate and encode the metadata to obtain a flow feature representation and identify abnormal vibration signals from the vibration signal sequence.

[0122] The time-space alignment module 23 is used to perform time-space alignment on the abnormal vibration signal and the flow characteristic representation to obtain time-space alignment data.

[0123] The determination module 24 is used to determine the normal traffic baseline based on the spatiotemporal alignment data through the game mechanism between the generator and the discriminator in the temporal adversarial generation network.

[0124] The identification module 25 is used to identify the normal traffic baseline and potential associated anomalies in the spatiotemporal alignment data to complete data security traceability detection.

[0125] Figure 2 The data security traceability system based on temporal adversarial generative network can be executed Figure 1 The implementation principle and technical effects of the data security traceability method based on a temporal adversarial generation network described in the illustrated embodiment will not be repeated here. The specific manner in which each module and unit performs operations in the data security traceability system based on a temporal adversarial generation network in the above embodiment has been described in detail in the embodiments of the method and will not be elaborated on here.

[0126] In one possible design, Figure 2 The data security traceability system based on the temporal adversarial generation network of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32 .

[0127] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0128] The processing component 32 is configured to perform the following processes: collecting metadata of network traffic from network traffic, the metadata including: protocol type, packet size and transmission interval, while obtaining a vibration signal sequence of the physical cable; performing aggregate encoding on the metadata to obtain a traffic feature representation, and identifying an abnormal vibration signal from the vibration signal sequence; performing spatio-temporal alignment on the abnormal vibration signal and the traffic feature representation to obtain spatio-temporal alignment data; determining a normal traffic baseline according to the spatio-temporal alignment data through a game mechanism of a generator and a discriminator in a time sequence generative adversarial network; and identifying potential associated abnormal points in the spatio-temporal alignment data based on the normal traffic baseline to complete data security traceability detection.

[0129] The processing component 32 can include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component can also be one or more Application-Specific Integrated Circuits (ASIC), Digital Signal Processors (DSP), Digital Signal Process Devices (DSPD), Programmable Logic Devices (PLD), Field Programmable Gate Arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic elements for executing the above method.

[0130] The storage component 31 is configured to store various types of data to support the operation of the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or their combination, such as Random Access Memory (RAM), Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0131] Of course, the computing device can also include other components, such as input / output interfaces, display components, communication components, etc.

[0132] The input / output interface provides an interface between the processing component and peripheral interface modules, which can be output devices, input devices, etc.

[0133] The communication component is configured to facilitate wired or wireless communication between the computing device and other devices, etc.

[0134] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform, and the computing device can be a cloud server, and the processing component, the storage component, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0135] The embodiment of the application also provides a computer storage medium storing a computer program, and the computer program can implement the above-mentioned Figure 1 The embodiment shown in the figure is a data security traceability method based on a time sequence generative adversarial network.

[0136] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-mentioned system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0137] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0138] Through the description of the foregoing embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software and the necessary general hardware platform, and of course, it can also be realized by hardware. Based on this understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disc, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, server, or network device, etc.) execute the method described in each embodiment or some part of the embodiment.

[0139] Finally, it should be noted that the above examples are only used to illustrate the technical solutions of the present application, and are not intended to limit the same; although the present application has been described in detail with reference to the foregoing examples, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data security traceability method based on a temporal adversarial generative network, characterized in that: include: Collecting metadata of network traffic from the network traffic, the metadata including protocol type, packet size, and transmission interval, and simultaneously obtaining a vibration signal sequence of a physical cable; performing aggregation encoding on the metadata to obtain a flow feature representation, and identifying abnormal vibration signals from the vibration signal sequence; Performing spatiotemporal alignment on the abnormal vibration signal and the flow characteristic representation to obtain spatiotemporal alignment data; According to the spatiotemporal alignment data, a normal traffic baseline is determined through a game mechanism between a generator and a discriminator in a temporal adversarial generative network; Based on the normal traffic baseline, potential associated anomalies in the spatiotemporal alignment data are identified to complete data security traceability detection.

2. The method according to claim 1, characterized in that Determining a normal traffic baseline based on the spatiotemporal alignment data through a game mechanism between a generator and a discriminator in a temporal adversarial generative network includes: Divide the spatiotemporal alignment data according to time windows to obtain time window time series data; inputting random noise data into the generator so that the generator extracts a cross-domain correlation feature pattern and generates a synthetic data stream according to the cross-domain correlation feature pattern; Inputting the synthesized data stream and the time window time series data into the discriminator, and comparing and analyzing the feature distribution differences through the game mechanism between the generator and the discriminator to obtain distribution difference information; Iteratively updating the parameter weights of the generator and the discriminator based on the game mechanism and the distribution difference information so that the synthesized data stream conforms to the distribution characteristics of the time series data in the time window; When the discriminator cannot distinguish the synthetic data stream from the time window time series data, the parameter weight of the generator is used as a normal traffic baseline.

3. The method according to claim 2, characterized in that The step of inputting the synthesized data stream and the time window time series data into the discriminator and comparing and analyzing feature distribution differences through the game mechanism between the generator and the discriminator to obtain distribution difference information includes: Inputting the synthesized data stream and the time window time series data into the discriminator to obtain discriminator input data, and constructing a joint distribution function based on the discriminator input data; Based on the joint distribution function, respectively calculating the vibration spectrum entropy value of the physical domain and the statistics of the traffic burst event of the network domain; By using the game mechanism, the joint probability density offset between the vibration spectrum entropy value and the statistics of the traffic emergency event is compared in the cross-domain correlation dimension to generate a joint probability density offset; Based on a preset adversarial decision rule, quantify the Mahalanobis distance difference between the synthetic data stream and the time window time series data in the coupled feature space to obtain a Mahalanobis distance difference value; The extreme point distribution information of the Mahalanobis distance difference value is used as distribution difference information.

4. The method according to claim 3, characterized in that The method of comparing the joint probability density offset of the vibration spectrum entropy value and the statistics of the traffic emergency event in the cross-domain correlation dimension through the game mechanism to generate a joint probability density offset includes: By using the game mechanism, the coupling feature space of the vibration spectrum entropy value and the statistics of the traffic emergency event is divided on the cross-domain correlation dimension to establish a probability grid; Adjusting the weight coefficients of the vibration spectrum entropy value and the statistic on the probability grid to obtain a weight coefficient combination; Based on the weight coefficient combination, calculating the density distribution deviation of the vibration spectrum entropy value and the statistic of the traffic emergency event in the probability grid; A cross-grid coupled integration is performed on the density distribution deviations of all probability grids to generate a joint probability density offset.

5. The method according to claim 3, characterized in that The method of quantifying the Mahalanobis distance difference between the synthetic data stream and the time window time series data in the coupled feature space based on the preset adversarial decision rule to obtain the Mahalanobis distance difference value includes: Based on a preset adversarial decision rule, determining the distribution center of the time window time series data in the coupled feature space; measuring the deviation distance of each data point in the synthetic data stream from the distribution center in the coupling feature space to obtain an original deviation distance set; Based on a preset sensitivity coefficient matrix, performing weighted correction on the deviation distances in the original deviation distance set to generate a weighted deviation distance set; Aggregate all the deviation distances in the weighted deviation distance set to generate the Mahalanobis distance difference value.

6. The method according to claim 1, characterized in that The performing spatiotemporal alignment on the abnormal vibration signal and the flow characteristic representation to obtain spatiotemporal alignment data includes: Based on the energy distribution peak timestamp of the abnormal vibration signal in the preset sensitive frequency band, identifying the mutation timestamp of the protocol jump event in the traffic feature representation; Establishing a matching point pair between the peak timestamp and the mutation timestamp; Based on the time offset of the matching point pair, performing window sliding compensation on the energy distribution of the abnormal vibration signal and the burst mode represented by the flow characteristics; The compensated energy distribution and the burst pattern are merged according to the timestamp to obtain the spatiotemporally aligned data.

7. The method according to claim 1, characterized in that The identifying, based on the normal traffic baseline, potential associated anomalies in the spatiotemporal alignment data includes: Inputting the spatiotemporal alignment data into a preset anomaly detection model to extract network traffic dimension features and physical vibration dimension features respectively; In the network traffic dimension, calculating the dynamic time warping distance between the traffic feature representation in the spatiotemporal alignment data and the normal traffic baseline to obtain a first deviation; In the physical vibration dimension, detecting a density gradient of an energy spectrum of an abnormal vibration signal in the spatiotemporal alignment data in a preset sensitive frequency band to obtain a second deviation; fusing the first deviation and the second deviation to generate a cross-domain correlation deviation coefficient; When the cross-domain correlation deviation coefficient exceeds a preset dynamic threshold, the corresponding data point is determined as a potential correlation anomaly point.

8. A data security traceability system based on a temporal adversarial generative network, characterized in that: include: a collection module, configured to collect metadata of network traffic from the network traffic, the metadata including protocol type, packet size, and transmission interval, and simultaneously obtain a vibration signal sequence of the physical cable; an identification module, configured to aggregate and encode the metadata to obtain a flow feature representation and identify abnormal vibration signals from the vibration signal sequence; a time-space alignment module, configured to perform time-space alignment on the abnormal vibration signal and the flow characteristic representation to obtain time-space alignment data; A determination module, configured to determine a normal traffic baseline based on the spatiotemporal alignment data through a game mechanism between a generator and a discriminator in a temporal adversarial generative network; An identification module is used for the normal traffic baseline to identify potential associated anomalies in the spatiotemporal alignment data to complete data security tracing detection.

9. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a data security tracing method based on a temporal adversarial generation network as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that A computer program is stored, and when the computer program is executed by a computer, a data security tracing method based on a temporal adversarial generation network as described in any one of claims 1 to 7 is implemented.

Images