A Data Security Tracing Method and System Based on Temporal Adversarial Generative Networks

Abstract

This application relates to the field of data security technology, and provides a data security tracing method and system based on temporal adversarial generative networks (TPNs) to solve the problems of poor data security tracing performance in existing technologies due to the lack of cross-modal correlation analysis, lack of dynamic coupling modeling, and insufficient feature decoupling capabilities. The method of this invention includes: aggregating and encoding metadata to obtain traffic feature representations; identifying abnormal vibration signals from vibration signal sequences; spatiotemporally aligning abnormal vibration signals and traffic feature representations; determining a normal traffic baseline through a game mechanism between the generator and discriminator in a temporal adversarial generative network; identifying potential correlation anomalies in the spatiotemporally aligned data, and completing data security tracing detection. The technical solution provided by this application can perform multimodal spatiotemporal alignment analysis of network traffic metadata and physical vibration signals, establish a dynamic baseline through a temporal adversarial generative network, and then accurately identify abnormal correlation points to achieve efficient data security tracing.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data security tracing method and system based on temporal adversarial generative networks. Background Technology

[0002] With the evolution of advanced persistent threats and physical layer eavesdropping techniques, infrastructure faces multidimensional attacks across cyberspace and physical space. Attackers may simultaneously manipulate network protocols and exert physical interference, requiring the identification of cross-domain correlation anomalies, the establishment of dynamically evolving normal traffic baselines, and the achievement of millisecond-level spatiotemporal alignment and multimodal anomaly causal inference.

[0003] Existing solutions employ generative adversarial networks (GANs) to process single-modal time-series data, learning normal patterns and detecting deviations. They use long short-term memory networks (LSTMs) as the basis for the generator and discriminator, with the generator reconstructing the input time-series data and the discriminator evaluating the data's authenticity. Meanwhile, the anomaly score is calculated by fusing the reconstruction error and the discriminator's confidence. Furthermore, a distance-optimized loss function is used to address the gradient vanishing problem and improve model stability.

[0004] However, existing solutions only handle single data sources and lack a multi-source coupling analysis mechanism. Secondly, the dynamic coupling relationships between multiple sources are not incorporated into the baseline model, leading to misjudging environmental interference as attacks, and there is also a problem of insufficient feature decoupling capability. Summary of the Invention

[0005] This application provides a data security tracing method and system based on temporal adversarial generative networks to solve the problems of poor data security tracing effect caused by the lack of cross-modal correlation analysis, lack of dynamic coupling modeling and insufficient feature decoupling ability in the prior art.

[0006] Firstly, this application provides a data security attribution method based on temporal adversarial generative networks, including:

[0007] Metadata of network traffic is collected from network traffic, including protocol type, packet size and transmission interval, and vibration signal sequence of physical cable is also acquired.

[0008] The metadata is aggregated and encoded to obtain a flow characteristic representation, and abnormal vibration signals are identified from the vibration signal sequence;

[0009] The abnormal vibration signal and the flow characteristic representation are spatiotemporally aligned to obtain spatiotemporally aligned data.

[0010] Based on the spatiotemporal alignment data, the normal traffic baseline is determined through the game mechanism between the generator and the discriminator in the temporal adversarial generative network.

[0011] Based on the normal traffic baseline, potential associated anomalies in the spatiotemporal aligned data are identified to complete data security tracing and detection.

[0012] Optionally, determining the normal traffic baseline based on the spatiotemporal aligned data through a game mechanism between the generator and discriminator in a temporal adversarial generative network includes:

[0013] The spatiotemporally aligned data is divided according to a time window to obtain time-window time-series data;

[0014] Random noise data is input into the generator so that the generator can extract cross-domain correlation feature patterns and generate a synthetic data stream based on the cross-domain correlation feature patterns;

[0015] The synthesized data stream and the time-window time series data are input into the discriminator. The differences in feature distribution are compared and analyzed through the game mechanism between the generator and the discriminator to obtain distribution difference information.

[0016] Based on the game mechanism and the distribution difference information, the parameter weights of the generator and the discriminator are iteratively updated so that the synthesized data stream conforms to the distribution characteristics of the time window time series data.

[0017] When the discriminator cannot distinguish between the synthesized data stream and the time window time series data, the parameter weights of the generator are used as the normal traffic baseline.

[0018] Optionally, the step of inputting the synthesized data stream and the time-window time-series data into the discriminator, and comparing and analyzing the feature distribution differences through a game mechanism between the generator and the discriminator to obtain distribution difference information, includes:

[0019] The synthesized data stream and the time-window time series data are input into the discriminator to obtain discriminator input data, and a joint distribution function is constructed based on the discriminator input data;

[0020] Based on the joint distribution function, the vibration spectrum entropy value of the physical domain and the statistics of traffic burst events in the network domain are calculated respectively.

[0021] Through the game mechanism, the joint probability density shift between the vibration spectrum entropy value and the statistics of the traffic burst event is compared in the cross-domain correlation dimension to generate a joint probability density shift.

[0022] Based on the preset adversarial decision-making rules, the difference in Mahalanobis distance between the synthetic data stream and the time-window time series data in the coupled feature space is quantified to obtain the Mahalanobis distance difference value.

[0023] The distribution information of the extreme points of the Mahalanobis distance difference is used as the distribution difference information.

[0024] Optionally, the step of generating a joint probability density offset by comparing the joint probability density shift of the vibration spectrum entropy value and the statistics of the traffic burst event in the cross-domain correlation dimension through the game mechanism includes:

[0025] Through the game mechanism, a coupled feature space of the vibration spectrum entropy value and the statistics of the traffic burst event is divided on the cross-domain correlation dimension to establish a probability grid.

[0026] By adjusting the weighting coefficients of the vibration spectrum entropy value and the statistic on the probability grid, a combination of weighting coefficients is obtained.

[0027] Based on the weighting coefficient combination, the deviation between the vibration spectrum entropy value and the density distribution of the statistics of the traffic burst event in the probability grid is calculated;

[0028] The density distribution deviations of all probability grids are coupled across grids to generate a joint probability density offset.

[0029] Optionally, the step of quantifying the Mahalanobis distance difference between the synthetic data stream and the time-window time-series data in the coupled feature space based on a preset adversarial decision rule to obtain the Mahalanobis distance difference value includes:

[0030] Based on preset adversarial decision-making rules, the distribution center of the time-series data of the time window is determined in the coupled feature space;

[0031] Measure the deviation distance of each data point in the synthetic data stream from the distribution center in the coupled feature space to obtain the original set of deviation distances;

[0032] Based on a preset sensitivity coefficient matrix, the deviation distances in the original deviation distance set are weighted and corrected to generate a weighted deviation distance set;

[0033] Aggregate all deviations in the weighted deviation distance set to generate Mahalanobis distance difference values.

[0034] Optionally, the step of performing spatiotemporal alignment on the abnormal vibration signal and the flow characteristic representation to obtain spatiotemporally aligned data includes:

[0035] Based on the peak timestamp of the energy distribution of the abnormal vibration signal in the preset sensitive frequency band, the abrupt timestamp of the protocol jump event in the flow characteristic representation is identified;

[0036] Establish a matching point pair between the peak timestamp and the mutation timestamp;

[0037] Based on the time offset of the matching point pair, window sliding compensation is performed on the energy distribution of the abnormal vibration signal and the burst mode represented by the flow characteristics;

[0038] The compensated energy distribution and the burst mode are merged according to the timestamp to obtain spatiotemporally aligned data.

[0039] Optionally, identifying potential correlation anomalies in the spatiotemporal aligned data based on the normal traffic baseline includes:

[0040] The spatiotemporal aligned data is input into a preset anomaly detection model to extract network traffic dimension features and physical vibration dimension features, respectively.

[0041] In terms of network traffic, the dynamic time warping distance between the traffic feature representation in the spatiotemporal aligned data and the normal traffic baseline is calculated to obtain the first deviation.

[0042] In the dimension of physical vibration, the density gradient of the energy spectrum of the abnormal vibration signal in the spatiotemporal alignment data in the preset sensitive frequency band is detected to obtain the second deviation.

[0043] By combining the first deviation and the second deviation, a cross-domain correlation deviation coefficient is generated;

[0044] When the cross-domain correlation deviation coefficient exceeds a preset dynamic threshold, the corresponding data point is identified as a potential correlation anomaly.

[0045] Secondly, this application provides a data security tracing system based on temporal adversarial generative networks, including:

[0046] The acquisition module is used to acquire network traffic metadata from network traffic, including protocol type, data packet size and transmission interval, and to acquire the vibration signal sequence of physical cables.

[0047] An identification module is used to aggregate and encode the metadata to obtain a traffic feature representation and identify abnormal vibration signals from the vibration signal sequence;

[0048] The spatiotemporal alignment module is used to perform spatiotemporal alignment on the abnormal vibration signal and the flow characteristic representation to obtain spatiotemporal aligned data.

[0049] The determination module is used to determine the normal traffic baseline based on the spatiotemporal aligned data through a game mechanism between the generator and the discriminator in a temporal adversarial generative network.

[0050] The identification module is used to identify potential associated anomalies in the spatiotemporal aligned data of the normal traffic baseline in order to complete data security tracing and detection.

[0051] Thirdly, this application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are to be invoked and executed by the processing component to implement a data security tracing method based on a temporal adversarial generative network as described in any of the first aspects.

[0052] Fourthly, this application provides a computer storage medium storing a computer program, which, when executed by a computer, implements a data security tracing method based on a temporal adversarial generative network as described in any of the first aspects.

[0053] This application provides a data security tracing method based on a temporal adversarial generative network. The method includes: collecting network traffic metadata from network traffic, including protocol type, packet size, and transmission interval; simultaneously acquiring vibration signal sequences of physical cables; aggregating and encoding the metadata to obtain traffic feature representations; identifying abnormal vibration signals from the vibration signal sequences; performing spatiotemporal alignment on the abnormal vibration signals and traffic feature representations to obtain spatiotemporally aligned data; determining a normal traffic baseline based on the spatiotemporally aligned data using a game mechanism between the generator and discriminator in the temporal adversarial generative network; and identifying potential associated anomalies in the spatiotemporally aligned data based on the normal traffic baseline to complete data security tracing detection.

[0054] The beneficial effects of this application are:

[0055] This application is based on the multimodal fusion of network traffic metadata and physical vibration signals. It generates a normal baseline for dynamic network modeling through spatiotemporal alignment and temporal adversarial analysis, accurately identifies cross-domain correlation anomalies, and thus achieves efficient data security traceability.

[0056] Furthermore, this application divides the spatiotemporally aligned data into time windows, injects random noise into the generator to extract cross-domain correlation feature patterns, and generates a synthetic data stream. The discriminator compares the distribution differences between the synthetic data stream and the real time window time series data, and iteratively optimizes the parameter weights of the generator and discriminator through a game mechanism until the discriminator can no longer distinguish between the two, at which point the generator parameters are fixed as a dynamic normal traffic baseline. Specifically, the distribution difference analysis includes: constructing a joint distribution function to calculate the physical domain vibration spectrum entropy and network domain traffic burst statistics; quantifying cross-domain correlation anomalies through joint probability density offset; and determining feature offsets based on the extreme points of Mahalanobis distance difference values. By coupling feature space offsets with cross-domain feature joint modeling and Mahalanobis distance quantification, the limitations of single-modal statistics are overcome, enabling dynamic correlation analysis between physical vibration and network traffic. The generator parameters are adaptively optimized using an adversarial game mechanism to construct a highly robust dynamic baseline, significantly improving the accurate tracing capability of covert cross-domain attacks.

[0057] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 A flowchart illustrating a data security tracing method based on a temporal adversarial generative network provided in this application embodiment;

[0060] Figure 2 A schematic diagram of the structure of a data security tracing system based on a temporal adversarial generative network provided in this application embodiment;

[0061] Figure 3 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0062] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0063] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 11, 12, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to different types.

[0064] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0065] To address the poor data security tracing results caused by the lack of cross-modal correlation analysis, dynamic coupling modeling, and insufficient feature decoupling capabilities in existing technologies, this application provides a data security tracing method based on temporal adversarial generative networks. This method employs the following concept: Addressing the difficulty in tracing covert cross-domain attacks, it overcomes the limitations of single-modal detection by simultaneously collecting network traffic metadata and physical vibration signals; after aggregating and encoding traffic features and identifying abnormal vibration signals, it performs millisecond-level spatiotemporal alignment to construct cross-domain correlation data; using the game-theoretic mechanism of temporal adversarial generative networks, the generator and discriminator learn the coupling distribution characteristics of normal traffic and vibration signals in dynamic adversarial interaction, adaptively establishing a dynamic baseline; finally, through cross-domain feature offset analysis, it accurately locates abnormal correlation points, achieving precise tracing of physical and network collaborative attacks.

[0066] Figure 1 A flowchart of a data security tracing method based on temporal adversarial generative networks provided in this application embodiment is shown below. Figure 1 As shown, the method includes:

[0067] S11. Collect network traffic metadata from the network traffic, including: protocol type, packet size and transmission interval, and simultaneously obtain the vibration signal sequence of the physical cable.

[0068] Network traffic refers to the set of data packets transmitted through wired or wireless communication links. Protocol type refers to the communication rules and standards followed by the data packets, including Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP). Deploying traffic probes on mirrored ports of switches allows for the collection of network traffic data. Data packet size refers to the length in bytes of a single data payload, reflecting the scale of the transmitted content. Transmission interval refers to the time difference between the arrival of consecutive data packets, used to measure transmission continuity. Physical cable refers to the physical medium such as copper cable or optical fiber that carries network signals. Vibration signal sequence refers to the time-domain waveform of the mechanical vibration of the cable, collected by an accelerometer.

[0069] In this embodiment, the original network traffic is first captured by a sniffing module deployed on the network switching device, and the metadata is extracted, including the protocol type used by the communicating parties, the byte size of each data packet, and the transmission time interval between consecutive data packets. At the same time, a high-precision accelerometer is installed on the surface of the physical cable to continuously collect the time-domain waveform generated by the cable vibration and form a vibration signal sequence.

[0070] S12. Aggregate and encode the metadata to obtain a traffic characteristic representation, and identify abnormal vibration signals from the vibration signal sequence.

[0071] Aggregation encoding refers to the operation performed on the original metadata according to the statistical mean, variance, and other characteristics of a time window. Traffic feature representation can refer to the multi-dimensional vector formed after aggregation encoding, describing traffic behavior patterns. Abnormal vibration signals refer to vibration peaks exceeding the normal energy range identified through spectral analysis. In this application embodiment, the upper and lower limits of the normal energy range can be set according to actual needs. For example, the lower limit of the normal energy range is equal to the difference between the baseline mean and a preset allowable difference, and the upper limit of the normal energy range is equal to the sum of the baseline mean and the preset allowable difference.

[0072] In this embodiment, a sliding window aggregation algorithm is used to aggregate network traffic metadata. The protocol type is one-hot encoded, and the mean, variance, and quantile statistics within the window are calculated for the data packet size and transmission interval, respectively. These are then fused to generate a multidimensional traffic feature representation. Simultaneously, wavelet transform and spectral kurtosis analysis are performed on the vibration signal sequence to identify abnormal vibration peaks that exceed a preset energy threshold and label them as abnormal vibration signals.

[0073] S13. Perform spatiotemporal alignment on the abnormal vibration signal and flow characteristic representation to obtain spatiotemporal aligned data.

[0074] Among them, spatiotemporally aligned data can refer to a joint data structure that binds vibration anomaly timestamps with corresponding network features.

[0075] In this embodiment, the abnormal vibration signal and the flow feature representation are aligned at the millisecond level based on the high-precision timestamp. Specifically, the transmission delay is compensated by the dynamic time warping algorithm, and the start and end time points of the abnormal vibration peak segment are bound to the flow feature vector of the corresponding time window to generate spatiotemporal aligned data containing physical vibration labels and network feature vectors.

[0076] S14. Based on the spatiotemporal alignment data, determine the normal traffic baseline through the game mechanism between the generator and discriminator in the temporal adversarial generative network.

[0077] In this context, a temporal adversarial generative network (GAN) can refer to a neural network modeled from temporal data based on a game between a generator and a discriminator. This network can include a sequence generator, a sequence discriminator, and a loss function. The sequence generator can be simply referred to as the generator, and similarly, the sequence discriminator can be simply referred to as the discriminator. The generator can refer to a data generation module that reconstructs cross-domain correlation features from noisy input. The discriminator can refer to a classification module that evaluates the authenticity of the input data and the difference in quantized distribution. The game mechanism refers to the adversarial optimization process of the generator and discriminator through backpropagation of the loss function. The normal traffic baseline can refer to a dynamic normal behavior model defined by the generator parameters after the game converges. This embodiment does not specifically limit the expression of the loss function. It should be noted that the model structure, construction process, and training process of this network can all refer to relevant technologies, and will not be elaborated here.

[0078] In this embodiment, a temporal adversarial generative network is used to process spatiotemporally aligned data. Specifically: first, time windows are divided to generate subsets of time-series data; the generator receives random noise and extracts cross-domain correlation features, outputting a synthetic data stream; the discriminator compares the joint distribution of the synthetic data stream with that of the real time-series data, calculates the joint probability density offset of vibration spectrum entropy and traffic burst statistics, and quantifies the distribution deviation through Mahalanobis distance difference; finally, the parameters of the generator and discriminator are iteratively optimized through gradient backpropagation. When the discriminator cannot distinguish between real and synthetic data, the generator parameters are fixed as the dynamic evolution of the normal traffic baseline.

[0079] S15. Based on the normal traffic baseline, identify potential correlation anomalies in the spatiotemporally aligned data to complete data security tracing and detection.

[0080] Among them, potentially correlated anomalies refer to data points whose combined offset from the baseline is due to physical vibration and network characteristics. Data security attribution detection is an analytical process that identifies the root cause of attacks and reconstructs the attack chain.

[0081] In this embodiment, the feature offset of the spatiotemporally aligned data is finally calculated based on the normal traffic baseline: the joint feature vector of vibration spectrum entropy and traffic burst statistics within each time window is extracted, and the extreme points of its Mahalanobis distance from the baseline are calculated; extreme points exceeding the adaptive threshold are selected as potential associated anomalies, and physical vibration events are associated with network behavior anomalies to complete the source tracing and detection of data leakage or attack paths.

[0082] Here is a specific example: First, Hypertext Transfer Protocol (HTTP) and TCP packets are captured through the mirror port of the core switch, recording the byte length of each packet and the transmission delay of adjacent packets. Simultaneously, vibration waveforms are collected using piezoelectric sensors attached to the fiber optic patch panel. Second, the mean packet size, transmission interval variance, and protocol distribution entropy are statistically analyzed in 5-second windows to generate a traffic feature matrix. After performing a Fast Fourier Transform on the vibration signal, abnormal segments with energy exceeding the threshold are marked. Subsequently, the vibration anomaly timestamps and traffic feature windows are aligned using a Peer-to-Peer (PTP) precision clock protocol to construct a spatiotemporal correlation dataset. Next, the dataset is input into an adversarial network containing Long Short-Term Memory (LSTM) units: the generator learns the correlation pattern between vibration spectral entropy and traffic bursts, and the discriminator calculates the joint distribution offset using the Wasserstein distance. After 200 iterations, the generator outputs a stable baseline. Finally, by detecting the peak value of the joint Mahalanobis distance between the vibration spectrum entropy and the TCP retransmission rate in the new data, the abnormal traffic window caused by cable eavesdropping was located and traced back to port A12 of rack 3.

[0083] By executing S11~S15, this embodiment of the application achieves cross-domain threat perception by synchronously analyzing network protocol characteristics and physical vibration signals; it establishes a dynamic adaptive baseline using adversarial game theory to effectively distinguish between environmental interference and real attacks; and it accurately locates the correlation anomalies between physical eavesdropping and network attacks based on joint probability density shift and Mahalanobis distance extreme value detection, thereby improving the source tracing capability in complex attack scenarios.

[0084] In one possible embodiment, S14, determining the normal traffic baseline based on spatiotemporal aligned data through a game mechanism between the generator and discriminator in a temporal adversarial generative network includes:

[0085] Step 141: Divide the spatiotemporally aligned data according to the time window to obtain the time window time series data.

[0086] The time-window time-series data refers to a spatiotemporally aligned subset of data divided into fixed durations, containing physical vibration labels and network feature vector sequences arranged in chronological order. This application does not specify a particular size for the fixed duration.

[0087] In this embodiment, the spatiotemporal aligned data is first divided into continuous time segments with a fixed duration. Each segment contains synchronously acquired physical vibration signals and network traffic feature vectors, forming time-series data arranged in chronological order.

[0088] Step 142: Input random noise data into the generator so that the generator can extract cross-domain correlation feature patterns and generate a synthetic data stream based on the cross-domain correlation feature patterns.

[0089] Random noise data refers to a random number matrix that conforms to a Gaussian or uniform distribution, used to stimulate the generator to learn data distribution patterns. Cross-domain correlation feature patterns can refer to the coupling law between physical vibration spectrum entropy and network traffic burst statistics, characterized by neural network weight parameters. Synthetic data streams can refer to simulated data reconstructed by the generator based on noise input, possessing the same dimensional structure and statistical properties as real data. In practical applications, cross-domain correlation feature patterns can be represented in the form [a, b], where a is the physical vibration spectrum entropy and b is the traffic burst variance.

[0090] In this embodiment of the application, random noise data conforming to a Gaussian distribution is input into the generator. The generator extracts the inherent correlation between the physical vibration spectrum and the burstiness of network traffic through a multi-layer long short-term memory network, namely the cross-domain correlation feature pattern, and reconstructs a synthetic data stream with the same dimensional characteristics based on the pattern.

[0091] Step 143: Input the synthesized data stream and time window time series data into the discriminator, and compare and analyze the differences in feature distribution through the game mechanism between the generator and the discriminator to obtain distribution difference information.

[0092] Among them, the distribution difference information refers to the distribution deviation between real data and synthetic data quantified by the joint probability density offset and Mahalanobis distance difference value.

[0093] In this embodiment, the synthetic data stream and the real time window time series data are input into the discriminator in parallel. The discriminator first constructs the joint distribution function of the two in the physical domain and the network domain, calculates the vibration spectrum entropy value and the statistics of traffic burst events respectively, compares the joint probability density offset through an adversarial game mechanism, and quantifies the degree of feature space offset based on the Mahalanobis distance difference value, and finally outputs the distribution difference information that characterizes the distribution deviation.

[0094] Step 144: Based on the game mechanism and distribution difference information, iteratively update the parameter weights of the generator and discriminator so that the synthesized data stream conforms to the distribution characteristics of time-series data within the time window.

[0095] Among them, parameter weights refer to the adjustable coefficients of convolutional kernels and fully connected layers in a neural network, determining the ability to extract features and generate data. Distribution characteristics can refer to the joint probability distribution law of physical vibration spectrum entropy and network traffic burst statistics.

[0096] In this embodiment, the loss functions of the generator and discriminator are calculated using distribution difference information. The weight parameters of the generator's convolutional neural network and the weight parameters of the discriminator's fully connected layer are updated through backpropagation using the gradient descent algorithm, so that the synthetic data stream output by the generator gradually approximates the multimodal joint distribution characteristics of the real time window time series data.

[0097] Step 145: When the discriminator cannot distinguish between the synthesized data stream and the time window time series data, the parameter weights of the generator are used as the normal traffic baseline.

[0098] In this embodiment, the final iterative optimization process continues until the discriminator's accuracy in distinguishing between synthetic data streams and real data is lower than a preset threshold. At this point, the cross-domain correlation feature generation capability represented by the generator parameter weights is solidified into a dynamically evolving normal traffic baseline.

[0099] Here's a concrete example: First, the data center fiber optic vibration and TCP traffic alignment dataset is divided into 120-dimensional time-series data blocks using a 10-second window. Second, the generator receives 128-dimensional Gaussian noise and extracts the correlation features between vibration spectral entropy and TCP retransmission rate using a three-layer LSTM, outputting a synthetic data stream. Next, the discriminator calculates the joint probability density of the synthetic and real data in terms of vibration frequency band energy and traffic burst variance, using Wasserstein distance to measure distribution offset and outputting the difference value. Then, based on the difference value, the generator's convolutional kernel weights and the discriminator's fully connected layer parameters are adjusted. Through multiple iterations, the vibration frequency domain envelope and traffic burst distribution of the synthetic data stream are made to approximate the real data. Finally, when the discriminator accuracy drops below 50%, the generator network parameters are fixed as a dynamic baseline model for real-time monitoring of cross-domain anomalies.

[0100] By executing steps 141 to 145, this embodiment of the application dynamically optimizes the cross-domain feature generation capability through an adversarial game mechanism, establishes a joint distribution baseline that integrates physical vibration and network behavior, effectively captures the coupling differences between environmental interference and real attacks, and improves the robustness of anomaly detection in complex attack scenarios.

[0101] In one possible embodiment, step 143 involves inputting the synthesized data stream and time-window time-series data into the discriminator, and comparing and analyzing the differences in feature distributions through a game mechanism between the generator and the discriminator to obtain distribution difference information, including:

[0102] Step a1: Input the synthesized data stream and time window time series data into the discriminator to obtain the discriminator input data, and construct the joint distribution function based on the discriminator input data.

[0103] The discriminator input data can refer to a merged dataset that simultaneously includes the synthetic data stream output by the generator and the time-series data of the real time window, used for distribution comparison analysis. The joint distribution function can refer to a mathematical model describing the probability of the co-occurrence of the physical domain vibration spectrum entropy and the network domain traffic burst statistics, constructed based on kernel density estimation. This embodiment does not specifically limit the construction process of this model.

[0104] In this embodiment, the synthesized data stream generated by the generator and the real time-series data collected in the time window are first input into the discriminator in parallel to form discriminator input data containing dual-source data. Then, a non-parametric kernel density estimation method is used to construct a joint distribution function describing the joint probability density of the two based on the correlation between the physical vibration spectrum characteristics and the burst characteristics of network traffic in the input data.

[0105] Step a2: Based on the joint distribution function, calculate the vibration spectrum entropy value of the physical domain and the statistics of traffic burst events in the network domain, respectively.

[0106] The physical domain refers to the analytical dimension characterizing the vibration signal characteristics of physical cables, including features such as spectral energy distribution. Vibration spectral entropy, calculated using the Shannon entropy formula after converting the vibration signal into a frequency domain energy distribution through Fourier transform, reflects the complexity of the vibration components. The network domain refers to the analytical dimension characterizing network traffic behavior, including features such as transmission bursts. A traffic burst event refers to an abnormal fluctuation in the network data packet transmission rate exceeding the dynamic baseline within a unit time window.

[0107] In this embodiment, the energy distribution of vibration signals within a preset frequency band is extracted from the physical domain dimension of the joint distribution function, and the spectral disorder index, i.e., the vibration spectral entropy value, is calculated using the Shannon entropy formula. Simultaneously, from the network domain dimension, the number of abnormal transmission events exceeding the traffic baseline threshold, their duration, and the byte fluctuation variance are statistically analyzed within the time window to generate statistics on traffic burst events.

[0108] Step a3: Through game theory, compare the joint probability density shift of the vibration spectrum entropy value and the statistics of traffic burst events in the cross-domain correlation dimension to generate the joint probability density shift.

[0109] Among these, the cross-domain correlation dimension can refer to the cross-feature space that simultaneously considers the physical vibration spectrum entropy and the burst statistics of network traffic. The joint probability density offset can refer to the difference in probability distribution between real and synthetic data in the physical-network joint feature space. The joint probability density offset can be defined as the numerical value of the relative shift in the joint probability density, quantified using a divergence algorithm.

[0110] In this embodiment, through the adversarial game mechanism between the generator and the discriminator, the vibration spectrum entropy value and traffic burst statistics of real data and synthetic data are compared in the cross-domain correlation dimension where physical vibration and network traffic intersect; the divergence algorithm is used to calculate the relative offset of the joint probability density of the two, and the quantified joint probability density offset is output.

[0111] Step a4: Based on the preset adversarial decision-making rules, quantify the difference in Mahalanobis distance between the synthetic data stream and the time window time series data in the coupled feature space to obtain the Mahalanobis distance difference value.

[0112] The predefined adversarial decision-making rules can include a predefined covariance matrix and a Mahalanobis distance calculation formula, used for standardized feature space difference assessment. The coupled feature space refers to the multidimensional associated feature space formed by mapping physical vibration spectrum entropy to network traffic burst statistics. Mahalanobis distance difference is a standardized measure reflecting the offset distance of data points in the coupled feature space after eliminating the influence of feature dimensions. The Mahalanobis distance difference value can refer to the Euclidean distance calculated by weighting the covariance inverse matrix, used to quantify the degree of feature space offset.

[0113] In this embodiment, based on the pre-trained feature covariance matrix in the adversarial decision-making rules, the synthetic data stream and the real time window time series data are mapped to the physical-network coupled feature space; by calculating the feature vector minus the mean vector, multiplying by the inverse covariance matrix, and then multiplying by the vector transpose, the square root is finally taken to obtain the standardized Mahalanobis distance difference value.

[0114] Step a5: Use the distribution information of extreme points of Mahalanobis distance difference as distribution difference information.

[0115] Among them, the extreme point distribution information can refer to the set of peak points in the Mahalanobis distance difference value sequence that exceed the statistical significance threshold, including spatiotemporal location and intensity attributes.

[0116] In this embodiment, a sliding window extreme value detection is performed on the Mahalanobis distance difference value sequence of continuous time windows to extract peak points exceeding three times the standard deviation range, and their timestamp position, intensity and duration information are integrated to form extreme point distribution information.

[0117] Here is a specific example: First, the discriminator receives vibration and flow data synthesized by the generator and 10-second window time-series data from the real data center. Gaussian kernel density estimation is used to construct a joint distribution function for both in the 0-2kHz vibration frequency band and the number of TCP retransmission bursts. Second, the vibration spectral entropy value of the real data in the 500-800Hz frequency band is calculated, and the variance of the number of bursts exceeding the baseline flow per second in the synthesized data is statistically analyzed. Next, a divergence algorithm is used to compare the physical-network joint probability density to generate offset values. Subsequently, based on the covariance matrix trained on historical normal data, the Mahalanobis distance difference between the synthesized data and the real data in the two-dimensional space of vibration entropy and burst count is calculated. Finally, extreme points in the difference value sequence that continuously exceed the statistical control limits are detected, and their timestamps and offset intensity distribution maps are output.

[0118] By executing steps a1 to a5, the embodiments of this application accurately capture the coupling anomaly pattern of physical vibration and network behavior through joint probability density offset quantization and standardized feature space distance calculation, thereby enhancing the robustness of adversarial networks in identifying cross-domain covert attacks and improving the accuracy of tracing the source.

[0119] In one possible embodiment, step a3, through a game theory mechanism, compares the joint probability density shift of the vibration spectrum entropy value and the statistics of the traffic burst event in the cross-domain correlation dimension to generate a joint probability density shift, including:

[0120] Step a31: Through game theory, the coupling feature space of vibration spectrum entropy value and traffic burst event statistics is divided in the cross-domain correlation dimension, and a probability grid is established.

[0121] Among them, the probability grid refers to the set of discretized units divided at equal intervals in the two-dimensional feature space consisting of the vibration spectrum entropy value in the physical domain and the burst statistics of the network domain, which is used to quantify the joint probability distribution.

[0122] Step a32: Adjust the weighting coefficients of the vibration spectrum entropy value and the statistic on the probability grid to obtain the weighting coefficient combination.

[0123] The weight adjustment rule can be defined as a dynamic weight optimization mechanism based on adversarial loss gradient descent. The weight coefficient combination refers to the set of contribution weights of the vibration spectrum entropy feature and the flow burst statistics feature in the joint distribution determined by gradient descent optimization, which is used to correct for differences in feature dimensions.

[0124] Step a33: Based on the combination of weighting coefficients, calculate the deviation between the vibration spectrum entropy value and the density distribution of the statistics of the sudden flow event in the probability grid.

[0125] Density distribution deviation refers to the difference between the density of real data samples and the density of synthetic data samples within the same probability grid cell, reflecting the degree of local feature spatial distribution shift.

[0126] Step a34: Perform cross-grid coupled integration on the density distribution deviation of all probability grids to generate a joint probability density offset.

[0127] Among them, cross-grid coupling integral refers to the operation of spatially weighted summation of the density distribution deviations of adjacent probability grid cells, which is used to aggregate local offsets to form a global joint probability density offset.

[0128] Here's a specific example: First, the vibration spectrum entropy value range is divided into 20 intervals from 0 to 10, and the flow burst statistics range is divided into 20 intervals from 0 to 100, forming a 400-cell probability grid. Second, the entropy and statistics weighting coefficients are adjusted based on the Wasserstein loss output by the discriminator, and the optimal weight combination is determined after 10 iterations. Next, the sample proportions of real data center data and generator-synthesized data in each grid cell are statistically analyzed, and the cell density deviation is calculated. Finally, the deviation values ​​of adjacent grid cells are weighted by a Gaussian kernel, and a joint offset is generated by double integration along the entropy axis and the statistics axis, which is then output to the generator parameter optimization module.

[0129] By executing steps a31 to a34, the embodiments of this application accurately quantify the collaborative distribution shift of physical vibration and network traffic in a multi-dimensional feature space through dynamic weight correction and spatial coupling integration, thereby improving the adversarial network's abnormal sensitivity and pattern recognition capability to cross-domain covert attacks.

[0130] In one possible embodiment, step a4, based on a preset adversarial decision rule, quantifies the Mahalanobis distance difference between the synthesized data stream and the time-window time-series data in the coupled feature space to obtain the Mahalanobis distance difference value, including:

[0131] Step a41: Based on the preset adversarial decision-making rules, determine the distribution center of the time-series data in the coupled feature space.

[0132] Among them, the distribution center of time series data in the time window refers to the mean position vector of real time series data sample points in the physical and network coupling feature space, which reflects the aggregation center of normal behavior patterns.

[0133] Step a42: Measure the deviation distance of each data point in the synthetic data stream from the distribution center in the coupled feature space to obtain the original deviation distance set.

[0134] The original offset distance set refers to the set of uncorrected Euclidean distance values ​​from each point in the synthetic data stream to the distribution center in the feature space.

[0135] Step a43: Based on the preset sensitivity coefficient matrix, perform weighted correction on the deviation distances in the original deviation distance set to generate a weighted deviation distance set.

[0136] The preset sensitivity coefficient matrix can refer to a weighted factor matrix pre-trained based on feature correlation, used to eliminate the influence of the difference in dimensions between vibration spectral entropy and flow burst statistics on distance calculation. The weighted deviation distance set refers to the set of standardized distance values ​​after the original deviation distance has been weighted and corrected by the sensitivity coefficient matrix. For example, the sensitivity coefficient matrix can be pre-trained based on the inverse covariance matrix.

[0137] Step a44: Aggregate all deviation distances in the weighted deviation distance set to generate Mahalanobis distance difference values.

[0138] Here's a specific example: First, based on the historical normal data covariance matrix, the mean vector of the 10-second window time-series data from the data center in the vibration entropy-burst frequency space is calculated as the distribution center. Second, the Euclidean distance from each point in the synthetic data stream to this center is measured to form the original set. Next, the original distance is multiplied by the product factor of the entropy dimension weight and the burst frequency dimension weight in the sensitivity coefficient matrix to generate a weighted distance set. Finally, the average of the sum of squares of the weighted distances is calculated and the square root is taken, outputting the Mahalanobis distance difference value to the discriminator decision module.

[0139] By executing steps a41 to a44, this embodiment of the application eliminates cross-domain feature dimension differences through feature space distribution center localization and sensitivity coefficient weighting correction, realizes standardized distribution offset quantization between synthetic data and real data, and improves the pattern recognition accuracy of adversarial networks for hidden anomalies.

[0140] In one possible embodiment, S13, performing spatiotemporal alignment on the abnormal vibration signal and flow characteristic representation to obtain spatiotemporal aligned data, including:

[0141] Step 131: Based on the peak timestamp of the energy distribution of the abnormal vibration signal in the preset sensitive frequency band, identify the abrupt change timestamp of the protocol jump event in the traffic characteristic representation.

[0142] Among them, the preset sensitive frequency band refers to the pre-defined vibration frequency range, such as the 50-500Hz band, for physical cable eavesdropping attack characteristics. The energy distribution peak timestamp refers to the precise time marker corresponding to the local maximum energy value of the vibration signal within the sensitive frequency band. The mutation timestamp refers to the precise time marker of the occurrence of a protocol jump event. A protocol jump event refers to an unexpected switch in network layer protocol type, used to identify abnormal communication behavior; a traffic burst event refers to a sudden fluctuation in the data rate of the transport layer, used to detect abnormal transmission scale. Both are manifestations of network anomalies, but protocol jumps focus on changes in protocol semantics, while traffic bursts focus on fluctuations in transmission volume.

[0143] In this embodiment, the local maxima of the energy distribution curve of the abnormal vibration signal within a preset sensitive frequency band are first extracted, and the corresponding peak timestamps are recorded. At the same time, the occurrence time of the protocol type jump event in the traffic characteristic representation is analyzed, and the mutation timestamp of the protocol state change is identified.

[0144] Step 132: Establish matching pairs between peak timestamps and mutation timestamps.

[0145] Among them, the spatiotemporal correspondence between the matching point and the vibration peak time stamp and the protocol mutation time stamp is established through correlation analysis.

[0146] In this embodiment, based on the principle of time correlation, the vibration energy peak timestamp and the protocol jump change timestamp are aligned according to the nearest neighbor matching principle to establish a matching point pair describing the causal relationship between physical vibration and network behavior.

[0147] Step 133: Based on the time offset of the matching point pair, perform window sliding compensation on the burst mode of the energy distribution and flow characteristics of the abnormal vibration signal.

[0148] Among them, time offset refers to the difference between the peak vibration value and the time of protocol mutation at the same matching point, reflecting the transmission delay of physical signals and network events. Burst pattern refers to the statistical pattern describing abnormal fluctuations in packet transmission rate in the traffic characteristic representation, including the number of bursts and amplitude variance. Window sliding compensation refers to the operation of shifting vibration or traffic data along the time axis by a specific offset, used to eliminate the impact of cross-domain data transmission delay.

[0149] In this embodiment, the mean time offset between the vibration peak value and the protocol mutation in all matching point pairs is then calculated. Based on this mean, a bidirectional window sliding compensation is performed on the energy distribution curve of the abnormal vibration signal and the burst mode statistics represented by the flow characteristics: the vibration signal time axis is shifted by the mean offset to align with the network event time reference. The above bidirectional window sliding compensation process can be referred to in related technologies and will not be elaborated here.

[0150] Step 134: Merge the compensated energy distribution with the burst mode according to the timestamp to obtain spatiotemporally aligned data.

[0151] In this embodiment, the compensated vibration energy distribution vector and the traffic burst mode feature vector are finally merged into a multi-dimensional joint feature matrix according to a unified timestamp, generating spatiotemporal aligned data containing physical-network cross-domain correlation characteristics.

[0152] Here's a specific example: First, identify the peak energy timestamps of fiber optic vibration in the 200-400Hz frequency band of a data center, and simultaneously detect the abrupt transition timestamps from HTTP to ICMP protocols in traffic characteristics. Second, match vibration peaks and protocol abrupt transition points within adjacent time windows using the minimum time difference to form matching point pairs. Then, calculate the average time offset of all point pairs as 15 milliseconds, and shift the vibration signal time axis forward by 15 milliseconds to align with the network event time base. Finally, merge the compensated vibration energy envelope feature vector with TCP retransmission burst statistics using millisecond-level timestamps to generate a spatiotemporally aligned dataset, which is then input into the adversarial network.

[0153] By executing steps 131 to 134, this embodiment of the application eliminates the data transmission delay between the physical layer and the network layer through precise matching of vibration energy peak and protocol jump and bidirectional time compensation, achieving millisecond-level spatiotemporal alignment; by fusing the compensated vibration energy distribution and traffic burst patterns, a cross-domain correlation feature matrix is ​​constructed, providing accurate input for collaborative attack detection.

[0154] In one possible embodiment, S15, based on a normal traffic baseline, identifies potential correlated anomalies in the spatiotemporally aligned data, including:

[0155] Step 151: Input the spatiotemporal aligned data into the preset anomaly detection model and extract the network traffic dimension features and physical vibration dimension features respectively.

[0156] The preset anomaly detection model refers to a pre-trained multi-branch neural network model, which includes a network traffic analysis module and a physical vibration analysis module. Network traffic dimension features refer to statistical features extracted from the traffic feature representation, such as protocol distribution entropy and packet size variance. Physical vibration dimension features refer to time-frequency domain features extracted from vibration signals, such as frequency band energy proportion and spectral kurtosis.

[0157] Step 152: In the network traffic dimension, calculate the dynamic time warping distance between the traffic feature representation in the spatiotemporal aligned data and the normal traffic baseline to obtain the first deviation.

[0158] The dynamic time warping distance refers to the cumulative distance of the optimal curved paths between two time-series data sequences calculated using a dynamic programming algorithm, used to measure the similarity under time axis scaling. The first deviation refers to the dynamic time warping distance value between the traffic characteristic sequence and the normal baseline sequence, reflecting the degree of network behavior anomalies. This application does not specifically limit the expression of the dynamic programming algorithm in its embodiments.

[0159] Step 153: In the physical vibration dimension, detect the density gradient of the energy spectrum of the abnormal vibration signal in the spatiotemporal alignment data in the preset sensitive frequency band to obtain the second deviation.

[0160] Here, the energy spectrum refers to the energy distribution curves of each frequency band after the vibration signal undergoes a Fourier transform. The preset sensitive frequency band refers to a key vibration frequency range pre-defined for a specific attack type. The density gradient is the first derivative of the energy spectrum within the preset sensitive frequency band, reflecting the intensity of abrupt changes in energy distribution. The second deviation is the integral value of the density gradient within the sensitive frequency band, reflecting the intensity of physical vibration anomalies.

[0161] Step 154: Combine the first deviation and the second deviation to generate the cross-domain correlation deviation coefficient.

[0162] The cross-domain correlation deviation coefficient is a composite index of the deviation between fused network traffic and physical vibration, used to quantify cross-domain coordination anomalies. Fusion can be understood as a weighted geometric average, or it can refer to other operations; this application does not specifically limit this.

[0163] Step 155: When the cross-domain correlation deviation coefficient exceeds the preset dynamic threshold, the corresponding data point is identified as a potential correlation anomaly.

[0164] Here, data points refer to the joint physical and network feature vectors corresponding to a specific time window in the spatiotemporal aligned data. The preset dynamic threshold differs from the static threshold in existing technologies; its value is adjustable. For example, the preset dynamic threshold is equal to the sum of the threshold at the previous moment and the current average deviation. This application does not specifically limit the magnitude of the coefficients between the two.

[0165] Here is a specific example: First, spatiotemporally aligned data is input into a dual-branch detection model to extract the TCP retransmission rate time series features and the 200-400Hz vibration energy spectrum features, respectively. Next, the dynamic time warping distance between the TCP retransmission rate sequence and the baseline sequence is calculated to obtain the first deviation. Then, the density gradient integral of the vibration energy spectrum at 250Hz is calculated to obtain the second deviation. Next, the two deviations are standardized and then a cross-domain correlation deviation coefficient is generated using a weighted geometric mean. Finally, when the coefficient exceeds the dynamic threshold for three consecutive windows, the data point in that time period is marked as an anomaly and traced back to the B3 fiber optic interface in rack 5.

[0166] By executing steps 151 to 155, this embodiment of the application achieves accurate correlation analysis between physical vibration anomalies and network behavior anomalies through dual-dimensional feature deviation fusion and dynamic threshold determination, effectively distinguishing environmental noise from real attacks and improving the source tracing and detection capabilities of cross-domain collaborative attacks.

[0167] Figure 2 A schematic diagram of a data security tracing system based on a temporal adversarial generative network is provided in an embodiment of this application, as shown below. Figure 2 As shown, the system includes:

[0168] The acquisition module 21 is used to acquire network traffic metadata from the network traffic, including protocol type, data packet size and transmission interval, and to acquire the vibration signal sequence of the physical cable.

[0169] The identification module 22 is used to aggregate and encode metadata to obtain a traffic feature representation and identify abnormal vibration signals from the vibration signal sequence.

[0170] The spatiotemporal alignment module 23 is used to perform spatiotemporal alignment on the abnormal vibration signal and the flow characteristic representation to obtain spatiotemporal aligned data.

[0171] The determination module 24 is used to determine the normal traffic baseline based on the spatiotemporal aligned data and through the game mechanism between the generator and the discriminator in the temporal adversarial generative network.

[0172] The identification module 25 is used to identify potential correlation anomalies in spatiotemporally aligned data in the normal traffic baseline in order to complete data security tracing and detection.

[0173] Figure 2 The aforementioned data security tracing system based on temporal adversarial generative networks can execute... Figure 1 The implementation principle and technical effects of the data security tracing method based on temporal adversarial generative networks described in the illustrated embodiment will not be repeated here. The specific methods by which each module and unit of the data security tracing system based on temporal adversarial generative networks in the above embodiments are performed have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0174] In one possible design, Figure 2 The data security tracing system based on temporal adversarial generative networks shown in the embodiment can be implemented as a computing device, such as... Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32.

[0175] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are invoked and executed by the processing component 32.

[0176] The processing component 32 is used to perform the following processes: collecting network traffic metadata from network traffic, including protocol type, packet size, and transmission interval, and simultaneously acquiring the vibration signal sequence of the physical cable; aggregating and encoding the metadata to obtain a traffic feature representation, and identifying abnormal vibration signals from the vibration signal sequence; performing spatiotemporal alignment on the abnormal vibration signals and the traffic feature representation to obtain spatiotemporal aligned data; determining the normal traffic baseline based on the spatiotemporal aligned data through a game mechanism between the generator and discriminator in a temporal adversarial generative network; and identifying potential associated anomalies in the spatiotemporal aligned data based on the normal traffic baseline to complete data security tracing and detection.

[0177] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above-described method. Alternatively, the processing component may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described method.

[0178] Storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Random Access Memory (RAM), Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0179] Of course, computing devices may also include other components, such as input / output interfaces, display components, communication components, etc.

[0180] Input / output interfaces provide interfaces between processing components and peripheral interface modules, which can be output devices, input devices, etc.

[0181] The communication components are configured to facilitate wired or wireless communication between computing devices and other devices.

[0182] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform. In this case, the computing device can refer to a cloud server, and the aforementioned processing components, storage components, etc., can be basic server resources rented or purchased from the cloud computing platform.

[0183] This application also provides a computer storage medium storing a computer program, which, when executed by a computer, can perform the above-described functions. Figure 1 The illustrated embodiment presents a data security tracing method based on a temporal adversarial generative network.

[0184] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0185] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0186] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0187] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A data security tracing method based on temporal adversarial generative networks, characterized in that, include: Metadata of network traffic is collected from network traffic, including protocol type, packet size and transmission interval, and vibration signal sequence of physical cable is also acquired. The metadata is aggregated and encoded to obtain a flow characteristic representation, and abnormal vibration signals are identified from the vibration signal sequence; The abnormal vibration signal and the flow characteristic representation are spatiotemporally aligned to obtain spatiotemporally aligned data. Based on the spatiotemporal alignment data, the normal traffic baseline is determined through the game mechanism between the generator and the discriminator in the temporal adversarial generative network. Based on the normal traffic baseline, potential associated anomalies in the spatiotemporal aligned data are identified to complete data security tracing and detection. The step of identifying potential correlation anomalies in the spatiotemporal aligned data based on the normal traffic baseline includes: The spatiotemporal aligned data is input into a preset anomaly detection model to extract network traffic dimension features and physical vibration dimension features, respectively. In terms of network traffic, the dynamic time warping distance between the traffic feature representation in the spatiotemporal aligned data and the normal traffic baseline is calculated to obtain the first deviation. In the dimension of physical vibration, the density gradient of the energy spectrum of the abnormal vibration signal in the spatiotemporal alignment data in the preset sensitive frequency band is detected to obtain the second deviation. By combining the first deviation and the second deviation, a cross-domain correlation deviation coefficient is generated; When the cross-domain correlation deviation coefficient exceeds a preset dynamic threshold, the corresponding data point is identified as a potential correlation anomaly.

2. The method according to claim 1, characterized in that, The step of determining the normal traffic baseline based on the spatiotemporal aligned data through a game mechanism between the generator and discriminator in a temporal adversarial generative network includes: The spatiotemporally aligned data is divided according to a time window to obtain time-window time-series data; Random noise data is input into the generator so that the generator can extract cross-domain correlation feature patterns and generate a synthetic data stream based on the cross-domain correlation feature patterns; The synthesized data stream and the time-window time series data are input into the discriminator. The differences in feature distribution are compared and analyzed through the game mechanism between the generator and the discriminator to obtain distribution difference information. Based on the game mechanism and the distribution difference information, the parameter weights of the generator and the discriminator are iteratively updated so that the synthesized data stream conforms to the distribution characteristics of the time window time series data. When the discriminator cannot distinguish between the synthesized data stream and the time window time series data, the parameter weights of the generator are used as the normal traffic baseline.

3. The method according to claim 2, characterized in that, The process of inputting the synthesized data stream and the time-window time-series data into the discriminator, and comparing and analyzing the feature distribution differences through a game mechanism between the generator and the discriminator to obtain distribution difference information, includes: The synthesized data stream and the time-window time series data are input into the discriminator to obtain discriminator input data, and a joint distribution function is constructed based on the discriminator input data; Based on the joint distribution function, the vibration spectrum entropy value of the physical domain and the statistics of traffic burst events in the network domain are calculated respectively. Through the game mechanism, the joint probability density shift between the vibration spectrum entropy value and the statistics of the traffic burst event is compared in the cross-domain correlation dimension to generate a joint probability density shift. Based on the preset adversarial decision-making rules, the difference in Mahalanobis distance between the synthetic data stream and the time-window time series data in the coupled feature space is quantified to obtain the Mahalanobis distance difference value. The distribution information of the extreme points of the Mahalanobis distance difference is used as the distribution difference information.

4. The method according to claim 3, characterized in that, The step of generating a joint probability density offset by comparing the joint probability density shift of the vibration spectrum entropy value and the statistics of the traffic burst event in the cross-domain correlation dimension through the game mechanism includes: Through the game mechanism, a coupled feature space of the vibration spectrum entropy value and the statistics of the traffic burst event is divided on the cross-domain correlation dimension to establish a probability grid. By adjusting the weighting coefficients of the vibration spectrum entropy value and the statistic on the probability grid, a combination of weighting coefficients is obtained. Based on the weighting coefficient combination, the deviation between the vibration spectrum entropy value and the density distribution of the statistics of the traffic burst event in the probability grid is calculated; The density distribution deviations of all probability grids are coupled across grids to generate a joint probability density offset.

5. The method according to claim 3, characterized in that, The method, based on a preset adversarial decision-making rule, quantifies the Mahalanobis distance difference between the synthetic data stream and the time-window time-series data in the coupled feature space to obtain the Mahalanobis distance difference value, including: Based on preset adversarial decision-making rules, the distribution center of the time-series data of the time window is determined in the coupled feature space; The deviation distance of each data point in the synthetic data stream from the distribution center in the coupled feature space is measured to obtain the original set of deviation distances; Based on a preset sensitivity coefficient matrix, the deviation distances in the original deviation distance set are weighted and corrected to generate a weighted deviation distance set; Aggregate all deviations in the weighted deviation distance set to generate Mahalanobis distance difference values.

6. The method according to claim 1, characterized in that, The process of performing spatiotemporal alignment on the abnormal vibration signal and the flow characteristic representation to obtain spatiotemporal aligned data includes: Based on the peak timestamp of the energy distribution of the abnormal vibration signal in the preset sensitive frequency band, the abrupt timestamp of the protocol jump event in the flow characteristic representation is identified; Establish a matching point pair between the peak timestamp and the mutation timestamp; Based on the time offset of the matching point pair, window sliding compensation is performed on the energy distribution of the abnormal vibration signal and the burst mode represented by the flow characteristics. The compensated energy distribution and the burst mode are merged according to the timestamp to obtain spatiotemporally aligned data.

7. A data security tracing system based on temporal adversarial generative networks, characterized in that, include: The acquisition module is used to acquire network traffic metadata from network traffic, including protocol type, data packet size and transmission interval, and to acquire the vibration signal sequence of physical cables. The first identification module is used to aggregate and encode the metadata to obtain a traffic feature representation and identify abnormal vibration signals from the vibration signal sequence; The spatiotemporal alignment module is used to perform spatiotemporal alignment on the abnormal vibration signal and the flow characteristic representation to obtain spatiotemporal aligned data. The determination module is used to determine the normal traffic baseline based on the spatiotemporal aligned data through a game mechanism between the generator and the discriminator in a temporal adversarial generative network. The second identification module is used to identify potential associated anomalies in the spatiotemporal aligned data based on the normal traffic baseline, so as to complete data security tracing and detection. The step of identifying potential correlation anomalies in the spatiotemporal aligned data based on the normal traffic baseline includes: The spatiotemporal aligned data is input into a preset anomaly detection model to extract network traffic dimension features and physical vibration dimension features, respectively. In terms of network traffic, the dynamic time warping distance between the traffic feature representation in the spatiotemporal aligned data and the normal traffic baseline is calculated to obtain the first deviation. In the dimension of physical vibration, the density gradient of the energy spectrum of the abnormal vibration signal in the spatiotemporal alignment data in the preset sensitive frequency band is detected to obtain the second deviation. By combining the first deviation and the second deviation, a cross-domain correlation deviation coefficient is generated; When the cross-domain correlation deviation coefficient exceeds a preset dynamic threshold, the corresponding data point is identified as a potential correlation anomaly.

8. A computing device, characterized in that, It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement a data security tracing method based on a temporal adversarial generative network as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that, The system contains a computer program that, when executed by a computer, implements a data security tracing method based on a temporal adversarial generative network as described in any one of claims 1 to 6.

Images