A network traffic anomaly detection method, device and medium based on a diffusion model

Abstract

The application discloses a network traffic anomaly detection method and device based on a diffusion model, and a medium, comprising: extracting and reducing the dimension of network traffic data to be detected to obtain an original time sequence feature sequence; calculating a structured distribution uncertainty corresponding to the original time sequence feature sequence; inputting the original time sequence feature sequence into a trained diffusion model to obtain a reconstructed time sequence feature sequence; wherein the process of adding noise to the original time sequence feature sequence by the diffusion model comprises: setting a disturbance based on the structured distribution uncertainty corresponding to the original time sequence feature sequence, and gradually applying the disturbance to the original time sequence feature sequence for noise addition in a forward process; calculating the mean square error between the original and reconstructed time sequence feature sequences, and the difference between the structured distribution uncertainties corresponding to the original and reconstructed time sequence feature sequences, to obtain a network traffic anomaly score; and when the network traffic anomaly score is greater than a threshold value, determining that the network traffic data to be detected is abnormal network traffic data.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security and artificial intelligence, and particularly relates to a network traffic anomaly detection method, device and medium based on a diffusion model. BACKGROUND

[0002] With the continuous acceleration of global informatization process, the Internet has become an important infrastructure for social operation and economic development. Network applications are increasingly diverse, and the user base continues to expand, leading to exponential growth in the volume, complexity and dynamics of network traffic. At the same time, network attack methods continue to evolve, from traditional viruses, Trojans, denial of service attacks (DoS / DDoS) to more covert advanced persistent threats (APT), zero-day exploit, malicious behavior in encrypted traffic, etc. Security threats are becoming diversified, intelligent and persistent. Network traffic anomaly detection, as a core part of the network security protection system, aims to identify abnormal traffic that deviates from normal behavior patterns in massive, high-dimensional, non-stationary network data, thereby achieving early warning and response to potential attack behavior.

[0003] In recent years, deep learning methods have been widely used in traffic anomaly detection, such as models based on recurrent neural networks (RNN), long short-term memory networks (LSTM), gated recurrent units (GRU), and convolutional neural networks (CNN), which can automatically extract high-dimensional time series features and improve the ability to identify complex attacks. However, existing deep learning models have poor adaptability to dynamic traffic changes. Network traffic behavior changes dynamically over time, users, and applications. Existing deep learning models mostly use fixed windows or static modeling, lack adaptive perception and model updating mechanisms for traffic evolution trends, and are difficult to adapt to the dynamic evolution of network behavior patterns in real time, resulting in detection lag, outdated models, and a large number of false positives. SUMMARY

[0004] To address the deficiencies in the prior art, the present application provides a network traffic anomaly detection method, device and medium based on a diffusion model.

[0005] In a first aspect, the present application provides a network traffic anomaly detection method based on a diffusion model, which comprises the following steps:

[0006] Feature extraction and dimensionality reduction are performed on the network traffic data to be detected to obtain an original time series feature sequence;

[0007] The structured distribution uncertainty corresponding to the original time series feature sequence is calculated;

[0008] input the original time sequence feature sequence into the trained diffusion model to obtain a reconstructed time sequence feature sequence; wherein the diffusion model processes the original time sequence feature sequence in a process including: setting a disturbance based on a structured distribution uncertainty corresponding to the original time sequence feature sequence, gradually applying the disturbance to the original time sequence feature sequence for noise adding in a forward process, and de-noising the noise-added sequence in a backward process;

[0009] calculate a mean square error between the original time sequence feature sequence and the reconstructed time sequence feature sequence, and a difference between structured distribution uncertainties corresponding to the original time sequence feature sequence and the reconstructed time sequence feature sequence, to obtain a network traffic anomaly score; when the network traffic anomaly score is greater than a threshold value, the network traffic data to be detected is determined as abnormal network traffic data.

[0010] In a second aspect, an electronic device is provided, comprising:

[0011] at least one processor; and

[0012] a memory in communication with the at least one processor; wherein

[0013] the memory stores one or more computer programs executable by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to perform the network traffic anomaly detection method based on a diffusion model described above.

[0014] In a third aspect, a computer readable storage medium is provided, which stores a computer program, and the computer program, when executed by a processor, implements the network traffic anomaly detection method based on a diffusion model described above.

[0015] In a fourth aspect, a computer program product is provided, which includes computer programs / instructions, and the computer programs / instructions, when executed by a processor, implement the network traffic anomaly detection method based on a diffusion model described above.

[0016] Compared with the prior art, the present application has the following beneficial effects:

[0017] The present application provides a network traffic anomaly detection method based on a diffusion model. The present application calculates a structured distribution uncertainty corresponding to an original time sequence feature sequence. In a forward noise adding process of the diffusion model on the original time sequence feature sequence, a disturbance is set based on the structured distribution uncertainty corresponding to the original time sequence feature sequence, and the disturbance is gradually applied to the original time sequence feature sequence for noise adding. Thus, complex and multi-scale network traffic time-dependent features can be effectively captured under unsupervised conditions, network traffic changes can be dynamically adapted, and detection of various hidden attacks can be realized, thereby improving the intelligence of network security protection. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart of a network traffic anomaly detection method based on a diffusion model provided in an embodiment of the present invention;

[0020] Figure 2 A flowchart illustrating the training process of the diffusion model provided in this embodiment of the invention;

[0021] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] It should be noted that, unless otherwise specified, the features in the following embodiments and implementation methods can be combined with each other.

[0024] like Figure 1 As shown in the figure, this embodiment of the invention provides a network traffic anomaly detection method based on a diffusion model, the method comprising:

[0025] Step S1: Perform feature extraction and dimensionality reduction on the network traffic data to be detected to obtain the original time-series feature sequence.

[0026] Specifically, in this example, feature extraction of network traffic data includes extracting one or more of the following network traffic features: flow duration, protocol type, total number of data packets, average packet length, standard deviation of packet length, inter-flow arrival time interval, and TCP flag statistics.

[0027] Furthermore, the process of dimensionality reduction of network traffic features includes: using a combination of mutual information and principal component analysis (PCA), firstly, redundant features are removed through mutual information, and then high-dimensional features are mapped to a low-dimensional space through principal component analysis.

[0028] The extracted and dimensionality-reduced network traffic features are segmented in chronological order to construct an original temporal feature sequence of length k and dimension d.

[0029] Step S2: Calculate the structured distribution uncertainty corresponding to the original time-series feature sequence.

[0030] Specifically, the structured distribution uncertainty is a weighted sum of the first, second, third, and fourth polynomials; the expression is as follows:

[0031]

[0032] In the formula, Indicates the weighting coefficient. This represents the first polynomial, i.e., the balance term. This represents the second polynomial, i.e., the rare amplification term. This represents the third polynomial, i.e., the coupling deviation term. This represents the fourth polynomial, i.e., the mutation term.

[0033] The first polynomial is obtained by calculating the product of the probability of each value of the target network traffic feature and a factor minus that probability, and then summing all the products; the expression for measuring the dispersion of the target network traffic feature is as follows:

[0034]

[0035] In the formula, This represents the probability of the i-th value of the target network traffic feature occurring, and K represents the number of different values ​​of the target network traffic feature within the current time window. The target network traffic feature is a single network traffic feature, such as a target port or protocol type.

[0036] The second polynomial is obtained by calculating the difference between the rarity threshold and the probability of each value of the target network traffic feature, and summing all the differences. This second polynomial is used to enhance the contribution of low-frequency target network traffic features to the overall uncertainty, amplifying the significance of low-frequency categories and preventing them from being overwhelmed by the overall frequency. The expression is as follows:

[0037]

[0038] In the formula, This represents the rarity threshold.

[0039] The third polynomial is obtained by calculating the absolute value of the difference between the joint distribution probability of the first dimension network traffic feature and the second dimension network traffic feature and the product of the respective marginal probabilities, and accumulating all the absolute values; the third polynomial is used to measure the deviation of the joint distribution of different network traffic feature dimensions from the independent assumption, depict the deviation from the independent assumption across domains (such as port-protocol), and capture the compatibility anomaly; the expression is as follows:

[0040]

[0041] In the formula, denotes the probability of the i-th value of the first dimension target network traffic feature appearing, denotes the probability of the i-th value of the second dimension target network traffic feature appearing, denotes the joint probability of the i-th value of the first dimension target network traffic feature and the i-th value of the second dimension target network traffic feature appearing, K denotes the number of different values of the first dimension target network traffic feature in the current time window, and K' denotes the number of different values of the second dimension target network traffic feature in the current time window.

[0042] The fourth polynomial is obtained by calculating the sum of squares of the difference between the logarithmic value of the probability of each value of the target network traffic feature in the current time window and the logarithmic value of the probability of each value of the target network traffic feature in the previous time window, and accumulating all the sums of squares; the fourth polynomial is used to measure the mutation degree of the target network traffic feature in adjacent time windows; the expression is as follows:

[0043]

[0044] In the formula, denotes the probability of the i-th value of the target network traffic feature appearing in the time window t, denotes the probability of the i-th value of the target network traffic feature appearing in the adjacent previous time window t-1, denotes a numerical stability constant.

[0045] In step S3, the original time series feature sequence is input into the trained diffusion model to obtain a reconstructed time series feature sequence; wherein the process of the diffusion model processing the original time series feature sequence includes: setting a disturbance based on the structured distribution uncertainty corresponding to the original time series feature sequence, gradually applying the disturbance to the original time series feature sequence for noise addition in the forward process, and de-noising the noise-added sequence in the backward process.

[0046] Further, the process of setting a disturbance based on the structured distribution uncertainty corresponding to the original time series feature sequence, and gradually applying the disturbance to the original time series feature sequence for noise addition in the forward process includes:

[0047] The disturbance is applied to the original time series feature sequence step by step in T time steps in the forward process, and the disturbance includes a first disturbance, a second disturbance and / or a third disturbance;

[0048] The first disturbance is an amplitude disturbance of continuous channels, that is, a zero-mean disturbance is injected into continuous features; the scale of the first disturbance is determined according to the normalized uncertainty of the current time step and the trajectory curvature; wherein the normalized uncertainty of the current time step is obtained according to the structured distribution uncertainty corresponding to the original time series feature sequence; the expression is as follows:

[0049]

[0050] In the formula, The scale of the first disturbance is represented by The minimum scale of the first disturbance is represented by The maximum scale of the first disturbance is represented by is a Sigmod function, The normalized uncertainty corresponding to the current time step is represented by The trajectory curvature is approximated by the second-order difference of the cumulative amount-time curve, And b represents a weight coefficient.

[0051] The second disturbance is a replacement or mask disturbance of discrete channels, and the second disturbance is performed according to a target probability The replacement or mask of network traffic features is performed, and the target probability Is set according to the normalized uncertainty of the current time step .

[0052] The third disturbance is to insert a short pulse according to a target amplitude, wherein the target amplitude is determined according to the normalized uncertainty of the current time step, the trajectory curvature and the conditional vector.

[0053]

[0054]

[0055] In the formula, The target amplitude of the third disturbance is represented by The minimum amplitude of the third disturbance is represented by The maximum amplitude of the third disturbance is represented by The normalized uncertainty corresponding to the current time step is represented by The trajectory curvature is approximated by the second-order difference of the cumulative amount-time curve, The statistical value of the conditional vector C is represented by The amplitude of the short pulse actually inserted at the current time step is represented by The maximum value of the short pulse amplitude is represented by

[0056] Further, in the present example, the calculation process of the condition vector C includes:

[0057] Obtaining the intra-sample statistical correlation of the original time series feature sequence;

[0058] Obtaining the soft mask m corresponding to the structured distribution uncertainty corresponding to the original time series feature sequence;

[0059] Obtaining the sequence context vector C according to the intra-sample statistical correlation of the original time series feature sequence and the soft mask seq ;

[0060] Obtaining the uncertainty context vector C according to the average value, maximum value, and standard deviation of the soft mask U* ;

[0061] Concatenating the sequence context vector and the uncertainty context vector to obtain the condition vector C = [C seq ;C U* ].

[0062] Further, the process of denoising the noisy sequence in the backward process includes:

[0063] In the reverse generation process, the current noisy sample is conditioned and denoised to predict by a conditioned restoration network ; wherein the conditioned restoration network can be a convolutional neural network, a feedforward network, a gated network, etc.

[0064] Step S4, calculating the mean square error between the original time series feature sequence and the reconstructed time series feature sequence, and the difference between the structured distribution uncertainty corresponding to the original time series feature sequence and the structured distribution uncertainty corresponding to the reconstructed time series feature sequence, to obtain a network traffic anomaly score; when the network traffic anomaly score is greater than a threshold value, it is determined that the network traffic data to be detected is abnormal network traffic data.

[0065]

[0066] wherein Score represents the network traffic anomaly score, k represents the length, d represents the dimension, represents the original element of the i-th length and the j-th dimension, represents the reconstructed element of the i-th length and the j-th dimension, represents the weight coefficient (in the present example, ), represents the structured distribution uncertainty corresponding to the original time series feature sequence X, represents the structured distribution uncertainty corresponding to the reconstructed time series feature sequence X’.

[0067] Further, as Figure 2As shown, the training process of the diffusion model includes:

[0068] In step S100, normal network traffic data is obtained, feature extraction and dimension reduction are performed on the normal network traffic data, and an original time series feature sequence is obtained.

[0069] In step S200, a structured distribution uncertainty corresponding to the original time series feature sequence is calculated.

[0070] In step S3, the original time series feature sequence is input into the diffusion model, a joint loss function is constructed, and the diffusion model is trained based on gradient descent method according to the joint loss function.

[0071] The expression of the joint loss function is as follows:

[0072]

[0073] In the formula, represents the disturbance vector applied to the sample in the forward noise adding process, represents the predicted disturbance vector of the sample after the conditional recovery network at the t-th step, t represents the time step index, and C represents the conditional vector, represents the sample after the s-th step in the reverse denoising process, t represents the time step index, C represents the conditional vector, and T represents the total number of time steps, is the lower limit of the budget of the s-th step, represents the decrease of the structured distribution uncertainty after the s-th step, OrderLoss represents an ordered loss function used to constrain the time order not to be reversed, and MassLoss is used to constrain the deviation between the original time series feature sequence and the reconstructed time series feature sequence, 、 、 represents the weight coefficient.

[0074] The expression of OrderLoss is as follows:

[0075]

[0076] In the formula, represents the intensity-normalized time series feature sequence (i.e., time-rescaling transform or cumulative intensity), and k represents the total length of the time series feature sequence, i.e., the total number of time steps in the time series feature sequence.

[0077] The expression of MassLoss is as follows:

[0078]

[0079]

[0080]

[0081]

[0082]

[0083] In the formula, And Indicates the weight coefficient, Indicates the stability constant to prevent the denominator from being zero, Indicates the mean vector of the original time sequence feature sequence, Indicates the mean vector of the reconstructed time sequence feature sequence, Indicates the standard deviation vector of the original time sequence feature sequence, Indicates the standard deviation vector of the reconstructed time sequence feature sequence, d indicates the dimension of the feature, Indicates the jth feature value of the original time sequence feature sequence at time t, Indicates the jth feature value of the reconstructed time sequence feature sequence at time t, Indicates the mean of the jth feature value of the original time sequence feature sequence at all time steps, Indicates the mean of the jth feature value of the reconstructed time sequence feature sequence at all time steps, t indicates the time step index, and k indicates the total length of the time sequence feature sequence, that is, the total number of time steps in the time sequence feature sequence.

[0084] In summary, the present application calculates the structured distribution uncertainty corresponding to the original time sequence feature sequence (taking into account the four types of signals of "balance degree-rarity-coupling deviation-time sequence mutation"); in the process of forward noise addition to the original time sequence feature sequence by the diffusion model, disturbance is set based on the structured distribution uncertainty corresponding to the original time sequence feature sequence, and adaptive composite disturbance is gradually applied to the original time sequence feature sequence for noise addition, so that the disturbance intensity changes adaptively with the uncertainty and curvature; In the backward generation process, conditional recovery is carried out, so that the recovery not only minimizes the disturbance estimation error, but also requires each step to realize the uncertainty decrease according to the budget and keep the order and statistics consistent, so as to form controllable and stable implicit time sequence constraint modeling and reconstruction ability in high-dimensional feature space; Therefore, complex and multi-scale network traffic time-dependent features can be effectively captured under unsupervised conditions, network traffic changes can be dynamically adapted, and various covert attacks can be detected, thereby improving the intelligence of network security protection. The problem that strong correlation and cross-time step global dependence exist between network traffic time sequence features and are difficult to effectively depict is solved.

[0085] Thus, without changing the input and output forms and the existing feature processing flow, the detection rate and robustness of multi-protocol, port and load scenarios are improved, false positives and false negatives are reduced, and cross-scene migration is enhanced; in the reasoning stage, a combination score of "reconstruction error + uncertainty difference" is used, taking into account the difficulty of recovery and the lack of structure simplification, to further improve the separability of abnormal and normal; the overall scheme of the application has low dependence on artificial rules and labels, and facilitates modular integration and deployment with existing network security platforms.

[0086] Correspondingly, the application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the network traffic anomaly detection method based on the diffusion model as described above. As Figure 3 As shown in the figure, a hardware structure diagram of any data processing capable device where the network traffic anomaly detection method based on the diffusion model provided by the embodiment of the application is located, in addition to the processor, the memory and the network interface shown in the figure, any data processing capable device where the device in the embodiment is usually according to the actual function of the data processing capable device, can also include other hardware, which will not be described here. Figure 3

[0087] Correspondingly, the application also provides a computer readable storage medium having computer instructions stored thereon, which are executed by a processor to implement the network traffic anomaly detection method based on the diffusion model as described above. The computer readable storage medium can be an internal storage unit of any data processing capable device, such as a hard disk or a memory. The computer readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. Further, the computer readable storage medium can include both the internal storage unit of any data processing capable device and the external storage device. The computer readable storage medium is used to store the computer program and other programs and data required by the data processing capable device, and can also be used to temporarily store data that has been output or will be output.

[0088] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice in the art to which the application pertains. The specification and examples are to be regarded as exemplary only.

[0089] ​It is to be understood that the application is not limited to the precise construction already described above and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope thereof.

Claims

1. A network traffic anomaly detection method based on diffusion model, characterized in that, The method comprises the following steps: feature extraction and dimension reduction are performed on the network traffic data to be detected to obtain an original time series feature sequence; a structured distribution uncertainty corresponding to the original time series feature sequence is calculated; the original time series feature sequence is input into a trained diffusion model to obtain a reconstructed time series feature sequence; wherein the process of the diffusion model processing the original time series feature sequence comprises: setting a perturbation based on the structured distribution uncertainty corresponding to the original time series feature sequence, gradually applying the perturbation to the original time series feature sequence for noise addition in a forward process, and de-noising the noise-added sequence in a backward process; a mean square error between the original time series feature sequence and the reconstructed time series feature sequence, and a difference between the structured distribution uncertainties corresponding to the original time series feature sequence and the reconstructed time series feature sequence, are calculated to obtain a network traffic anomaly score; when the network traffic anomaly score is greater than a threshold value, it is determined that the network traffic data to be detected is abnormal network traffic data; wherein the process of calculating the structured distribution uncertainty corresponding to the original time series feature sequence comprises: the structured distribution uncertainty is a weighted sum of a first polynomial, a second polynomial, a third polynomial, and a fourth polynomial; wherein the first polynomial is obtained by calculating the product of the probability of each value of the target network traffic feature and one minus the probability, and accumulating all products; the first polynomial is used to measure the distribution dispersion of the target network traffic feature; the second polynomial is obtained by calculating the difference between the rarity threshold and the probability of each value of the target network traffic feature, and accumulating all differences; the second polynomial is used to enhance the contribution of low-frequency target network traffic features in the overall uncertainty; the third polynomial is obtained by calculating the absolute value of the difference between the joint distribution probability of the first dimension network traffic feature and the second dimension network traffic feature and the product of their respective marginal probabilities, and accumulating all absolute values; the third polynomial is used to measure the deviation of the joint distribution of different network traffic feature dimensions from the independent assumption; the fourth polynomial is obtained by calculating the sum of squares of the difference between the logarithmic value of the probability of each value of the target network traffic feature in the current time window and the logarithmic value of the probability in the previous time window, and accumulating all sums of squares; the fourth polynomial is used to measure the mutation degree of the target network traffic feature in adjacent time windows.

2. The network traffic anomaly detection method based on diffusion model according to claim 1, characterized in that, The process of feature extraction on the network traffic data to be detected comprises: extracting network traffic features including flow duration, protocol type, total number of packets, average packet length, packet length standard deviation, inter-flow arrival time, and TCP flag bit statistics.

3. The method of claim 1, wherein, The process of setting a perturbation based on the structured distribution uncertainty corresponding to the original time series feature sequence, and gradually applying the perturbation to the original time series feature sequence for noise addition in a forward process comprises: the perturbation is gradually applied to the original time series feature sequence in T time steps in the forward process, and the perturbation comprises a first perturbation, a second perturbation, and / or a third perturbation; The first disturbance is an amplitude disturbance of a continuous channel, and a scale of the first disturbance is determined according to a normalized uncertainty of a current time step and a trajectory curvature; wherein the normalized uncertainty of the current time step is obtained according to a structured distribution uncertainty corresponding to the original time sequence feature sequence; The second disturbance is a replacement or mask disturbance of a discrete channel, and the second disturbance performs replacement or masking of network traffic features according to a target probability, and the target probability is set according to the normalized uncertainty of the current time step; The third disturbance is a short pulse inserted according to a target frequency, and the target frequency is determined according to the normalized uncertainty of the current time step, the trajectory curvature and a conditional vector.

4. The network traffic anomaly detection method based on diffusion model according to claim 3, characterized in that, The calculation process of the conditional vector includes: obtaining an intra-sample statistical correlation of the original time sequence feature sequence; obtaining a soft mask corresponding to the structured distribution uncertainty corresponding to the original time sequence feature sequence; obtaining a sequence context vector according to the intra-sample statistical correlation of the original time sequence feature sequence and the soft mask; obtaining an uncertainty context vector according to an average value, a maximum value and a standard deviation of the soft mask; splicing the sequence context vector and the uncertainty context vector to obtain the conditional vector.

5. The method of claim 1, wherein, The training process of the diffusion model includes: obtaining normal network traffic data, performing feature extraction and dimension reduction on the normal network traffic data to obtain an original time sequence feature sequence; calculating a structured distribution uncertainty corresponding to the original time sequence feature sequence; inputting the original time sequence feature sequence into the diffusion model to obtain a reconstructed time sequence feature sequence; wherein the process of the diffusion model processing the original time sequence feature sequence includes: setting a disturbance based on the structured distribution uncertainty corresponding to the original time sequence feature sequence, adding the disturbance to the original time sequence feature sequence in a forward process to add noise, and removing the noise from the sequence after adding the noise in a backward process; training the diffusion model based on gradient descent method based on a joint loss function; wherein the joint loss function is a weighted sum of a first loss function, a second loss function, a third loss function and a fourth loss function; wherein the first loss function is used to constrain a disturbance estimation error, the second loss function is used to constrain a complexity budget, the third loss function is used to constrain a time sequence non-reversal, and the fourth loss function is used to constrain a deviation between the original time sequence feature sequence and the reconstructed time sequence feature sequence.

6. The network traffic anomaly detection method based on diffusion model according to claim 5, characterized in that, The first loss function is a square of an L2 norm of a disturbance added to the original time sequence feature sequence sample in a forward process of the s-th time step, and a disturbance predicted by the conditional recovery network given the disturbed sample, a time step index t and a conditional vector at the t-th step.

7. An electronic device, comprising: comprise: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores one or more computer programs executable by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to perform the network traffic anomaly detection method based on the diffusion model according to any one of claims 1-6.

8. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by a processor, implements the diffusion model based network traffic anomaly detection method of any one of claims 1-6.

9. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instructions, when executed by a processor, implement the diffusion model based network traffic anomaly detection method of any one of claims 1-6.

Images