Network attack traffic category balancing method and system based on improved ACGAN

Abstract

The invention provides a network attack traffic category balancing method and system based on an improved ACGAN, and the method comprises the steps: carrying out the preprocessing of a network traffic data set, and obtaining a preprocessed network traffic data set; wherein the category of the network traffic data set comprises normal traffic data and attack traffic data; carrying out preliminary enhancement on the preprocessed attack traffic data by using an oversampling technology SMOTE to obtain a preliminary balanced data set; and enhancing the attack traffic data in the preliminary balanced data set by using a generative adversarial network ACGAN to obtain a final balanced data set, and completing balancing of network attack traffic categories. According to the technical scheme, the problem that extreme categories of data samples are unbalanced in the prior art is solved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method and system for balancing network attack traffic categories based on an improved ACGAN. Background Technology

[0002] With the widespread adoption of internet technology, global network traffic has experienced explosive growth. In the first half of 2024, my country's mobile internet data traffic reached 160.4 billion GB, a year-on-year increase of 12.6%. However, the expansion of web services has also exacerbated cybersecurity risks, with attacks such as SQL injection and cross-site scripting continuing to threaten the security of enterprises and users. Against this backdrop, intrusion detection systems face the core challenge of extreme class imbalance: in real-world network environments, the ratio of normal traffic to attack samples generally exceeds 10,000:1. For example, DDoS attack traffic accounts for less than 0.01%, and APT attack samples account for only one in a million. This leads to a severe bias in detection models towards the majority class, resulting in a decline in the identification capability of intrusion detection systems. Furthermore, as attack methods evolve, the model's detection capability continues to weaken, creating significant security blind spots.

[0003] Current research primarily addresses class imbalance through data-level and algorithm-level optimizations. However, existing methods are mainly applicable to scenarios with relatively low class imbalance, such as finance and healthcare, and struggle to directly meet the extreme imbalance requirements of intrusion detection. Even balancing methods specifically designed for intrusion detection typically only balance the major categories in the original dataset (such as DoS, web attacks, and brute-force attacks), failing to effectively address the more extreme imbalance problems faced by smaller, more specific categories (such as web brute-force attacks, XSS, and SQL injection within web attacks).

[0004] Therefore, this invention studies the balancing of network attack traffic under extreme category imbalance conditions. Summary of the Invention

[0005] To address the problem of extreme class imbalance, this invention proposes a network attack traffic class balancing method and system based on an improved ACGAN. It combines the traditional oversampling technique SMOTE with the generative adversarial network ACGAN to design an improved model that is more suitable for extreme class imbalance situations in intrusion detection.

[0006] To achieve the above objectives, the present invention provides the following solution: A network attack traffic category balancing method based on improved ACGAN includes: The network traffic dataset is preprocessed to obtain a preprocessed network traffic dataset; wherein, the network traffic dataset includes normal traffic data and three types of attack traffic data; the attack traffic data includes Web brute-force attack traffic data, XSS brute-force attack traffic data, and SQL injection traffic data; The preprocessed attack traffic data is then augmented using the SMOTE oversampling technique to obtain a preliminary balanced dataset. The attack traffic data in the preliminary balanced dataset is augmented using a generative adversarial network (ACGAN) to obtain the final balanced dataset, thus completing the balancing of network attack traffic categories.

[0007] Preferably, the Generative Adversarial Network (ACGAN) includes a generator, a discriminator, and a classifier, and integrates an architecture separation component, a noise optimization component, and a similarity constraint component.

[0008] Preferably, the architecture separation component is used to split the discriminator into a true / false discrimination module and a category classification module; The real / fake discrimination module is used to determine whether the input sample is a real sample or a generated sample; The category classification module is used to predict the specific category of the input sample.

[0009] Preferably, the workflow of the noise optimization component includes: The K-Means algorithm is used to cluster samples of each category, dividing samples within the same category into several clusters that meet the preset feature similarity, and the Davies-Bouldin index is used to determine the optimal number of clusters. By calculating the mean vector and covariance matrix of each cluster in each category, a corresponding multivariate Gaussian distribution model is constructed. The weights are determined based on the proportion of samples in each cluster, and noise vectors are extracted from the corresponding multivariate Gaussian distribution model based on the weights. The noise vectors are then accumulated according to the weights to obtain an optimized noise vector for each category. The optimized noise vectors of all categories are concatenated to obtain the final noise vector input to the generator.

[0010] Preferably, the similarity constraint component includes two constraint mechanisms: similarity constraint and difference constraint; wherein, the similarity constraint is used to maximize the cosine similarity between the generated sample and the real sample; and the difference constraint is used to minimize the cosine similarity between generated samples of different categories.

[0011] Preferably, the method for calculating the similarity constraint includes: Calculate the cosine similarity between the generated sample and the real sample; The feature representations of generated samples and real samples are mapped to a preset high-dimensional feature space using a high-dimensional feature mapping function. Combining the number of samples in each category and the cosine similarity between generated samples and real samples, the similarity constraints between generated samples and real samples for each category are calculated. The similarity optimization target of the generator is obtained by averaging the similarity constraints of all categories.

[0012] Preferably, the method for calculating the difference constraint includes: Calculate the cosine similarity between samples generated from different categories; The feature representations of the generated samples in each category are mapped to a preset high-dimensional feature space using a high-dimensional feature mapping function. Combining the number of generated samples in each category and the cosine similarity between generated samples from different categories, the difference constraints between generated samples for each category are calculated. The difference constraints of all category pairs are averaged to obtain the difference optimization objective of the generator.

[0013] This invention also provides a network attack traffic category balancing system based on an improved ACGAN, for implementing the method, comprising: The data acquisition module is used to preprocess the network traffic dataset to obtain a preprocessed network traffic dataset; wherein, the network traffic dataset includes normal traffic data and three types of attack traffic data; the attack traffic data includes Web brute-force attack traffic data, XSS brute-force attack traffic data, and SQL injection traffic data; The preliminary balancing module is used to perform preliminary enhancement on the preprocessed attack traffic data using the oversampling technique SMOTE to obtain a preliminary balanced dataset. The final balancing module is used to enhance the attack traffic data in the preliminary balancing dataset using a generative adversarial network (ACGAN) to obtain the final balancing dataset and complete the balancing of network attack traffic categories. The ACGAN includes a generator, a discriminator, and a classifier, and integrates an architecture separation component, a noise optimization component, and a similarity constraint component.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: The present invention provides a feasible solution to the problem of extreme class imbalance caused by the subdivision of small attack categories in the network environment, improves the quality of intrusion detection datasets, thereby enhancing the attack traffic recognition rate and effectively alleviating the dilemma of minority class attack recognition caused by extreme class imbalance. Attached Figure Description

[0015] To more clearly illustrate the technical solution of the present invention, the drawings used in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart of a network attack traffic category balancing method based on an improved ACGAN according to an embodiment of the present invention. Figure 2 This is an overall framework diagram of the HSGAN model in an embodiment of the present invention; Figure 3 This is a diagram of the overall architecture of the improved Generative Adversarial Network (ACGAN) according to an embodiment of the present invention. Figure 4 This is a framework diagram of the component separation architecture according to an embodiment of the present invention; Figure 5 This is a framework diagram of the noise optimization component based on the Gaussian mixture model in an embodiment of the present invention; Figure 6 This is a schematic diagram of cosine similarity constraints in an embodiment of the present invention; Figure 7 This is a comparison experiment result figure on the CSE-CIC-IDS 2018 dataset of this invention embodiment; Figure 8 This is a figure showing the comparative experimental results on the WKLIN-WEB-2023-n / 2 dataset in this embodiment of the invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0019] Example 1 like Figure 1 , Figure 2 As shown, the network attack traffic category balancing method based on the improved ACGAN includes: S1: Preprocess the network traffic dataset to obtain a preprocessed network traffic dataset. The network traffic dataset includes normal traffic data and three types of attack traffic data. In this embodiment, the original dataset is divided into training and testing sets in an 8:2 ratio. After preprocessing such as cleaning and data type conversion, the initial training and testing sets form an imbalanced dataset. This stage improves the representativeness of the minority class samples, providing higher-quality input data for advanced augmentation. Specifically, the network traffic dataset includes normal traffic (Benign) and three types of attack traffic: Brute Force Web, Brute Force XSS, and SQL Injection. Data augmentation is performed on these three types of attack data. In subsequent augmentation processes, the basic augmentation module SMOTE oversamples these three types of attack traffic; the advanced augmentation module's model needs to be trained, using all four types of traffic, including normal and attack traffic, during training. However, after model training, only the three types of attack traffic are sampled, thus increasing the sample size of these three attack traffic types.

[0020] S2: The preprocessed attack traffic data is then initially augmented using the SMOTE oversampling technique, adjusting the minority class to majority class sample ratio to 1:999, thus obtaining a preliminarily balanced dataset. Specifically, the initial augmentation process using SMOTE includes: First, a sample from the minority class is randomly selected, and its Euclidean distance to all other minority class samples in the feature space is calculated. Then, samples are sorted in ascending order of distance, and the k nearest neighbors are selected as the sample's k-nearest neighbors. Next, a point is randomly selected between the line connecting the sample to each of its nearest neighbors, and a new minority class sample is generated through interpolation. This process is repeated for each sample in the minority class until the ratio of minority attack class samples to majority normal traffic class samples reaches 1:999, thereby increasing the number of minority class samples and improving class imbalance.

[0021] S3: The attack traffic data in the initial balanced dataset is augmented using a Generative Adversarial Network (ACGAN) to obtain the final balanced dataset, thus balancing the network attack traffic categories. Specifically, the improved ACGAN is used to perform adversarial training on the initially balanced training set, synthesizing more high-quality minority class samples through a generator, ultimately optimizing the ratio to 1:99 to construct the balanced dataset. This stage effectively improves the data distribution, enhances the credibility and diversity of the generated samples, and provides a higher-quality balanced dataset for the subsequent training of the detection model.

[0022] A further implementation involves a Generative Adversarial Network (ACGAN) comprising a generator (G), a discriminator (D), and a classifier (C), and integrating architecture separation components, noise optimization components, and similarity constraint components. For example... Figure 3 As shown, Figure 3 middle, This represents the input training dataset. This represents the true distribution of the input data. This is the noise vector generated by the noise optimization component. Used for processing high-dimensional features, mainly for calculating cosine similarity between samples; Represents the cosine similarity constraints for each category. This is a weighted average of the cosine similarities for each category, used to optimize the generator's feedback signal, thereby guiding the generator to produce more realistic samples.

[0023] Specifically, the discriminator in the original ACGAN suffers from task conflict, needing to both determine whether the input is real or generated and classify its category. While ACGAN has certain advantages in generating conditional samples, its auxiliary classifier is prone to overfitting, failing to provide effective guidance to the generator and affecting the quality of generated samples. Furthermore, handling dual tasks within a single module can easily lead to mutual interference, resulting in unstable learning signals. Especially when the data is imbalanced, the majority class samples dominate, further weakening the generator's ability to generate high-quality minority class samples.

[0024] To address this issue, this invention designs a component-separated architecture, splitting the discriminator into a true / false discrimination module and a category classification module. The true / false discrimination module focuses on determining whether the input sample is real or generated data, while the category classification module is responsible for predicting the specific category of the sample. This separation design allows each module to be optimized independently, reducing interference between tasks and thus providing more stable and clear feedback to the generator. The specific framework is as follows: Figure 4 As shown.

[0025] A further implementation involves using an architecture separation component to split the discriminator into a true / false discrimination module and a category classification module; The real / fake discrimination module is used to determine whether the input sample is a real sample or a generated sample; The category classification module is used to predict the specific category of the input sample.

[0026] In cases of imbalanced data, this separation architecture provides the generator with a clearer direction for optimization. The generator takes into account the feedback from the true / false discrimination and classification modules to generate high-quality samples, providing data support for subsequent detection tasks.

[0027] In ACGAN, the generator takes random noise sampled from a Gaussian distribution as input, aiming to produce diverse samples. However, this noise has insufficient correlation with the real data distribution, making it difficult for the generator to accurately capture the intrinsic characteristics of the samples. Network traffic features are tabular data with a non-Gaussian distribution and complex nonlinear relationships between features. This further makes it difficult for the generator to approximate the real data distribution, while the discriminator can easily distinguish between real and generated samples, thus affecting the overall quality and diversity of the generated samples.

[0028] To address this problem, this invention proposes a noise optimization component based on a Gaussian mixture model, the structure of which is as follows: Figure 5 As shown in Table 1, this component optimizes the input noise based on the feature distribution of each category in the dataset.

[0029] A further implementation method includes the following workflow for the noise optimization component: The K-Means algorithm is used to cluster samples of each category, dividing samples within the same category into several clusters that meet the preset feature similarity, and the Davies-Bouldin index is used to determine the optimal number of clusters. By calculating the mean vector and covariance matrix of each cluster in each category, a corresponding multivariate Gaussian distribution model is constructed. Weights are determined based on the proportion of samples in each cluster. Noise vectors are then extracted from the corresponding multivariate Gaussian distribution model based on these weights, and the noise vectors are accumulated according to their weights to obtain optimized noise vectors for each category. The weights are derived from the proportion of samples. Each category will have multiple clusters, and the proportion of samples in each cluster constitutes the weight, reflecting the proportion of samples in each cluster within the corresponding category. This weight is used to represent the contribution of different clusters to noise generation during subsequent weighted noise generation. For example, if 10 noise vectors are to be extracted from a category with 2 clusters, and the proportion of samples in each cluster is the weight (0.4 and 0.6), 10 vectors are extracted from each cluster. However, during the final accumulation, the vectors extracted from the cluster with a weight of 0.4 are multiplied by 0.4, and the vectors extracted from the cluster with a weight of 0.6 are multiplied by 0.6. Then, the corresponding dimensions are accumulated to obtain 10 optimized noise vectors.

[0030] The optimized noise vectors of all categories are concatenated to obtain the final noise vector input to the generator.

[0031] Table 1

[0032] In cases of extreme class imbalance, where minority class samples are not representative enough, the noise optimization component can make the random noise input to the generator more closely resemble the distribution of the real data, thereby improving the quality of the generated samples.

[0033] Class overlap refers to the phenomenon where generated samples are mixed into the feature spaces of other classes, blurring class boundaries and increasing the difficulty for classifiers to distinguish between them. Using SMOTE to initially balance the dataset in the basic augmentation module may exacerbate this problem, thus affecting classification performance.

[0034] To address this, the present invention designs a similarity constraint component, including similarity constraints and difference constraints. The similarity constraint measures the similarity between generated samples and real samples, while the difference constraint measures the distinguishability between generated samples of different categories. The specific details of the two constraints are as follows: Figure 6 As shown. Among them, Figure 6 (a) is a schematic diagram illustrating the similarity constraints between real samples and generated samples. Figure 6 (b) is a schematic diagram of the difference constraints between samples generated from different categories.

[0035] A further implementation method is that the similarity constraint component includes two constraint mechanisms: similarity constraint and difference constraint. The similarity constraint is used to maximize the cosine similarity between the generated sample and the real sample, ensuring that the generated sample is as close as possible to the real sample. The difference constraint is used to minimize the cosine similarity between generated samples of different categories, ensuring that the generated sample has sufficient discriminative power in the feature space.

[0036] A further implementation method includes a method for calculating similarity constraints comprising: The cosine similarity between the generated sample and the real sample is calculated to measure the degree of similarity between the two sample vectors. The formula is as follows: , in, and These represent two vectors respectively.

[0037] The feature representations of generated and real samples are mapped to a predefined high-dimensional feature space using a high-dimensional feature mapping function. Combining the number of samples in each category and the cosine similarity between generated and real samples, similarity constraints between generated and real samples are calculated for each category. The similarity constraints for all categories are then averaged to obtain the generator's similarity optimization objective. Specifically, in the high-dimensional feature space, the similarity constraints between generated and real samples are calculated for each category. The calculation formula is as follows: in, Indicate category The number of samples, It is a high-dimensional feature mapping function. To generate the feature representation of the sample, corresponding Figure 6 In , This represents the features of the real sample.

[0038] After averaging the similarity constraints of all categories, the similarity optimization objective of the generator is calculated as follows: , in, The total number of categories, This indicates the similarity constraint between the generated sample and the real sample.

[0039] A further implementation method includes a method for calculating the difference constraints comprising: Calculate the cosine similarity between samples generated from different categories; The feature representations of generated samples in each category are mapped onto a pre-defined high-dimensional feature space using a high-dimensional feature mapping function. Combining the number of generated samples in each category and the cosine similarity between generated samples from different categories, a difference constraint is calculated for the generated samples in each category. Specifically, the difference constraints of all category pairs are averaged to obtain the generator's difference optimization objective. and The formula for calculating the difference constraints between generated samples is shown below: in, and For category and categories The number of generated samples, Indicate category The first in The feature representation of each generated sample, corresponding to Figure 6 In The average of the differences between all class pairs forms the difference optimization objective, which is calculated as follows: ,in, This represents the total number of category pairs.

[0040] Combining similarity and difference constraints, the final optimization objective of the generator is shown in the following formula: , A higher similarity constraint value indicates that the generated sample is closer to the real sample; conversely, a lower difference constraint value indicates that the generated samples from different categories are more distinguishable. This can be achieved by minimizing... The generator can produce samples that are both realistic and diverse.

[0041] This improvement effectively improved the distribution of generated samples: on the one hand, the generated samples are closer to real data, improving quality; on the other hand, the generated samples of different categories maintain sufficient distinguishability, effectively alleviating the problem of class overlap.

[0042] In the advanced enhancements of step S3, the loss functions for the discriminator, classifier, and generator are as follows: (1) The loss function of the discriminator: in, The target class label of the generated samples serves as an auxiliary input to the generator. In this study, the discriminator's loss is calculated using the Wasserstein distance proposed in WGAN, replacing the cross-entropy loss in traditional ACGAN, effectively mitigating the mode collapse and gradient vanishing problems.

[0043] (2) Loss function of the classifier: The classification loss for real samples is defined as: The classification loss for generating samples is defined as: , The overall loss function of the classifier is a weighted combination of the classification losses of real samples and generated samples: in, Indicates the category of the real sample. and These are weighting coefficients used to adjust the importance of the classification loss for real and generated samples. In this invention, Set to 1, Set it to 0.1.

[0044] (3) Loss function of generator: .

[0045] The generator's loss consists of four parts: the first part is the adversarial loss, where the generator attempts to maximize the discriminator's evaluation of the authenticity of the generated samples; the second part comes from the consistency constraint between the classifier's generated sample category and the real sample category; the third part comes from the classification constraint of the classifier's generated sample category label matching; and the fourth part comes from the similarity constraint component, which includes similarity and difference constraints.

[0046] Furthermore, the discriminator design draws on the spectral normalization concept from SNGAN, further enhancing the stability of generative adversarial network training. The training process of the advanced augmentation module is detailed in Table 2.

[0047] Table 2

[0048] This embodiment also includes training the detection model using the data-augmented final balanced dataset to fit the sample distribution in the final balanced dataset, thereby improving the model's ability to identify minority class attack samples. During the testing phase, an independent test set is used to evaluate the classification performance of the detection model. Preprocessed test data is input into the trained model, and the model's performance on key metrics such as classification accuracy and recall is evaluated by analyzing its detection results.

[0049] To verify the intrusion detection performance of HSGAN under extreme class imbalance, this embodiment conducts comparative experiments on public and private datasets. To comprehensively evaluate model performance, four classifiers are selected for testing, and ablation experiments are used to analyze the role of each component of HSGAN. Figure 7 , Figure 8 As shown.

[0050] To further demonstrate the effectiveness of each module and component in the HSGAN model, this embodiment selects the DT and ResNet50 models to conduct ablation experiments on public and private datasets, respectively. The results are shown in Tables 3 and 4.

[0051] HSGAN is divided into two parts: basic enhancement module and advanced enhancement module. The advanced enhancement module has three main components: ① architecture separation component, ② noise optimization component, and ③ similarity constraint component. × indicates that the module has not been applied, while √ indicates that the corresponding module or component has been added.

[0052] Table 3

[0053] Bold numbers indicate optimal performance.

[0054] Table 4

[0055] Bold numbers indicate optimal performance.

[0056] Example 2 This invention also provides a network attack traffic category balancing system based on an improved ACGAN, for implementing the method, including: The data acquisition module is used to preprocess the network traffic dataset to obtain a preprocessed network traffic dataset. The network traffic dataset includes normal traffic data and three types of attack traffic data. The attack traffic data includes Web brute-force attack traffic data, XSS brute-force attack traffic data, and SQL injection traffic data. The preliminary balancing module is used to perform preliminary enhancement on the preprocessed attack traffic data using the oversampling technique SMOTE to obtain a preliminary balanced dataset. The final balancing module is used to augment the attack traffic data in the initial balancing dataset using the Generative Adversarial Network (ACGAN) to obtain the final balancing dataset, thus balancing the network attack traffic categories. The ACGAN includes a generator, a discriminator, and a classifier, and integrates architecture separation components, noise optimization components, and similarity constraint components.

[0057] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A network attack traffic category balancing method based on improved ACGAN, characterized in that, include: The network traffic dataset is preprocessed to obtain a preprocessed network traffic dataset; wherein, the network traffic dataset includes normal traffic data and three types of attack traffic data; the attack traffic data includes Web brute-force attack traffic data, XSS brute-force attack traffic data, and SQL injection traffic data; The preprocessed attack traffic data is then augmented using the SMOTE oversampling technique to obtain a preliminary balanced dataset. The attack traffic data in the preliminary balanced dataset is augmented using a generative adversarial network (ACGAN) to obtain the final balanced dataset, thus completing the balancing of network attack traffic categories.

2. The method according to claim 1, characterized in that, The Generative Adversarial Network (ACGAN) includes a generator, a discriminator, and a classifier, and integrates an architecture separation component, a noise optimization component, and a similarity constraint component.

3. The method according to claim 2, characterized in that, The architecture separation component is used to split the discriminator into a true / false discrimination module and a category classification module; The real / fake discrimination module is used to determine whether the input sample is a real sample or a generated sample; The category classification module is used to predict the specific category of the input sample.

4. The method according to claim 3, characterized in that, The workflow of the noise optimization component includes: The K-Means algorithm is used to cluster samples of normal traffic data and three types of attack traffic data. Samples within the same category are divided into several clusters that meet the preset feature similarity, and the Davies-Bouldin index is used to determine the optimal number of clusters. By calculating the mean vector and covariance matrix of each cluster in each category, a corresponding multivariate Gaussian distribution model is constructed. The weights are determined based on the proportion of samples in each cluster, and noise vectors are extracted from the corresponding multivariate Gaussian distribution model based on the weights. The noise vectors are then accumulated according to the weights to obtain an optimized noise vector for each category. The optimized noise vectors of all categories are concatenated to obtain the final noise vector input to the generator.

5. The method according to claim 3, characterized in that, The similarity constraint component includes two constraint mechanisms: similarity constraint and difference constraint. The similarity constraint is used to maximize the cosine similarity between the generated sample and the real sample; the difference constraint is used to minimize the cosine similarity between generated samples of different categories.

6. The method according to claim 5, characterized in that, The method for calculating the similarity constraint includes: Calculate the cosine similarity between the generated sample and the real sample; The feature representations of generated samples and real samples are mapped to a preset high-dimensional feature space using a high-dimensional feature mapping function. Combining the number of samples in each category and the cosine similarity between generated samples and real samples, the similarity constraints between generated samples and real samples for each category are calculated. The similarity optimization target of the generator is obtained by averaging the similarity constraints of all categories.

7. The method according to claim 5, characterized in that, The method for calculating the difference constraint includes: Calculate the cosine similarity between samples generated from different categories; The feature representations of the generated samples in each category are mapped to a preset high-dimensional feature space using a high-dimensional feature mapping function. Combining the number of generated samples in each category and the cosine similarity between generated samples from different categories, the difference constraints between generated samples for each category are calculated. The difference constraints of all category pairs are averaged to obtain the difference optimization objective of the generator.

8. A network attack traffic category balancing system based on an improved ACGAN, used to implement the method described in any one of claims 1-7, characterized in that, include: The data acquisition module is used to preprocess the network traffic dataset to obtain a preprocessed network traffic dataset; wherein, the network traffic dataset includes normal traffic data and three types of attack traffic data; the attack traffic data includes Web brute-force attack traffic data, XSS brute-force attack traffic data, and SQL injection traffic data; The preliminary balancing module is used to perform preliminary enhancement on the preprocessed attack traffic data using the oversampling technique SMOTE to obtain a preliminary balanced dataset. The final balancing module is used to enhance the attack traffic data in the preliminary balancing dataset using a generative adversarial network (ACGAN) to obtain the final balancing dataset and complete the balancing of network attack traffic categories. The ACGAN includes a generator, a discriminator, and a classifier, and integrates an architecture separation component, a noise optimization component, and a similarity constraint component.

Images