Network traffic generation method and apparatus, computer device, and readable storage medium

Abstract

Embodiments of the present application provide a network traffic generation method and device, computer equipment and a readable storage medium. The method comprises: obtaining random noise data input into a generator of a target model to obtain a corresponding target predicted traffic image; performing inverse mapping calculation on the target predicted traffic image to obtain corresponding network traffic; the target model is obtained by performing adversarial training on the generator and a discriminator, wherein the generator is optimized by maximizing the discrimination probability of the discriminator for a sample predicted traffic image as an optimization target of the generator, and the discriminator is optimized by maximizing the discrimination probability of the discriminator for a sample real traffic image and minimizing the discrimination probability of the discriminator for the sample predicted traffic image, the sample predicted traffic image is generated by the generator based on a sample random noise, and the sample real traffic image is obtained by performing forward mapping calculation on real-time updated sample network traffic. In this way, the authenticity of the generated network traffic data can be improved.

Description

Technical Field

[0001] This application relates to the field of traffic generation technology, and in particular to a method, apparatus, computer device, and readable storage medium for generating network traffic. Background Technology

[0002] As a core infrastructure for the digital transformation of manufacturing, the Industrial Internet, while driving improvements in production efficiency, faces complex security risks and performance challenges brought about by its open and interconnected architecture. To ensure the reliability and security of industrial systems, it is urgent to construct a highly simulated network traffic environment for network security testing, protocol verification, and performance evaluation, thereby effectively supporting the security protection, performance optimization, and technological iteration needs of the Industrial Internet.

[0003] In related technologies, traffic data is generally generated using a statistical model-based approach. Specifically, this involves large-scale sampling and statistical analysis of real industrial network traffic to generate simulated traffic data that conforms to specific distribution characteristics (such as traffic volume and time intervals), which is then used to replace real traffic in test scenarios. However, traffic generated in this way often relies excessively on idealized statistical assumptions, ignoring the inherent randomness (such as sudden traffic spikes) and complex interaction characteristics (such as dynamic responses between devices) in real industrial environments. In other words, network traffic data generated in this way lacks authenticity. Summary of the Invention

[0004] This application proposes a method, apparatus, computer device, and readable storage medium for generating network traffic, which can improve the authenticity of the generated network traffic data.

[0005] To achieve the above objectives, a first aspect of this application proposes a network traffic generation method, the method comprising:

[0006] Obtain random noise data;

[0007] The random noise data is input into the generator of the target model to obtain the corresponding target predicted traffic image;

[0008] The target predicted traffic image is inversely mapped to obtain the corresponding network traffic;

[0009] The preset model includes a generator and a discriminator. The target model is obtained by adversarial training of the generator and the discriminator. The generator is optimized to maximize the discrimination probability of the discriminator for the sample predicted traffic image, and the discriminator is optimized to maximize the discrimination probability of the discriminator for the sample real traffic image and minimize the discrimination probability for the sample predicted traffic image. The sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by forward mapping calculation of the real-time updated sample network traffic.

[0010] Accordingly, a second aspect of this application provides a network traffic generation apparatus, the apparatus comprising:

[0011] The acquisition module is used to acquire random noise data;

[0012] The input module is used to input the random noise data into the generator of the target model to obtain the corresponding target predicted traffic image;

[0013] The calculation module is used to perform inverse mapping calculation on the target predicted traffic image to obtain the corresponding network traffic;

[0014] The preset model includes a generator and a discriminator. The target model is obtained by adversarial training of the generator and the discriminator. The generator is optimized to maximize the discrimination probability of the discriminator for the sample predicted traffic image, and the discriminator is optimized to maximize the discrimination probability of the discriminator for the sample real traffic image and minimize the discrimination probability for the sample predicted traffic image. The sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by forward mapping calculation of the real-time updated sample network traffic.

[0015] In some embodiments, the network traffic generation device further includes a training module for:

[0016] Obtain real-time updated sample network traffic and perform forward mapping calculation on the sample network traffic to obtain the corresponding sample real traffic image;

[0017] Obtain sample random noise, input the sample random noise into a preset model, and generate the corresponding sample predicted traffic image through the generator of the preset model;

[0018] The predicted traffic image of the sample is input into the discriminator of the preset model to obtain a first discrimination probability, and the actual traffic image of the sample is input into the discriminator to obtain a second discrimination probability;

[0019] The generator is optimized by maximizing the first discrimination probability, and the discriminator is optimized by minimizing the first discrimination probability and maximizing the second discrimination probability. The generator and the discriminator are then subjected to adversarial training to obtain the target model.

[0020] In some embodiments, the discriminator embeds a convolutional neural network module and a transformer module, with the convolutional neural network module preceding the structure of the transformer module; the training module is further configured to:

[0021] The sample predicted traffic image is input into the discriminator of the preset model. The convolutional neural network module in the discriminator extracts the spatial local features of the sample predicted traffic image to obtain the corresponding three-dimensional feature map. The three-dimensional feature map is then flattened and compressed to obtain the corresponding feature sequence.

[0022] The feature sequence is input into the transformer module, and the transformer module models the dependencies between the sequence elements contained in the feature sequence to obtain the target feature fused with the global context.

[0023] The first discrimination probability corresponding to the target feature is output through the classification output layer of the discriminator.

[0024] In some implementations, the training module is further configured to:

[0025] Based on the first discrimination probability corresponding to the sample predicted traffic image, a first generator sub-loss is constructed;

[0026] Obtain the sample reference traffic image corresponding to each sample predicted traffic image, and construct a second generator loss based on the pixel difference between the sample predicted traffic image and the corresponding sample reference traffic image, and construct a third generator loss based on the feature representation difference between the sample predicted traffic image and the sample reference traffic image;

[0027] Based on the first generator loss, the second generator loss, and the third generator loss, a first target loss is constructed, and the generator's optimization objective is to maximize the first discrimination probability by minimizing the first target loss.

[0028] A first discriminant sub-loss is constructed based on the first discrimination probability corresponding to the sample predicted traffic image, and a second discriminant sub-loss is constructed based on the second discrimination probability corresponding to the sample real traffic image;

[0029] Obtain interpolated samples between the predicted traffic image and the actual traffic image, and construct a third discriminant loss based on the gradient of the interpolated samples with respect to the discriminator;

[0030] Based on the first discriminant loss, the second discriminant loss, and the third discriminant loss, a second target loss is constructed;

[0031] By minimizing the second objective loss, the discriminator is optimized to minimize the first discrimination probability and maximize the second discrimination probability. Based on the optimization objectives of the generator and the discriminator, the generator and the discriminator are trained adversarially to obtain the target model.

[0032] In some implementations, the training module is further configured to:

[0033] When the discriminator processes the sample predicted traffic image, it obtains multiple first feature tensors output by multiple intermediate layers, and performs global average pooling on the multiple first feature tensors to obtain first intermediate features, wherein the multiple intermediate layers include convolutional layers and transformer layers.

[0034] When the discriminator processes the sample real traffic image, it obtains multiple second feature tensors output by the multiple intermediate layers, and performs global average pooling on the multiple second feature tensors to obtain second intermediate features;

[0035] Obtain the first norm corresponding to the first intermediate feature and the second norm corresponding to the second intermediate feature, and construct a third generator loss based on the difference between the first norm and the second norm.

[0036] In some implementations, the training module is further configured to:

[0037] Obtain a preset mixing coefficient and calculate the product between the mixing coefficient and the sample real traffic image to obtain the first product;

[0038] Obtain a preset reference value, and based on the difference between the preset reference value and the first product, obtain complementary weights;

[0039] The second product is obtained based on the product between the complementary weights and the sample predicted traffic image;

[0040] Based on the difference between the first product and the second product, an interpolated sample is obtained between the predicted flow image and the actual flow image.

[0041] In some implementations, the training module is further configured to:

[0042] The interpolated sample is input into the discriminator to obtain the corresponding real numerical score;

[0043] Calculate the rate of change of the real numerical score relative to the interpolated sample to obtain the target gradient;

[0044] Obtain the norm value and preset reference value corresponding to the target gradient, and construct a third discriminant loss based on the difference between the norm value and the preset reference value.

[0045] Accordingly, a third aspect of the present application provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the network traffic generation method of any one of the embodiments of the first aspect of the present application.

[0046] Accordingly, a fourth aspect of the embodiments of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network traffic generation method of any one of the embodiments of the first aspect of this application.

[0047] This application embodiment acquires random noise data; inputs the random noise data into the generator of the target model to obtain the corresponding target predicted traffic image; performs inverse mapping calculation on the target predicted traffic image to obtain the corresponding network traffic; wherein, the preset model includes a generator and a discriminator, and the target model is obtained by the preset model with the optimization objective of maximizing the discrimination probability of the discriminator for the sample predicted traffic image as the generator's optimization objective, and the optimization objective of the discriminator for maximizing the discrimination probability of the discriminator for the sample real traffic image and minimizing the discrimination probability for the sample predicted traffic image as the discriminator's optimization objective, and the generator and discriminator are trained adversarially. The sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by forward mapping calculation on the real-time updated sample network traffic. In this way, through the adversarial training mechanism of the target model, the generator can learn the complex distribution and dynamic characteristics of real industrial network traffic, and the generator can generate highly realistic network traffic data based on random noise data. Specifically, adversarial training forces the generator to continuously optimize its output to approximate the distribution of real traffic data, thereby generating highly realistic industrial network traffic. Simultaneously, adversarial training forces the discriminator to learn the high-dimensional, complex feature distribution of real traffic images, continuously refining its ability to distinguish between predicted and actual traffic images. This provides high-quality, stable gradient signals to guide the generator's optimization direction, enabling it to generate traffic images that more closely resemble real traffic images, thus improving the realism of the generated traffic and overcoming the limitations of statistical model-based methods that overly rely on idealized assumptions. In summary, this application can improve the realism of generated network traffic data, making it closer to the actual industrial network environment. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the architecture of the network traffic generation system provided in the embodiments of this application;

[0049] Figure 2 This is a flowchart of the network traffic generation method provided in the embodiments of this application;

[0050] Figure 3 This is a general flowchart of the network traffic generation method provided in the embodiments of this application;

[0051] Figure 4 This is a schematic diagram of the functional modules of the network traffic generation device provided in the embodiments of this application;

[0052] Figure 5 This is a schematic diagram of the hardware structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0056] As a core infrastructure for the digital transformation of manufacturing, the Industrial Internet, while driving improvements in production efficiency, faces complex security risks and performance challenges brought about by its open and interconnected architecture. To ensure the reliability and security of industrial systems, it is urgent to construct a highly simulated network traffic environment for network security testing, protocol verification, and performance evaluation, thereby effectively supporting the security protection, performance optimization, and technological iteration needs of the Industrial Internet.

[0057] In related technologies, traffic data is generally generated using a statistical model-based approach. Specifically, this involves large-scale sampling and statistical analysis of real industrial network traffic to generate simulated traffic data that conforms to specific distribution characteristics (such as traffic volume and time intervals), which is then used to replace real traffic in test scenarios. However, traffic generated in this way often relies excessively on idealized statistical assumptions, ignoring the inherent randomness (such as sudden traffic spikes) and complex interaction characteristics (such as dynamic responses between devices) in real industrial environments. In other words, network traffic data generated in this way lacks authenticity.

[0058] Based on this, embodiments of this application provide a network traffic generation method, apparatus, computer device, and readable storage medium, which can improve the authenticity of the generated network traffic data.

[0059] The network traffic generation method, apparatus, computer equipment, and readable storage medium provided in the embodiments of this application are specifically described through the following embodiments. First, the network traffic generation system in the embodiments of this application is described.

[0060] Please refer to Figure 1 In some embodiments, this application provides a network traffic generation system, including a terminal 11 and a server 12.

[0061] In some implementations, terminal 11 can be used for the acquisition and preprocessing of industrial network traffic data. It can be an industrial sensor, industrial control equipment, network probe, embedded device, or industrial data acquisition terminal, etc. Terminal 11 can capture raw industrial network traffic data (such as pcap format) in real time or offline and convert the raw industrial network traffic data into image representation to meet the input requirements of the model.

[0062] In some implementations, server 12 can be used to train a preset model or execute a target model. It can be a high-performance computing server, a cloud server, or an industrial AI computing platform, etc. Server 12 can receive image-based traffic data from terminal 11 and train the preset model based on random noise and image-based traffic data to obtain the target model.

[0063] Furthermore, data transmission between terminal 11 and server 12 is conducted via industrial Ethernet or secure communication protocols (such as TLS / SSL). Terminal 11 can send the collected random noise to server 12. After processing, server 12 converts the image data generated based on the random noise back into pcap format network traffic and then returns it to terminal 11.

[0064] The network traffic generation method in this application can be illustrated by the following examples.

[0065] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent will be obtained first. Furthermore, the collection, use, and processing of this data will comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user will be obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent will the necessary user-related data for the normal operation of the embodiments of this application be obtained.

[0066] In this embodiment, the description will focus on the network traffic generation device, which can be integrated into a computer device. See also... Figure 2 , Figure 2 This is a flowchart illustrating the steps of the network traffic generation method provided in this application embodiment. Taking the network traffic generation device specifically integrated into a terminal or server as an example, the specific process when the processor on the terminal or server executes the program instructions corresponding to the network traffic generation method is as follows:

[0067] Step 101: Obtain random noise data.

[0068] In some implementations, in order to enable diversity and randomness in the generation of industrial network traffic, random noise data sampled from a predefined noise distribution (such as a uniform or normal distribution) can be acquired as the initial input to the generator, thereby triggering the reasoning process of the target model, i.e., the generative adversarial network, to ensure the uniqueness of the generated traffic samples.

[0069] The random noise data can be a 100-dimensional (or other-dimensional) random vector, which is used as input to the generator to initiate the generation process of the target predicted traffic image.

[0070] In some implementations, since industrial network traffic generation requires diverse initial inputs to simulate the randomness and burstiness of real-world environments, random noise data can be obtained by sampling from a predefined noise distribution. This can be achieved by calculating the generation process of a noise vector z, where z represents a 100-dimensional random vector following a noise distribution. Specifically, Defined as uniform distribution Or a normal distribution. During computation, a random number generator (such as a pseudo-random algorithm built into the computer) is used to independently sample the value of each dimension, forming random noise data z. This provides a random seed for the generator, ensuring that the initial input covers different regions of the high-dimensional space, enabling the generator to explore a wider range of flow pattern spaces and initiate the inference process.

[0071] By using the above methods, a random starting point can be provided to drive the generator to generate realistic and diverse traffic images. This ensures that the generated industrial network traffic has a high degree of randomness, thereby providing basic support for subsequent actual traffic conversion and ultimately improving the efficiency and realism of traffic generation.

[0072] Step 102: Input random noise data into the generator of the target model to obtain the corresponding target predicted flow image.

[0073] In some implementations, in order to achieve intelligent generation of industrial network traffic, pre-acquired random noise data can be input into the generator of the target model, and feature transformation and upsampling can be performed through its multi-layer deconvolution structure and nonlinear activation function to generate a target predicted traffic image with industrial protocol characteristics.

[0074] The target model can be an adversarial learning framework based on TransDCGAN for end-to-end generation of industrial network traffic. It can be an integrated architecture including a generator and a discriminator, which is improved according to this application. Specifically, the generator can adopt the DCGAN architecture, and the discriminator can adopt a structure that combines Convolutional Neural Networks (CNN) and Transformer.

[0075] The generator can be used to map random noise vectors into industrial flow images. For example, by inputting 100-dimensional random noise data, passing through a fully connected layer, batch normalization, and three deconvolution operations, the corresponding target predicted flow image is output.

[0076] The target predicted traffic image can be a two-dimensional matrix data output by the generator, used to characterize the protocol and temporal features of the synthesized industrial traffic. For example, image data with pixel values ​​constrained to the range of [-1,1] by the Tanh activation function, which needs to be decoded by img2pcap and converted into actual network traffic (pcap format).

[0077] In some implementations, since industrial network traffic generation requires transforming random noise into a structured image with protocol semantics, feature mapping can be achieved using a generator architecture based on the target model. This can be accomplished by calculating the forward propagation process of the generator. Specifically, the generator can include fully connected layers, batch normalization layers, and deconvolution layers. The process of generating the target predicted traffic image can be as follows: First, the random noise data is projected into a high-dimensional vector (e.g., size 512×7×7) through a fully connected layer. Then, it undergoes three deconvolution operations for progressive upsampling. Each deconvolution uses a stride of 2 and a kernel size of 4, combined with the ReLU activation function (the last layer uses Tanh to match the encoding range of the real traffic image). The final output is a target predicted traffic image with a size of 1×80×56. In this way, low-dimensional random signals can be decoded into high-dimensional traffic images, thereby achieving the synthesis of industrial protocol features.

[0078] In some implementations, the generator of the target model can adopt a multi-scale generator structure, first generating a low-resolution initial predicted flow image (e.g., 40×28), and then gradually refining it to a high resolution (80×56) through a residual upsampling module to improve the realism of details, and finally obtaining the target predicted flow image.

[0079] By using the above methods, the generator's deep feature extraction capabilities can be used to transform random noise into traffic images that conform to the semantics of industrial protocols. This enables the rapid generation of traffic images that perform well in terms of realism, diversity, and protocol compatibility, facilitating industrial network security testing and performance evaluation after format conversion.

[0080] Step 103: Perform inverse mapping calculation on the target predicted traffic image to obtain the corresponding network traffic;

[0081] The preset model includes a generator and a discriminator. The target model is obtained by the preset model with the generator's optimization objective being to maximize the discriminator's discrimination probability for the sample predicted traffic image, and the discriminator's optimization objective being to maximize the discriminator's discrimination probability for the sample real traffic image and minimize the discrimination probability for the sample predicted traffic image. The generator and discriminator are trained adversarially. The sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by forward mapping calculation of the real-time updated sample network traffic.

[0082] In some implementations, in order to reconstruct network traffic data (pcap format) that conforms to industry protocol specifications (such as Modbus, Profinet), a reverse mapping calculation based on a preset decoding function can be performed on the target predicted traffic image to realize the reverse conversion of the generated traffic image to the actual network protocol, thereby completing the closed-loop conversion from the synthetic image to deployable traffic.

[0083] Among them, network traffic can be industrial protocol data packets (pcap format) restored through reverse mapping, used to simulate communication behavior in a real industrial environment. For example, it can be a binary data stream containing fields such as payload, timestamp, and protocol type, which is generated by decoding the target predicted traffic image.

[0084] The preset model can be an initial adversarial framework containing a generator and a discriminator, used to optimize traffic generation capabilities through adversarial training, such as iteratively optimizing parameters based on sample random noise and sample real traffic images during the training phase.

[0085] The discriminator can be an evaluation module that integrates CNN local feature extraction and Transformer global dependency modeling to score the realism of the input image. For example, the discriminator can output a real-valued scalar, where 0 indicates that the image is completely real and 1 indicates that the image is completely generated.

[0086] The sample predicted traffic image can be an image synthesized by the generator based on sample random noise, used for evaluation by the discriminator during the training phase.

[0087] The discrimination probability can be the discriminator's evaluation of the authenticity of the input image, used to quantify the difference between the generated sample and the true distribution.

[0088] The sample real flow image can be a two-dimensional industrial flow representation transformed by forward mapping, used to train the discriminator, for example, generated by encoding real-time updated network flow through an 80×56 pixel matrix.

[0089] The sample random noise can be a 100-dimensional vector that follows a uniform distribution, used to drive the generator to generate images that conform to the flow characteristics.

[0090] The sample network traffic can be raw data packets from an industrial environment collected in real time, used to generate real image samples needed for training through forward mapping. For example, the sample network traffic can be traffic data containing the timing of protocol interactions.

[0091] For example, a target predicted traffic image After being output by the generator (size 1×80×56, pixel values ​​constrained to the [-1,1] range by Tanh), it can be... A linear mapping from [-1, 1] to [0, 255] yields the normalized image representation as follows: , The domain of the decoding function is [0, 255]. Then, apply the following to each pixel: The specific process is as follows:

[0092] ;

[0093] in, This is the kth traffic field to be restored (such as the Modbus function code), round is the rounding function (because the protocol field is an integer), and the coordinate (i,j) corresponds to the traffic timing position.

[0094] Furthermore, by combining the decoded payload with protocol headers (such as IP / UDP headers), network traffic in pcap format can be generated.

[0095] In some implementations, the target model can be obtained through adversarial training of a pre-defined model. During adversarial training, the generator's optimization objective is to generate predicted traffic images that closely resemble the features of the actual traffic images, maximizing the discriminator's probability of classifying the predicted traffic images. The discriminator's optimization objective is to maximize the probability of classifying the actual traffic images while minimizing the probability of classifying the predicted traffic images, i.e., to distinguish between the actual traffic images and the generator-generated traffic images as much as possible. By continuously optimizing the generator and discriminator through these objectives, the training of the pre-defined model can be continuously improved. Once the pre-defined model converges, the target model can be obtained.

[0096] In some implementations, since the generation of industrial network traffic needs to ensure the authenticity, timeliness, and protocol consistency of the training data, the sample real traffic image can be obtained by forward mapping calculation of the real-time updated sample network traffic, so that the model can be trained based on the sample real traffic image. Alternatively, the sample real traffic image can also be obtained by real-time feature extraction of the replay traffic (e.g., using a lightweight LSTM network to analyze the time series mode), outputting feature vectors, and then converting them into a sample real traffic image through the forward mapping of this application; or, sample network traffic can be directly synthesized using industrial protocol specifications (e.g., Modbus standard documents); or, images can be generated by migrating from non-industrial network traffic (e.g., IT network data); or, the corresponding sample network traffic can be directly obtained from the sample dataset.

[0097] The above methods enable high-fidelity reconstruction of generated traffic images into industrial protocol data, thereby ensuring the integrity of the protocol structure and the rationality of the timing logic of the generated samples (such as Modbus request / response causal chains). This provides industrial network security testing with directly injectable dynamic traffic samples (such as simulated PLC attack traffic), facilitating subsequent high-coverage vulnerability detection and system robustness verification, and ultimately supporting the construction of an active defense system for the industrial internet.

[0098] This application embodiment acquires random noise data; inputs the random noise data into the generator of the target model to obtain the corresponding target predicted traffic image; performs inverse mapping calculation on the target predicted traffic image to obtain the corresponding network traffic; wherein, the preset model includes a generator and a discriminator, and the target model is obtained by the preset model with the optimization objective of maximizing the discrimination probability of the discriminator for the sample predicted traffic image as the generator's optimization objective, and the optimization objective of the discriminator for maximizing the discrimination probability of the discriminator for the sample real traffic image and minimizing the discrimination probability for the sample predicted traffic image as the discriminator's optimization objective, and the generator and discriminator are trained adversarially. The sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by forward mapping calculation on the real-time updated sample network traffic. In this way, through the adversarial training mechanism of the target model, the generator can learn the complex distribution and dynamic characteristics of real industrial network traffic, and the generator can generate highly realistic network traffic data based on random noise data. Specifically, adversarial training forces the generator to continuously optimize its output to approximate the distribution of real traffic data, thereby generating highly realistic industrial network traffic. Simultaneously, adversarial training forces the discriminator to learn the high-dimensional, complex feature distribution of real traffic images, continuously refining its ability to distinguish between predicted and actual traffic images. This provides high-quality, stable gradient signals to guide the generator's optimization direction, enabling it to generate traffic images that more closely resemble real traffic images, thus improving the realism of the generated traffic and overcoming the limitations of statistical model-based methods that overly rely on idealized assumptions. In summary, this application can improve the realism of generated network traffic data, making it closer to the actual industrial network environment.

[0099] In some implementations, to enable the target model to generate high-fidelity, multi-protocol compatible industrial traffic images, adversarial training can be performed on a preset model to obtain the target model, thereby addressing the problems of insufficient traffic realism, limited protocol support, and poor timeliness. For example, the target model can be trained in the following manner:

[0100] (A.1) Obtain the real-time updated sample network traffic and perform forward mapping calculation on the sample network traffic to obtain the corresponding sample real traffic image;

[0101] (A.2) Obtain sample random noise, input the sample random noise into the preset model, and generate the corresponding sample predicted flow image through the generator of the preset model;

[0102] (A.3) Input the sample predicted traffic image into the discriminator of the preset model to obtain the first discrimination probability, and input the sample real traffic image into the discriminator to obtain the second discrimination probability;

[0103] (A.4) Maximize the first discrimination probability as the optimization objective of the generator, and minimize the first discrimination probability and maximize the second discrimination probability as the optimization objective of the discriminator. The generator and discriminator are trained adversarially to obtain the target model.

[0104] The first discrimination probability can be the discriminator's evaluation scalar of the sample predicted traffic image generated by the generator. For example, the first discrimination probability can be an output value between 0 and 1, where 0 represents completely real and 1 represents completely fake. During training, the generator needs to generate sample predicted traffic images that minimize this value as much as possible to deceive the discriminator.

[0105] The second discrimination probability can be the discriminator's evaluation scalar of the sample real traffic image, used to anchor the real data distribution characteristics. During training, the discriminator needs to minimize the first discrimination probability and maximize the second discrimination probability in order to accurately distinguish between generated samples and real samples.

[0106] In some implementations, sample network traffic can be converted into two-dimensional image data. Specifically, a specific encoding method can be used to map the payload of the traffic data into a pixel matrix, with different traffic features corresponding to different color channels or image regions. This visualizes complex industrial traffic patterns as a spatially structured image representation, preserving the temporal relationships and protocol characteristics of the traffic data while making it suitable for processing by deep learning models. For example, a forward mapping calculation can be performed on real-time acquired sample network traffic (such as Modbus / TCP packets):

[0107] ;

[0108] in, The hexadecimal value of the payload is mapped to an 80×56 pixel image (value range [0,255]), preserving the spatiotemporal distribution of protocol fields (such as function code locations). Acquiring real-time updated sample network traffic ensures that the data reflects the latest industrial environment (such as new attack traffic).

[0109] In some implementations, sample network traffic can be obtained from noise distribution and input into a generator of a preset model. The generator upsamples through three deconvolutions (kernel size 4×4, stride 2) and can output a sample predicted traffic image of size 1×80×56.

[0110] Furthermore, the discriminator integrates CNN and Transformer modules. The CNN layer (with LeakyReLU activation) can extract local protocol features (such as Profinet header texture), while the Transformer layer models global dependencies (such as inter-device interaction timing) through a multi-head attention mechanism. This allows for more accurate discriminant probabilities. Sample predicted traffic images can be input into the discriminator of the pre-defined model. The discriminator outputs an evaluation value (in the real number domain) representing the difference between the generated image and the true distribution. Simultaneously, sample real traffic images can be input into the discriminator, which outputs an evaluation value to anchor the true data distribution; 0 indicates the image is completely real, and 1 indicates it is completely generated.

[0111] In some implementations, the process of adversarial training between the generator and the discriminator is as follows:

[0112] ;

[0113] in, The distribution representing real data, Let D represent the input noise distribution, G represent the discriminator, V represent the generator, and E represent the value function and expectation function. From this process, we can see that the generator's optimization objective is to generate a sample predicted traffic image based on the sample random noise as much as possible, and to maximize the first discrimination probability output by the discriminator (i.e., to adjust the generator's parameters as much as possible in the direction that the discriminator might misclassify the sample predicted traffic image as real). The discriminator's optimization objective is to maximize... To maximize the second discriminant probability (Correctly identify the real traffic image of the sample) and minimize the first discrimination probability. (Predicted traffic image of correctly identified sample) Through this adversarial game, both sides continuously optimize the parameters and finally obtain the target model that can generate high-fidelity traffic images.

[0114] By using the above methods, a dynamic game can be constructed using the discriminator's dual evaluation mechanism (first and second discrimination probabilities). This drives the generator to learn the complex distribution characteristics of industrial traffic (such as protocol interaction timing) and suppresses mode collapse through gradient penalty, thereby providing a stable training foundation for obtaining a high-quality target model. Ultimately, this achieves low-cost, high-fidelity industrial network traffic synthesis, supporting security attack and defense drills and system performance verification.

[0115] In some implementations, to address the challenge of a single model simultaneously achieving both local accuracy and global consistency, a convolutional neural network (CNN) module and a transformer module can be embedded within the discriminator. The CNN module is positioned prior to the transformer module, enabling it to efficiently extract local spatial features (such as pixel-level patterns in the protocol header) through kernel sliding computation. Meanwhile, the transformer module models long-range dependencies between sequence elements (such as temporal correlations between different regions of an image) using a self-attention mechanism. This allows for a comprehensive evaluation of the authenticity of the traffic image in both local syntax and global semantics, significantly improving the discriminator's ability to understand the complex structures of industrial protocols. For example, (A.3) may include:

[0116] (A.3.1) Input the sample predicted flow image into the discriminator of the preset model, extract the spatial local features of the sample predicted flow image through the convolutional neural network module in the discriminator to obtain the corresponding three-dimensional feature map, and flatten and compress the three-dimensional feature map to obtain the corresponding feature sequence.

[0117] (A.3.2) Input the feature sequence into the transformer module, and model the dependencies between the sequence elements contained in the feature sequence through the transformer module to obtain the target feature fused with the global context;

[0118] (A.3.3) The classification output layer of the discriminator outputs the first discrimination probability corresponding to the target feature.

[0119] The convolutional neural network module can be a CNN-based local feature extraction unit in the discriminator, used to capture the protocol syntax features of industrial flow images. For example, the convolutional neural network module can process the input image through two layers of convolutional kernels and the LeakyReLU activation function to output a three-dimensional feature map.

[0120] Among them, spatial local features can be the texture patterns of key fields of industrial protocols extracted by convolution operations, used to characterize the protocol syntax structure, such as the pixel gradient features of the Modbus function code region, which are generated by sliding calculation through convolution kernels.

[0121] Among them, the three-dimensional feature map can be a multidimensional tensor output by the convolutional neural network module after convolutional downsampling of the sample predicted traffic image, used to store the channel response of local spatial features, such as a feature matrix with C=32 channels, H'=40 height, and W'=28 width.

[0122] The feature sequence can be a one-dimensional vector sequence obtained by flattening (Flatten layer) and compressing (fully connected layer) a three-dimensional feature map, which is used as input to the transformer module. Each vector in the feature sequence corresponds to the feature representation of each image sub-region in the sample predicted traffic image.

[0123] The transformer module can be a feature fusion unit that integrates a multi-head self-attention mechanism to model global dependencies between sequence elements, such as calculating attention weights between feature vectors to capture the interactive temporal logic between industrial devices.

[0124] The sequence element can be a single feature vector in the feature sequence, used to characterize the protocol characteristics of a local region of the image, such as a vector corresponding to the EtherNet / IP packet header region, which preserves spatial information through positional encoding.

[0125] The target feature can be a high-dimensional vector of the fused global context output by the transformer, used to comprehensively characterize the semantic integrity of industrial traffic, such as a [CLS] tag vector containing protocol interaction causal relationships.

[0126] The classification output layer can be a fully connected network at the end of the discriminator, used to map target features into a scalar of discrimination probability.

[0127] In some implementations, since industrial network traffic images simultaneously contain local spatial features of protocol fields (such as pixel-level texture patterns of Modbus function codes) and global temporal dependencies of inter-device interactions (such as cross-regional correlations in Profinet periodic communication), multi-level feature extraction and comprehensive evaluation can be achieved by employing a hybrid architecture of convolutional neural networks (CNNs) and transformers. Specifically, the samples generated by the generator can be used to predict traffic images. (Size 1×H×W, where H=80, W=56, range [-1,1]) Input discriminator convolutional neural network module. The convolutional neural network module consists of two convolutional layers. The first convolutional layer uses 32 3×3 convolutional kernels with a stride of 1 and padding of 1. Through convolution operations... Extract primary features, and output a feature map with dimensions of 32×H×W; where, This represents the weight parameters of the first convolutional layer. With input Convolution is performed for feature extraction. This represents the bias parameters of the first convolutional layer. The second convolutional layer uses 64 3×3 convolutional kernels, through... Further extract high-level features and output a 3D feature map. ;in, This represents the weight parameters of the second convolutional layer. With the output of the first convolutional layer Perform convolution. This represents the bias parameters of the second convolutional layer. This represents the output feature map of the second convolutional layer. Subsequently, the 3D feature map... Flatten it to convert it into a two-dimensional matrix. Then, the feature sequence S is obtained by dimensionality compression through a fully connected layer.

[0128] Furthermore, the feature sequence S can be input into the transformer module, which includes a multi-head self-attention mechanism and a feedforward neural network. First, a query matrix is ​​obtained through a linear transformation. Key matrix Sum matrix , among which, among which , , These are learnable parameters. Therefore, attention weights can be calculated. :

[0129] ;

[0130] in, It is the scaling factor.

[0131] After layer normalization and residual connections, the output yields the target feature F fused with the global context, with its [CLS] label representing the corresponding feature vector. As a whole semantic representation of the sample predicted traffic image. Target features The input classification output layer consists of a fully connected layer and a sigmoid activation function. Ultimately, the first discriminant probability corresponding to the target feature can be obtained.

[0132] By combining the advantages of convolutional neural network modules in local feature extraction with the capabilities of transformer modules in long-range dependency modeling, a comprehensive and accurate assessment of industrial traffic images can be achieved. This provides stable and reliable discrimination signals for adversarial training, facilitating subsequent optimization of the quality and efficiency of the generation model. Ultimately, this generates highly realistic and protocol-compliant network traffic data, providing effective support for industrial network security testing.

[0133] In some implementations, to optimize the realism of the generated samples and the discriminator's ability to distinguish between genuine and fake samples, a first objective loss for the generator and a second objective loss for the discriminator can be calculated, and the optimization objectives of the generator and discriminator can be achieved by minimizing the first and second objective losses. This enables collaborative model optimization and addresses the problems of unstable training and deviation of generated samples from industrial protocol constraints in traditional GANs. For example, (A.4) may include:

[0134] (A.4.1) Construct the first generator loss based on the first discriminant probability corresponding to the sample predicted traffic image;

[0135] (A.4.2) Obtain the sample reference traffic image corresponding to each sample predicted traffic image, and construct the second generator loss based on the pixel difference between the sample predicted traffic image and the corresponding sample reference traffic image, and construct the third generator loss based on the feature representation difference between the sample predicted traffic image and the sample reference traffic image;

[0136] (A.4.3) Based on the first generator loss, the second generator loss and the third generator loss, a first target loss is constructed, and the optimization objective of the generator is to maximize the first discrimination probability by minimizing the first target loss;

[0137] (A.4.4) Construct a first discriminant sub-loss based on the first discriminant probability corresponding to the sample predicted traffic image, and construct a second discriminant sub-loss based on the second discriminant probability corresponding to the sample real traffic image;

[0138] (A.4.5) Obtain the interpolated samples between the predicted traffic image and the actual traffic image, and construct the third discriminant loss based on the gradient of the interpolated samples with respect to the discriminator;

[0139] (A.4.6) Construct the second target loss based on the first discriminant loss, the second discriminant loss, and the third discriminant loss;

[0140] (A.4.7) By minimizing the second objective loss, the discriminator is optimized to minimize the first discrimination probability and maximize the second discrimination probability. Based on the optimization objectives of the generator and the discriminator, the generator and the discriminator are trained adversarially to obtain the target model.

[0141] The first generator loss can be an adversarial loss term based on the discrimination probability of the generated samples, which is used to drive the generator to optimize the synthesis quality. By minimizing this value, the generated sample can be used to predict traffic images that can deceive the discriminator.

[0142] The sample reference flow image can be a real flow mapping image corresponding to the sample predicted flow image, used to calculate the reconstruction loss.

[0143] The second generation loss can be the pixel-level difference loss between the generated image and the reference image, used to ensure the consistency of the protocol structure.

[0144] The third generator loss can be the feature difference loss between the generated image and the reference image in the intermediate layer of the discriminator, which is used to constrain semantic consistency.

[0145] The first objective loss can be a composite optimization objective of the generator, used to comprehensively balance adversarial behavior and fidelity. The generator parameters can be updated via backpropagation based on this first objective loss.

[0146] The first discriminant loss can be the discriminator's evaluation loss of the generated samples, used to quantify the falsity of the generated samples. Minimizing the first discriminant loss can make the discriminator more accurately identify the synthetic samples.

[0147] The second discriminant loss can be the discriminator's evaluation loss on real samples, used to strengthen the learning of the real distribution. Minimizing the first discriminant loss can make the discriminator more confident in the real traffic image of the samples.

[0148] The interpolated sample can be a linear mixture of the predicted flow image and the actual flow image, used for gradient penalty calculation.

[0149] The third discriminant loss can be a penalty term based on the gradient norm of the interpolated samples.

[0150] The second objective loss can be a composite optimization objective of the discriminator, used to balance authenticity identification and stability.

[0151] In some implementations, since the generator needs to generate a sample predicted traffic image that matches the distribution of the actual traffic image, a first generator sub-loss (also known as adversarial loss) can be constructed by using the discriminant probability of the sample predicted traffic image (i.e., the image output by the generator) to determine the discriminant probability. The representation of can be as follows:

[0152] ;

[0153] in, It is a sample prediction traffic image generated by the generator based on the random noise of the samples. This represents the distribution of the sample predicted traffic image, that is, the probability distribution of all possible images output by the generator. It is the real-valued score output by the discriminator for the sample predicted flow image (without Sigmoid activation to support the Wasserstein distance metric), representing the confidence that the sample predicted flow image is true. This represents the set of parameters for the discriminator. By minimizing the first generator loss, the generated samples can achieve a higher discrimination probability, i.e., a probability closer to the true distribution.

[0154] To further improve the consistency between the generated image and the real image at the pixel and semantic levels, a second generation sub-loss (reconstruction loss) and a third generation sub-loss (feature matching loss) can be constructed. The second generation sub-loss... Traffic flow images can be predicted by calculating samples. Comparison with the corresponding sample reference flow image The pixel-level differences between (the actual traffic flow images corresponding to the sample random noise) are obtained and represented as The third generator loss is obtained by comparing the predicted flow images of the samples. Corresponding sample real flow image The discriminator is constructed by using the feature representation differences in the intermediate layer, represented as follows: ,in This represents the output feature of a certain intermediate layer of the discriminator. Finally, the generator's first target loss... Weighted sum of the three:

[0155] ;

[0156] in, and Using preset weight coefficients, the generator's optimization objective can be achieved by minimizing the first objective loss. By constructing the first objective loss, the realism, pixel-level accuracy, and high-level semantic consistency of the generated image can be comprehensively optimized, thereby improving the quality and protocol compliance of the generated traffic image, facilitating its subsequent conversion into usable industrial network traffic data.

[0157] For example, in addition to using mean squared error (MSE) to calculate reconstruction loss and feature matching loss, the Structure Similarity Index Measure (SSIM) or feature distance based on pre-trained networks (such as the LPIPS method) can be used to measure image similarity to better maintain the structural and semantic consistency of generated images.

[0158] In some implementations, the discriminator needs to accurately distinguish between the predicted flow images and the actual flow images, while satisfying Lipschitz continuity to ensure training stability. Therefore, the discriminator can be used to analyze the predicted flow images. The scoring constructs the first discriminant loss. :

[0159] ;

[0160] Furthermore, a second discriminant loss is constructed by scoring the sample's real traffic images. :

[0161] ;

[0162] Next, the deviation of the discriminator's gradient norm from 1 is calculated as the third discriminant loss. :

[0163] ;

[0164] in, This represents the interpolated sample between the predicted flow image and the actual flow image.

[0165] Finally, the discriminator's second target loss is:

[0166] ;

[0167] in, The gradient penalty coefficient is used to optimize the discriminator by minimizing the second objective loss. This approach ensures that the discriminator maintains gradient stability while effectively distinguishing between predicted and actual traffic images, thus promoting balanced convergence in generative adversarial training and facilitating the acquisition of a high-performance target model.

[0168] In some implementations, the generator and discriminator are trained adversarially by alternately optimizing their target loss functions. Specifically, in each training iteration, the generator parameters are first fixed, and the discriminator's second target loss is minimized to update the discriminator; then, the discriminator parameters are fixed, and the generator's first target loss is minimized to update the generator. After multiple iterations, the generator can generate samples that are highly consistent with the distribution of real traffic images, and the discriminator has accurate discrimination capabilities. When the preset model reaches the convergence condition, such as when the preset model has been trained a preset number of times (e.g., 10,000 times), a target model that can be used for industrial network traffic generation is finally obtained.

[0169] In some implementations, besides generating predicted traffic images by deconvolving random noise samples with a generator, a conditional generation mechanism can be introduced. Specifically, during the training of a pre-defined model, industrial protocol types (such as Modbus / TCP) can be embedded as labels into the noise vector. Conditional batch normalization adjusts the feature mapping, enabling the generator-generated predicted traffic images to target specific protocol semantics. After training the target model, the industrial protocol type can also be embedded as a label into the noise vector when inputting random noise data, ensuring that the final generated predicted traffic image targets specific protocol semantics.

[0170] In some implementations, a fourth generator loss for the generator can also be calculated by computing the protocol semantic difference between the sample predicted traffic image and the sample real traffic image. Specifically, the sample predicted traffic image can be used to calculate the protocol semantic difference between the sample predicted traffic image and the sample real traffic image. Compared with the sample real flow image Through the reverse mapping function respectively Restored to the corresponding network traffic data, sample predicted traffic image correspond Sample real flow image correspond Subsequently, a protocol feature extractor (such as a Modbus protocol-specific feature extraction module that can parse function codes, address fields, data fields, etc.) is used to extract key protocol features from the two types of traffic data, obtaining their respective feature vectors. and Finally, based on the differences between the two, a fourth generator loss is constructed, the calculation formula of which can be expressed as:

[0171] ;

[0172] Alternatively, the cross-entropy loss commonly used in classification tasks can be adopted (if the protocol field is a discrete value). This application does not limit the specific calculation method.

[0173] In some implementations, a first target loss can be constructed based on the first generator loss, the second generator loss, the third generator loss, and the fourth generator loss to train and optimize the generator. Alternatively, during the calculation of the first target loss, corresponding weights can be assigned to the first generator loss, the second generator loss, the third generator loss, and the fourth generator loss, and then they are summed to obtain the first target loss.

[0174] Through the above methods, the collaborative adversarial optimization of the generator and discriminator can be achieved, thereby obtaining a target model that can generate high-quality, highly realistic industrial network traffic images, which is convenient for application in security testing, performance evaluation and protocol verification of industrial networks.

[0175] In some implementations, to achieve protocol semantic consistency constraints for generated traffic, the first feature tensor output by the intermediate layers (such as convolutional layers and transformer layers) of the discriminator when processing the sample predicted traffic image can be obtained, and global average pooling can be performed on it to generate the first intermediate feature. Simultaneously, the second feature tensor corresponding to the sample real traffic image can be obtained and pooled to generate the second intermediate feature. Then, a third generator sub-loss is constructed based on the norm difference between the two (such as L1 norm difference) to force the generator to learn the deep semantic patterns (such as protocol interaction logic) of the real traffic, thereby improving the protocol compliance and structural fidelity of the generated traffic. For example, "constructing the third generator sub-loss based on the feature representation difference between the sample predicted traffic image and the sample reference traffic image" in (A.4.2) can include:

[0176] (A.4.2.1) Obtain multiple first feature tensors output by multiple intermediate layers when the discriminator processes the sample predicted traffic image, and perform global average pooling on multiple first feature tensors to obtain the first intermediate features, wherein the multiple intermediate layers include convolutional layers and transformer layers.

[0177] (A.4.2.2) Obtain multiple second feature tensors output by multiple intermediate layers when the discriminator processes the sample real traffic image, and perform global average pooling on multiple second feature tensors to obtain the second intermediate features;

[0178] (A.4.2.3) Obtain the first norm corresponding to the first intermediate feature and the second norm corresponding to the second intermediate feature, and construct the third generator loss based on the difference between the first norm and the second norm.

[0179] The intermediate layer can be a layered module in the discriminator used for feature extraction, including a convolutional layer (located inside the convolutional neural network module) and a transformer layer (located inside the transformer module), used to progressively abstract the local and global features of the industrial flow image.

[0180] The first feature tensor can be a multidimensional data matrix output by the transformer layer of the convolutional neural network module and / or the discriminant module when processing sample prediction traffic images, and is used to store the feature response in the space-channel dimension.

[0181] The first intermediate feature can be a one-dimensional vector compressed from the first feature tensor by global average pooling, used to characterize the semantic summary of the sample predicted traffic image.

[0182] Among them, the convolutional layer can be a local feature extraction layer contained in the convolutional neural network in the discriminator, used to capture the spatial local features of the industrial protocol field (such as the texture of the Modbus function code region).

[0183] The transformer layer can be a global dependency modeling layer in the transformer module of the discriminator, used to parse long-distance interaction relationships between sequence elements (such as inter-device communication timing).

[0184] The second feature tensor can be a multidimensional data matrix output from the intermediate layer when the discriminator processes the sample real traffic image. It is used to store the feature distribution of the real sample, such as a tensor of the same size as the first feature tensor, which is generated in real time by forward propagation.

[0185] The second intermediate feature can be a one-dimensional vector compressed from the second feature tensor by global average pooling, used to anchor the semantic benchmark of the sample's real traffic image.

[0186] The first norm can be the L1 norm (sum of absolute values) of the first intermediate feature, used to quantify the semantic feature strength of the sample predicted traffic image.

[0187] The second norm can be the L1 norm of the second intermediate feature, used to quantify the semantic feature benchmark of the sample real traffic image.

[0188] In some implementations, since industrial traffic generation needs to ensure that the synthesized data is consistent with the real traffic in terms of multi-level protocol features, the protocol semantic constraints of the generator can be enhanced by employing a multi-level feature matching loss (i.e., a third generator loss). This can be achieved through the following computational process:

[0189] For example, sample prediction traffic images can be used. (Generator Output) Input the discriminator D to obtain the set of first feature tensors output from its multiple intermediate layers (including convolutional layers and transformer layers), and perform global average pooling on the first feature tensor of each intermediate layer to obtain the corresponding first intermediate sub-features. Concatenate these sub-features to obtain the first intermediate feature. .

[0190] Similarly, the actual traffic flow image of the sample can be used. Input discriminator D, obtain the set of second feature tensors output by its multiple intermediate layers (including convolutional layers and transformer layers), and perform global average pooling on the second feature tensors of each intermediate layer to obtain the corresponding second intermediate features. .

[0191] Furthermore, for each intermediate layer, the norm difference between the corresponding first intermediate feature and the second intermediate feature can be calculated, and the expected values ​​of multiple norm differences corresponding to multiple intermediate layers can be calculated to obtain the third generator loss. The specific formula is as follows:

[0192] ;

[0193] in, This represents a sample predicted flow image. This represents the actual flow rate image of the sample. This represents a certain intermediate layer output feature of the discriminator.

[0194] By using the above methods, the norm difference loss can be calculated based on the multi-level feature abstraction of the discriminator's intermediate layer (local syntax of the convolutional layer and global semantics of the transformer layer). In this way, the sample predicted traffic image generated by the generator is forced to approximate the protocol distribution of the sample real traffic image (such as the EtherNet / IP packet header structure) in the feature space. This provides regularization constraints for the subsequent generation of high-fidelity target predicted traffic images with low protocol logic errors, and ultimately supports the accurate simulation of complex attack scenarios and the verification of system robustness in industrial network security testing.

[0195] In some implementations, to achieve efficient generation of interpolated samples to support gradient penalty calculation of the discriminator, preset mixing coefficients can be obtained, and their product with the sample real traffic image can be calculated to obtain a first product. Complementary weights are obtained based on the difference between a preset reference value (such as a constant 1) and the first product. The product of the complementary weights and the sample predicted traffic image is then calculated to obtain a second product. The interpolated sample is obtained by summing the first and second products to provide the mixed data points required for gradient calculation, thereby ensuring the Lipschitz continuity constraint of the discriminator. "Obtaining interpolated samples between the sample predicted traffic image and the sample real traffic image" in (A.4.5) may include:

[0196] (A.4.5.a1) Obtain the preset mixing coefficients and calculate the product between the mixing coefficients and the sample real traffic image to obtain the first product;

[0197] (A.4.5.a2) Obtain a preset reference value, and based on the difference between the preset reference value and the first product, obtain complementary weights;

[0198] (A.4.5.a3) The second product is obtained based on the product between the complementary weights and the sample predicted traffic image;

[0199] (A.4.5.a4) Based on the difference between the first product and the second product, an interpolated sample is obtained between the predicted flow image and the actual flow image.

[0200] The mixing coefficient can be a preset random scalar value used to control the weight ratio of the sample real traffic image in the interpolation.

[0201] The first product can be the result of a scalar multiplication of the mixing coefficients and the sample real flow image, used to represent the weighted component of the real sample in the interpolation.

[0202] The preset reference value can be a constant 1, which is used as a benchmark value for calculating complementary weights. For example, it can be directly defined as a fixed value of 1, without the need for external input or calculation, and serves as a reference point for difference calculation.

[0203] The complementary weight can be the difference between a preset reference value and the first product, used to represent the complementary weight ratio of the sample predicted traffic image in the interpolation.

[0204] The second product can be the result of a scalar multiplication of complementary weights and the sample predicted flow image, used to represent the weighted components of the generated sample in the interpolation.

[0205] In some implementations, the gradient norm of the discriminator can be computed in the linear interpolation space to constrain its Lipschitz continuity. Specifically, interpolation samples between the predicted flow rate image and the actual flow rate image can be generated using a linear interpolation method. The specific generation process is as follows:

[0206] ;

[0207] in, Represents the mixing coefficient. The first product represents the actual traffic flow image of the sample; the preset reference value is 1, and the difference between the preset reference value and the first product is the complementary weight; the complementary weight and the predicted traffic flow image of the sample... product This is the second product; the final interpolated sample can be obtained by summing the first and second products.

[0208] In some implementations, due to the fixed mixing coefficient of random sampling It is difficult to consistently generate interpolation samples that are most challenging for the discriminator. Therefore, the training effect of gradient penalty can be improved by employing a learnable mixture coefficient dynamic optimization method. Specifically, the mixture coefficients can be randomly sampled from a uniform distribution. Redefining them as learnable parameters and dynamically optimizing them using gradient ascent. To maximize the third discriminant loss of the discriminator (That is, gradient penalty loss), thereby actively seeking the difficult interpolation point that causes the discriminator's gradient norm to deviate most severely from 1, improving the penalty effect, and gradually optimizing to obtain the optimal mixing coefficient. In this way, we can first find the weaknesses of the model and then strengthen the training in a targeted manner. This is more efficient than the traditional WGAN-GP, which passively waits for random sampling of effective samples. It can guide the discriminator to satisfy the global Lipschitz continuity condition more quickly, and ultimately improve the stability and effectiveness of the entire adversarial training.

[0209] It should be noted that maximizing the loss is a generation strategy for the training data (interpolated samples), not a training strategy for the model. This approach is used to optimize the mixing coefficients so that the generated interpolated samples... This is precisely where the discriminator is most uncomfortable and least able to satisfy the Lipschitz constraint (i.e., the gradient norm deviates significantly from 1). At this point, all model weights of the discriminator D and generator G are fixed and do not participate in the update; only the mixing coefficients are updated through gradient ascent, thus fixing the mixing coefficients. After that, adversarial training can be resumed to train the generator and discriminator, and finally the target model can be obtained.

[0210] By using the above methods, linear interpolated samples between real and synthetic traffic images can be generated. Based on these samples, the third discriminant loss of the discriminator can be calculated, thereby forcing the discriminator to satisfy 1-Lipschitz continuity, avoiding training divergence and mode collapse, and ultimately improving the stability of adversarial training and the protocol compliance of generated traffic, which facilitates the subsequent construction of a highly robust industrial traffic generation model.

[0211] In some implementations, to achieve the Lipschitz continuity constraint of the discriminator, the target gradient can be obtained by inputting interpolated samples into the discriminator's output real-valued score, calculating the rate of change of this score relative to the interpolated samples, and then constructing a third discriminant loss based on the difference between the norm of the target gradient and a preset reference value (such as a constant 1). This forces the discriminator gradient to stabilize near the unit norm, thereby avoiding gradient explosion or vanishing problems during training. For example, (A.4.5) may also include:

[0212] (A.4.5.b1) Input the interpolated sample into the discriminator to obtain the corresponding real numerical score;

[0213] (A.4.5.b2) Calculate the rate of change of the real numerical fractions relative to the interpolated samples to obtain the target gradient;

[0214] (A.4.5.b3) Obtain the norm value and preset reference value corresponding to the target gradient, and construct the third discriminant loss based on the difference between the norm value and the preset reference value.

[0215] Among them, the real numerical score can be the output scalar of the discriminator for the interpolated sample, which is used to quantify the degree of authenticity of the sample.

[0216] The target gradient can be a vector of partial derivatives of the real-valued fraction with respect to the interpolated sample, used to characterize the local rate of change of the discriminator output.

[0217] In some implementations, since the training stability of Wasserstein GAN depends on the discriminator satisfying the 1-Lipschitz continuity condition, and traditional methods such as weight pruning can significantly limit model capacity and lead to gradient anomalies, this application adopts a gradient penalty method to softly constrain the local gradient characteristics of the discriminator in order to improve training stability, suppress mode collapse and ensure the Lipschitz continuity of the discriminator.

[0218] Specifically, the interpolation samples can be... The input is fed into the discriminator to obtain the corresponding real-valued score. The score represents the discriminator's confidence assessment that the input interpolated sample comes from the true distribution, and its range is the real number field (if no Sigmoid activation is used) or the interval [0,1] (if Sigmoid activation is used).

[0219] Furthermore, it can be calculated Relative to interpolated samples The rate of change, i.e., the target gradient This gradient can be used to characterize the sensitivity of the discriminator's output to small changes in the input samples. Then, the gradient corresponding to the target gradient is obtained. The norm value is calculated by taking the square root of the sum of the squares of all gradient components and a preset reference value of 1 (used to enforce the 1-Lipschitz constraint), and a third discriminant loss (i.e., gradient penalty loss) is constructed based on the difference between the two. :

[0220] ;

[0221] in, It is the distribution of the interpolated samples. This represents the interpolated sample between the predicted traffic image and the actual traffic image. The third discriminant loss can ensure that the discriminator function satisfies local Lipschitz continuity by penalizing deviations of the gradient norm from 1.

[0222] By employing the above methods, the local Lipschitz continuity of the discriminator at the interpolated samples can be precisely constrained, thereby avoiding the model capacity reduction and training instability problems caused by weight pruning. This ensures the effectiveness of Wasserstein distance estimation and the convergence of the training process, facilitating the subsequent generator to obtain more stable and effective gradient signals, and ultimately producing high-quality industrial network traffic data that is protocol compliant and structurally realistic.

[0223] Please refer to Figure 3 Below, in conjunction with Figure 3 The overall embodiments of this application are described below. Specifically, this embodiment mainly includes a training phase and a traffic generation phase. In the training phase, a target model is obtained through adversarial training; in the traffic generation phase, highly realistic network traffic data is generated using the trained target model.

[0224] Furthermore, during the training phase, real-time updated sample network traffic (such as Modbus / TCP or Profinet packets in an industrial environment) is first obtained from the original dataset and converted into a sample real traffic image using a forward mapping function (pcap2img). The sample real traffic image has a size of 1×H×W (where H and W are the height and width of the image, for example, H=80, W=56), and its pixel values ​​are normalized to preserve the spatiotemporal distribution characteristics of the protocol fields.

[0225] Simultaneously, the generator receives sample random noise (e.g., 100-dimensional) from a predefined noise distribution (such as a uniform or normal distribution). This noise data is first converted into a 512-dimensional vector through a fully connected layer, and then reshaped into a 512×(H / 8)×(W / 8) feature map through a dimension transformation operation (e.g., when H=80, W=56, H / 8=10, W / 8=7, and the feature map size is 512×10×7). Next, the generator progressively upsamples the feature map through three deconvolution operations (each deconvolution uses a 4×4 kernel with a stride of 2, and is coupled with the ReLU activation function), finally outputting a sample predicted traffic image with the same size as the sample real traffic image, which is 1×H×W (e.g., 1×80×56). The last layer of the generator uses the Tanh activation function to constrain the pixel values ​​within the range [-1,1] to match the encoding specifications of the real traffic image.

[0226] For example, the discriminator employs an architecture that fuses a convolutional neural network (CNN) module with a transformer module to evaluate the realism of the input image. The sample predicted traffic image and the sample real traffic image are input into the discriminator: First, the image is processed through two convolutional layers. The first convolutional layer uses 128 3×3 convolutional kernels (stride 1, padding 1), outputting a feature map of size 128×H×W. The second convolutional layer further extracts features, outputting a feature map of size 128×(H / 4)×(W / 4) (e.g., when H=80, W=56, H / 4=20, W / 4=14, resulting in a feature map size of 128×20×14). This feature map is flattened and then compressed into a 512-dimensional feature sequence through a fully connected layer. Subsequently, the feature sequence is input into the Transformer module, which models the global dependencies between sequence elements using a multi-head self-attention mechanism to obtain the target features fused with the global context. Finally, the discriminator outputs the discrimination probabilities through its classification output layer (fully connected layer and sigmoid activation function), where the first discrimination probability corresponds to the sample predicted traffic image and the second discrimination probability corresponds to the sample actual traffic image.

[0227] Understandably, during adversarial training, the generator's optimization objective is to maximize the discriminator's first discrimination probability for the predicted traffic image, while the discriminator's optimization objective is to maximize the second discrimination probability for the real traffic image and minimize the first discrimination probability for the predicted traffic image. Both devices alternately optimize by minimizing their respective objective loss functions (the generator's first objective loss and the discriminator's second objective loss) until the preset model converges, yielding the target model. During training, the generator and discriminator continuously improve through adversarial game; the generator learns the complex distribution characteristics of real traffic, while the discriminator enhances its ability to distinguish between real and fake traffic, thus ensuring high realism and protocol compatibility of the generated traffic.

[0228] Furthermore, during the traffic generation stage, new random noise data (sampling from a predefined noise distribution, with a dimension of 100) can be acquired and input into the generator of the target model. The generator converts the random noise data into a target predicted traffic image with a size of 1×H×W (e.g., 1×80×56) through the same path described above (fully connected layer, dimension transformation, and three deconvolution operations). Subsequently, the target predicted traffic image undergoes inverse mapping calculation (img2pcap) to restore it to actual network traffic data (pcap format). The inverse mapping process involves linearly mapping image pixel values ​​from [-1,1] to [0,255] and decoding them into a binary data stream according to protocol specifications (such as Modbus or Profinet), ultimately generating network traffic that can be directly used for industrial network security testing, performance evaluation, or protocol verification.

[0229] Through the above embodiments, this application utilizes an adversarial training mechanism to enable the generator to learn the dynamic characteristics and complex distribution of real industrial network traffic. The generated network traffic data has high authenticity and protocol compliance, overcoming the limitations of traditional generation methods that rely on idealized assumptions.

[0230] This application embodiment acquires random noise data; inputs the random noise data into the generator of the target model to obtain the corresponding target predicted traffic image; performs inverse mapping calculation on the target predicted traffic image to obtain the corresponding network traffic; wherein, the preset model includes a generator and a discriminator, and the target model is obtained by the preset model with the optimization objective of maximizing the discrimination probability of the discriminator for the sample predicted traffic image as the generator's optimization objective, and the optimization objective of the discriminator for maximizing the discrimination probability of the discriminator for the sample real traffic image and minimizing the discrimination probability for the sample predicted traffic image as the discriminator's optimization objective, and the generator and discriminator are trained adversarially. The sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by forward mapping calculation on the real-time updated sample network traffic. In this way, through the adversarial training mechanism of the target model, the generator can learn the complex distribution and dynamic characteristics of real industrial network traffic, and the generator can generate highly realistic network traffic data based on random noise data. Specifically, adversarial training forces the generator to continuously optimize its output to approximate the distribution of real traffic data, thereby generating highly realistic industrial network traffic. Simultaneously, adversarial training forces the discriminator to learn the high-dimensional, complex feature distribution of real traffic images, continuously refining its ability to distinguish between predicted and actual traffic images. This provides high-quality, stable gradient signals to guide the generator's optimization direction, enabling it to generate traffic images that more closely resemble real traffic images, thus improving the realism of the generated traffic and overcoming the limitations of statistical model-based methods that overly rely on idealized assumptions. In summary, this application can improve the realism of generated network traffic data, making it closer to the actual industrial network environment.

[0231] Please see Figure 4 This application also provides a network traffic generation device that can implement the above-described network traffic generation method. The network traffic generation device includes:

[0232] Acquisition module 41 is used to acquire random noise data;

[0233] Input module 42 is used to input random noise data into the generator of the target model to obtain the corresponding target predicted flow image;

[0234] Calculation module 43 is used to perform inverse mapping calculation on the target predicted traffic image to obtain the corresponding network traffic;

[0235] The preset model includes a generator and a discriminator. The target model is obtained by the preset model with the generator's optimization objective being to maximize the discriminator's discrimination probability for the sample predicted traffic image, and the discriminator's optimization objective being to maximize the discriminator's discrimination probability for the sample real traffic image and minimize the discrimination probability for the sample predicted traffic image. The generator and discriminator are trained adversarially. The sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by forward mapping calculation of the real-time updated sample network traffic.

[0236] The specific implementation of this network traffic generation device is basically the same as the specific embodiment of the network traffic generation method described above, and will not be repeated here. Subject to meeting the requirements of the embodiments of this application, the network traffic generation device may also be equipped with other functional modules to implement the network traffic generation method described above.

[0237] This application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described network traffic generation method. This computer device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0238] Please see Figure 5 , Figure 5 The hardware structure of a computer device according to another embodiment is illustrated. The computer device includes:

[0239] The processor 51 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0240] The memory 52 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 52 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 52 and is called and executed by the processor 51 using the network traffic generation method of the embodiments of this application.

[0241] Input / output interface 53 is used to implement information input and output;

[0242] The communication interface 54 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0243] Bus 55 transmits information between various components of the device (e.g., processor 51, memory 52, input / output interface 53, and communication interface 54);

[0244] The processor 51, memory 52, input / output interface 53, and communication interface 54 are connected to each other within the device via bus 55.

[0245] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described network traffic generation method.

[0246] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0247] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0248] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0249] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0250] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0251] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0252] It should be understood that in this application, "at least one" and "several" refer to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0253] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0254] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0255] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0256] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0257] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A network traffic generation method, characterized by, The method comprises: acquiring random noise data; inputting the random noise data into a generator of a target model to obtain a corresponding target predicted traffic image; performing inverse mapping calculation on the target predicted traffic image to obtain corresponding network traffic; wherein the preset model comprises a generator and a discriminator, the target model is obtained by performing adversarial training on the generator and the discriminator, taking maximizing a discrimination probability of the discriminator for a sample predicted traffic image as an optimization objective of the generator, and taking maximizing the discrimination probability of the discriminator for a sample real traffic image and minimizing the discrimination probability for the sample predicted traffic image as an optimization objective of the discriminator, the sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by performing forward mapping calculation on real-time updated sample network traffic; the target model is obtained by the following method: acquiring real-time updated sample network traffic, and performing forward mapping calculation on the sample network traffic to obtain corresponding sample real traffic images; acquiring sample random noise, inputting the sample random noise into a preset model, and generating corresponding sample predicted traffic images by a generator of the preset model; inputting the sample predicted traffic images into a discriminator of the preset model to obtain a first discrimination probability, and inputting the sample real traffic images into the discriminator to obtain a second discrimination probability; taking maximizing the first discrimination probability as an optimization objective of the generator, and taking minimizing the first discrimination probability and maximizing the second discrimination probability as an optimization objective of the discriminator, to perform adversarial training on the generator and the discriminator to obtain a target model.

2. The network traffic generation method of claim 1, wherein, The discriminator is embedded with a convolutional neural network module and a transformer module, and the convolutional neural network module is located in the structure front sequence of the transformer module. The inputting of the sample predicted traffic image into the discriminator of the preset model to obtain the first discrimination probability comprises: inputting the sample predicted traffic image into the discriminator of the preset model, extracting spatial local features of the sample predicted traffic image through the convolutional neural network module in the discriminator to obtain a corresponding three-dimensional feature map, and performing flattening and compression processing on the three-dimensional feature map to obtain a corresponding feature sequence; inputting the feature sequence into the transformer module, and modeling the dependency relationship between each sequence element contained in the feature sequence through the transformer module to obtain a target feature fused with global context; outputting the first discrimination probability corresponding to the target feature through the classification output layer of the discriminator.

3. The network traffic generation method of claim 1, wherein, The adversarial training of the generator and the discriminator, taking maximizing the first discrimination probability as an optimization objective of the generator, and taking minimizing the first discrimination probability and maximizing the second discrimination probability as an optimization objective of the discriminator, to obtain a target model, comprises: constructing a first generation sub-loss according to the first discrimination probability corresponding to the sample predicted traffic image; obtaining a sample reference traffic image corresponding to each sample predicted traffic image, and constructing a second generation sub-loss based on a pixel difference between the sample predicted traffic image and the corresponding sample reference traffic image, and constructing a third generation sub-loss based on a feature representation difference between the sample predicted traffic image and the sample reference traffic image; constructing a first target loss based on the first generation sub-loss, the second generation sub-loss and the third generation sub-loss, and minimizing the first target loss to satisfy maximizing the first discrimination probability as an optimization objective of the generator; constructing a first discrimination sub-loss according to the first discrimination probability corresponding to the sample predicted traffic image, and constructing a second discrimination sub-loss according to the second discrimination probability corresponding to the sample real traffic image; obtaining an interpolation sample between the sample predicted traffic image and the sample real traffic image, and constructing a third discrimination sub-loss based on a gradient of the interpolation sample with respect to the discriminator; constructing a second target loss based on the first discrimination sub-loss, the second discrimination sub-loss and the third discrimination sub-loss; minimizing the second target loss to satisfy minimizing the first discrimination probability and maximizing the second discrimination probability as an optimization objective of the discriminator, and performing adversarial training on the generator and the discriminator based on the optimization objectives of the generator and the discriminator to obtain a target model.

4. The network traffic generation method of claim 3, wherein, The third generation sub-loss is constructed based on a feature representation difference between the sample predicted traffic image and the sample reference traffic image, including: obtaining a plurality of first feature tensors output by a plurality of intermediate layers of the discriminator when processing the sample predicted traffic image, and performing global average pooling on the plurality of first feature tensors to obtain a first intermediate feature, wherein the plurality of intermediate layers include convolutional layers and transformer layers; obtaining a plurality of second feature tensors output by the plurality of intermediate layers of the discriminator when processing the sample real traffic image, and performing global average pooling on the plurality of second feature tensors to obtain a second intermediate feature; obtaining a first norm corresponding to the first intermediate feature and a second norm corresponding to the second intermediate feature, and constructing the third generation sub-loss based on a difference between the first norm and the second norm.

5. The network traffic generation method of claim 3, wherein, The interpolation sample between the sample predicted traffic image and the sample real traffic image is obtained, including: obtaining a preset mixing coefficient and calculating a product between the mixing coefficient and the sample real traffic image to obtain a first product; obtaining a preset reference value and obtaining a complementary weight based on a difference between the preset reference value and the first product; obtaining a second product based on a product between the complementary weight and the sample predicted traffic image; obtaining an interpolation sample between the sample predicted traffic image and the sample real traffic image based on a difference between the first product and the second product.

6. The network traffic generation method of claim 3, wherein, The third discrimination sub-loss is constructed based on a gradient of the interpolation sample with respect to the discriminator, including: inputting the interpolation sample into the discriminator to obtain a corresponding real value score; calculating a change rate of the real value score relative to the interpolation sample to obtain a target gradient; obtaining a norm value corresponding to the target gradient and a preset reference value, and constructing a third discriminator loss based on a difference between the norm value and the preset reference value.

7. A network traffic generation apparatus, characterized by, The device comprises: an acquisition module configured to acquire random noise data; an input module configured to input the random noise data into a generator of a target model to obtain a corresponding target predicted traffic image; a calculation module configured to perform inverse mapping calculation on the target predicted traffic image to obtain corresponding network traffic. The preset model comprises a generator and a discriminator, the target model is obtained by performing adversarial training on the generator and the discriminator, the generator is taken as an optimization target of the generator by maximizing a discrimination probability of a sample predicted traffic image by the discriminator, and the discriminator is taken as an optimization target of the discriminator by maximizing a discrimination probability of a sample real traffic image and minimizing the discrimination probability of the sample predicted traffic image, the sample predicted traffic image is generated by the generator based on sample random noise, and the sample real traffic image is obtained by performing forward mapping calculation on real-time updated sample network traffic. The target model is trained by the following method: acquiring real-time updated sample network traffic, and performing forward mapping calculation on the sample network traffic to obtain a corresponding sample real traffic image; acquiring sample random noise, inputting the sample random noise into a preset model, and generating a corresponding sample predicted traffic image by a generator of the preset model; inputting the sample predicted traffic image into a discriminator of the preset model to obtain a first discrimination probability, and inputting the sample real traffic image into the discriminator to obtain a second discrimination probability; taking maximizing the first discrimination probability as an optimization target of the generator, and taking minimizing the first discrimination probability and maximizing the second discrimination probability as an optimization target of the discriminator, to perform adversarial training on the generator and the discriminator to obtain the target model.

8. A computer device, comprising: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the network traffic generation method in any one of claims 1 to 6 when executing the computer program.

9. A computer readable storage medium, the storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the network traffic generation method in any one of claims 1 to 6.

Images