Malicious encrypted traffic detection method based on diffusion model

Abstract

The invention provides a malicious encrypted traffic detection method based on a diffusion model, and the method comprises the steps: cutting a received original traffic to obtain a plurality of session streams, generating corresponding packet-level data streams, and carrying out the analysis and conversion of each data packet in the packet-level data streams to generate a three-channel traffic diagram; using a pre-trained stable diffusion model to perform forward noise adding and reverse denoising learning on the three-channel flow graph in a submerged space, outputting a denoising track, calculating a generation distance between the denoising track and a normal diffusion track, and according to the generation distance, determining whether the original flow is a suspicious flow; and carrying out fine tuning on a full connection layer of the pre-trained stable diffusion model through an LORA low-rank matrix, carrying out reasoning according to the fine-tuned full connection layer, and judging whether the suspicious traffic is malicious traffic or not. According to the method, the malicious encrypted traffic is efficiently and accurately identified under the condition that the load does not need to be decrypted.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of malicious encrypted traffic detection, and particularly relates to a malicious encrypted traffic detection method based on a diffusion model. BACKGROUND

[0002] With the enforcement of TLS 1.3, QUIC and HTTPS, the proportion of encrypted traffic on the global Internet has exceeded 85%, and this proportion is even higher than 90% inside enterprise campuses and cloud data centers. These encryption protocols have made remarkable achievements in ensuring data confidentiality and integrity, but at the same time, they have provided a covert channel for malware, advanced persistent threats (APTs), command and control (C2) communications, and data leakage. Traditional deep packet inspection (DPI)-based protection systems gradually lose their effectiveness in the face of zero-day attacks, defense bypasses, and privacy protection because they cannot view packet content. The limitation of existing detection technology is that all mainstream methods focus on the discriminative paradigm: finding a classification hyperplane in a pre-defined feature space. When the traffic distribution appears concept drift, or encounters new threats that have never been seen before (such as zero-day attacks or variants), the model usually lacks reliable uncertainty measurement, which can lead to missed detection or false positives. SUMMARY

[0003] The present application provides a malicious encrypted traffic detection method based on a diffusion model, which solves the problems of weak generalization, heavy feature engineering dependence and insufficient zero-day attack detection capability in the prior art, and realizes efficient and accurate identification of malicious encrypted traffic without decrypting the payload.

[0004] The present application provides a malicious encrypted traffic detection method based on a diffusion model, which includes:

[0005] The received original traffic is cut to obtain a plurality of session flows, and corresponding packet-level data streams are generated, and each data packet in the packet-level data stream is parsed and converted to generate a three-channel traffic graph;

[0006] The pre-trained stable diffusion model is used to learn forward noise and reverse denoising in the latent space of the three-channel traffic graph, and output a denoising trajectory, calculate the generation distance between the denoising trajectory and the normal diffusion trajectory, and determine whether the original traffic is suspicious traffic according to the generation distance;

[0007] The full connection layer of the pre-trained stable diffusion model is fine-tuned by a LORA low-rank matrix, and inference is performed according to the fine-tuned full connection layer to determine whether the suspicious traffic is malicious traffic.

[0008] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, the original traffic is received and cut to obtain a plurality of session flows, and corresponding packet streams are generated, which includes:

[0009] receiving original traffic;

[0010] cutting the original traffic according to a time window and a five-tuple rule to obtain a plurality of session flows;

[0011] obtaining a plurality of data packets based on the session flows and packet sequence reorganization of each session flow;

[0012] extracting a packet sequence for each session flow to obtain a packet sequence, and generating a corresponding packet-level data flow based on the packet sequence.

[0013] Preferably, in the malicious encrypted traffic detection method based on the diffusion model, each data packet in the packet-level data flow is parsed and converted to generate a traffic graph, including:

[0014] parsing each data packet in the packet-level data flow to generate a packet header matrix and a payload matrix;

[0015] encoding the packet header matrix and the payload matrix of the plurality of data packets in the packet-level data flow by splicing along the vertical axis according to the time sequence of the data packets to generate a two-dimensional traffic graph;

[0016] mapping the two-dimensional traffic graph through color, position, and channel coding to obtain a three-channel traffic graph.

[0017] Preferably, in the malicious encrypted traffic detection method based on the diffusion model, a pre-trained stable diffusion model is used to perform forward noise addition and reverse denoising learning on the three-channel traffic graph in the latent space, and output a denoising trajectory, including:

[0018] generating a conditional embedding vector based on the session duration, packet count, average packet interval, and direction ratio of each packet-level data flow;

[0019] inputting the latent variable and the conditional embedding vector into the pre-trained stable diffusion model, performing forward noise addition and reverse denoising learning on the three-channel traffic graph in the latent space, and obtaining a denoised latent variable;

[0020] recording the latent variable input into the pre-trained stable diffusion model to generate a denoising trajectory.

[0021] Preferably, in the malicious encrypted traffic detection method based on the diffusion model, the generation distance of the denoising trajectory and the normal diffusion trajectory is calculated, and whether the original traffic is suspicious traffic is judged according to the generation distance, including:

[0022] calculating the generation distance of the denoising trajectory and the normal diffusion trajectory of the pre-trained stable diffusion model using Sliced Wasserstein Distance;

[0023] compare the generated distance with a preset distance threshold value;

[0024] When the generated distance is greater than the preset distance threshold value, it is determined that the original traffic is suspicious traffic.

[0025] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, when the generated distance is less than or equal to the preset distance threshold value, it includes:

[0026] Obtain the first index difference by comparing each element of the conditional embedding vector corresponding to each packet-level data stream with the corresponding preset standard interval, and calculate the comprehensive index difference of the conditional embedding based on the first index difference of each element and the corresponding preset weight;

[0027] When the comprehensive index difference is less than or equal to the preset difference, it is determined that the original traffic is normal traffic;

[0028] Otherwise, obtain the average packet number and direction ratio of the maximum sending frequency period corresponding to each packet-level traffic data, and calculate the second index difference based on the average packet number and direction ratio and the corresponding preset standard interval;

[0029] Compare the second index difference with the comprehensive index difference to obtain the element deviation coefficient, and perform weight redistribution based on the preset weight corresponding to the average packet number and direction ratio;

[0030] According to the redistribution weight corresponding to the average packet number and direction ratio and the corresponding element deviation coefficient, a threshold correction coefficient is calculated;

[0031] Based on the threshold correction coefficient, the classification confidence of the pre-trained stable diffusion model, and the preset distance threshold value, an adjusted distance threshold value is obtained;

[0032] When the generated distance is less than the adjusted distance threshold value, it is determined that the original traffic is normal traffic;

[0033] Otherwise, it is determined that the original traffic is suspicious traffic.

[0034] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, the full connection layer of a pre-trained stable diffusion model is fine-tuned through a LORA low-rank matrix, and inference is performed according to the fine-tuned full connection layer to determine whether suspicious traffic is malicious traffic, including:

[0035] The weight matrix in the full connection layer of the pre-trained stable diffusion model is decomposed based on the LORA low-rank matrix to complete the fine-tuning of the pre-trained stable diffusion model;

[0036] The suspicious traffic is inferred through the fine-tuned full connection layer to determine whether the suspicious traffic is malicious traffic by using accelerated sampling, dynamic early stopping, resource-aware scheduling and learnable noise scheduling mechanism.

[0037] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, the suspicious traffic is inferred through the fine-tuned full connection layer to determine whether the suspicious traffic is malicious traffic by using accelerated sampling, dynamic early stopping, resource-aware scheduling and learnable noise scheduling mechanism, comprising:

[0038] In the process of inferring the suspicious traffic through the fine-tuned full connection layer, the real-time denoising trajectory is obtained, and the real-time trajectory is obtained based on the number of execution diffusion steps corresponding to the real-time denoising trajectory, and the real-time trajectory is obtained based on the number of execution diffusion steps corresponding to the real-time denoising trajectory.

[0039] The real-time distance between the real-time denoising trajectory and the real-time trajectory corresponding to the real-time denoising trajectory is calculated by using Sliced Wasserstein Distance.

[0040] When the real-time distance is greater than the preset distance threshold for the first preset number of diffusion steps, it is determined that the original traffic corresponding to the real-time denoising trajectory is malicious traffic, and the real-time denoising trajectory inference is ended.

[0041] When the real-time distance is less than the adjusted distance threshold for the second preset number of diffusion steps, it is determined that the original traffic corresponding to the real-time denoising trajectory is normal traffic, and the real-time denoising trajectory inference is ended.

[0042] Otherwise, continue to perform denoising trajectory inference until the inference is completed, and when the final generated distance of the suspicious traffic is less than the adjusted distance threshold, it is determined that the suspicious traffic is normal traffic.

[0043] Otherwise, it is determined that the suspicious traffic is malicious traffic.

[0044] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, further comprising:

[0045] The real-time inference step number and resource usage of the pre-trained stable diffusion model are displayed in real time based on the display module.

[0046] After the inference is completed, the traffic detection record is automatically generated based on the inference related data and uploaded to the cloud.

[0047] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, further comprising:

[0048] The preset distance threshold is adjusted in real time based on the current network traffic, comprising:

[0049] Obtain the condition embedding vector, the encrypted protocol parameter and the domain name feature of the normal flow in the plurality of flow burst periods in the current time interval;

[0050] Respectively compare and extract features of the condition embedding vector, the encrypted protocol parameter and the domain name feature of the plurality of flow burst periods, and obtain the condition embedding vector feature, the encrypted protocol parameter feature and the domain name comprehensive feature of the current time interval;

[0051] Input the condition embedding vector feature, the encrypted protocol parameter feature and the domain name comprehensive feature into the pre-training stable diffusion model, process the normal flow, and obtain the normal flow adversarial sample;

[0052] Calculate the difference degree between the normal flow adversarial sample and the corresponding normal flow by using Sliced Wasserstein Distance;

[0053] Based on the difference degrees corresponding to all normal flows, generate a difference interval, and take the maximum value of the difference degree interval as the preset distance threshold of the next time interval.

[0054] Compared with the prior art, the present application has the following beneficial effects:

[0055] The detection of malicious encrypted traffic is divided into three parts of traffic-image conversion, pre-training diffusion model application and diffusion model fine-tuning by the application. The traffic-image conversion part: the original traffic is cut into session streams and converted into three-channel traffic graphs, realizing the conversion of network traffic from original binary data to visual images, breaking through the traditional detection method based on feature engineering, mapping the time sequence features, packet structure features and protocol interaction features of traffic data to the pixel space of images, without analyzing the encrypted content and without needing to touch the actual payload data of users to capture the subtle pattern changes and abnormal features in encrypted traffic, more comprehensively and intuitively presenting the internal features of traffic, and significantly improving the detection ability of complex encrypted traffic. The pre-training diffusion model application part: the pre-training stable diffusion model is used to learn forward noise and reverse denoising in the latent space, simulate the data generation process, calculate the generation distance of the denoising trajectory and the normal diffusion trajectory to judge suspicious traffic, so that the diffusion model can learn the data distribution and generation rule of normal traffic, form a stable representation of the features of normal traffic, and when encountering abnormal traffic, the significant change of the generation distance can sensitively identify the traffic deviating from the normal mode, effectively distinguish normal and suspicious traffic, and has good generalization detection ability for unknown types of malicious traffic, overcoming the problem that the traditional detection method based on rules or statistical features has insufficient detection ability for zero-day attacks and new varieties of malicious traffic. The diffusion model fine-tuning part: the LORA low-rank matrix is used to fine-tune the full connection layer of the pre-training stable diffusion model, on the basis of maintaining the overall structure and parameters of the model, with low calculation cost and less training data, the model performance is optimized for specific scenarios and data sets, not only speeding up the training speed of the model and reducing the consumption of calculation resources, but also being able to flexibly adjust the model according to different network environments and attack characteristics, improving the accurate judgment ability of malicious traffic in suspicious traffic, realizing high-precision malicious traffic identification, reducing the false positive rate and the false negative rate, and improving the practicability and reliability of the detection system. The application adopts a two-stage detection strategy of first judging suspicious traffic and then identifying malicious traffic in the suspicious traffic, gradually narrows down the detection range in layers, reduces the calculation complexity, ensures the detection accuracy, and effectively enhances the system processing capacity and robustness, which is conducive to the application of malicious encrypted traffic detection in large-scale complex and variable network traffic scenarios.

[0056] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the application. The objects and other advantages of the present application can be realized and attained by the structure particularly pointed out in the written description and claims hereof.

[0057] The technical solutions of the present application will be further described in detail below with the help of the drawings and examples. BRIEF DESCRIPTION OF DRAWINGS

[0058] The accompanying drawings are included to provide a further understanding of the application, and are incorporated in and constitute a part of this specification, illustrate embodiments of the application, and are used to explain the application without restricting it. In the drawings:

[0059] Figure 1 A framework diagram of a malicious encrypted traffic detection method based on a diffusion model;

[0060] Figure 2 A flowchart of original traffic processing;

[0061] Figure 3 A flowchart of three-channel traffic graph conversion. DETAILED DESCRIPTION

[0062] The preferred embodiments of the application are described below in conjunction with the accompanying drawings, and it should be understood that the preferred embodiments described herein are only used to illustrate and explain the application, and do not limit the application.

[0063] Embodiment 1:

[0064] The application provides a malicious encrypted traffic detection method based on a diffusion model, comprising:

[0065] The received original traffic is cut to obtain a plurality of session flows, and corresponding packet-level data flows are generated, and each data packet in the packet-level data flow is parsed and converted to generate a three-channel traffic graph;

[0066] The pre-trained stable diffusion model is used to learn forward noise and reverse denoising in the latent space of the three-channel traffic graph, and output a denoising trajectory, calculate the generation distance between the denoising trajectory and the normal diffusion trajectory, and determine whether the original traffic is suspicious traffic according to the generation distance;

[0067] The full connection layer of the pre-trained stable diffusion model is fine-tuned by a LORA low-rank matrix, and inference is performed according to the fine-tuned full connection layer to determine whether the suspicious traffic is malicious traffic.

[0068] In this embodiment, LORA is a low-resource fine-tuning large model method, using LORA, the training parameters are only one ten-thousandth of the overall parameters, the GPU memory usage is reduced by 2 / 3, and no additional inference time is introduced.

[0069] The beneficial effects of the above technical solutions are: the application Figure 1As shown, the detection of malicious encrypted traffic is divided into three parts of traffic-image conversion, pre-training diffusion model application and diffusion model fine-tuning. The traffic-image conversion part: the original traffic is cut into session streams and converted into three-channel traffic graphs, realizing the conversion of network traffic from original binary data to visual images, breaking through the traditional detection method based on feature engineering, mapping the time sequence features, packet structure features and protocol interaction features of the traffic data to the pixel space of the image, without analyzing the encrypted content and without touching the actual payload data of the user, the subtle pattern changes and abnormal features in the encrypted traffic can be captured, the internal features of the traffic are more comprehensively and intuitively presented, and the detection ability of the complex encrypted traffic is significantly improved. The pre-training diffusion model application part: the pre-training stable diffusion model is used to learn forward noise and reverse denoising in the latent space, simulate the data generation process, calculate the generation distance of the denoising trajectory and the normal diffusion trajectory to judge the suspicious traffic, so that the diffusion model can learn the data distribution and generation rule of the normal traffic, and form a stable representation of the features of the normal traffic; when encountering abnormal traffic, the significant change of the generation distance can sensitively identify the traffic deviating from the normal mode, effectively distinguish normal and suspicious traffic, and has good generalization detection ability for unknown types of malicious traffic, overcoming the problem that the traditional detection method based on rules or statistical features has insufficient detection ability for zero-day attacks and new varieties of malicious traffic. The diffusion model fine-tuning part: the LORA low-rank matrix is used to fine-tune the full connection layer of the pre-training stable diffusion model, on the basis of maintaining the overall structure and parameters of the model, with low calculation cost and less training data, the model performance is optimized for specific scenarios and data sets, not only speeding up the training speed of the model and reducing the consumption of calculation resources, but also being able to flexibly adjust the model according to different network environments and attack characteristics, improve the accurate judgment ability of the malicious traffic in the suspicious traffic, realize high-precision malicious traffic identification, and reduce the false positive rate and the false negative rate, improve the practicability and reliability of the detection system. The two-stage detection strategy of the present application is adopted, that is, first judging the suspicious traffic, and then identifying the malicious traffic in the suspicious traffic, which gradually narrows down the detection range in layers, reduces the calculation complexity, ensures the detection accuracy, and effectively enhances the system processing capacity and robustness, which is conducive to the application of malicious encrypted traffic detection in large-scale complex and variable network traffic scenarios.

[0070] Embodiment 2:

[0071] On the basis of embodiment 1, the original traffic is received and cut to obtain a plurality of session streams, and corresponding packet streams are generated, as shown in Figure 2 , which includes:

[0072] Receiving original traffic;

[0073] According to the time window and the five-tuple rule, the original traffic is cut to obtain a plurality of session streams;

[0074] obtaining a plurality of data packets based on each session flow and packet sequence reorganization of each session flow;

[0075] performing data packet sequence extraction on each session flow to obtain a packet sequence, and generating a corresponding packet-level data stream based on the packet sequence.

[0076] The beneficial effects of the above technical solutions are as follows: The original traffic is cut according to a time window and a five-tuple rule in the application, and the huge and disordered original traffic is divided into a plurality of independent session flows. The time window can be flexibly set according to the change rule of network traffic, and the time correlation of captured traffic is ensured. The five-tuple (source IP, destination IP, source port, destination port, protocol) rule accurately locates the communication parties and the protocol type, so that each session flow corresponds to a specific network communication process, the accurate division of the session flow is realized, the interference between the traffic characteristics of different sessions is avoided, the pertinence and accuracy of the detection of malicious encrypted traffic in a specific communication scenario are significantly improved, and an accurate data basis is provided for the subsequent detection of malicious encrypted traffic. The packet sequence reorganization and data packet sequence extraction are performed on each session flow, the data packets are arranged in the correct order, the real process of network communication is completely restored, the problem of out-of-order data packets in network transmission due to various reasons is effectively solved, and the occurrence of traffic feature loss or misreading caused by the disorder of data packet order is avoided. The packet-level data stream is generated, the traffic information is converted into structured data, the key information such as the timing characteristics and the interaction mode of the traffic is completely retained, an accurate and complete data basis is provided for the subsequent generation of a three-channel traffic graph and analysis based on a diffusion model, and the reliability of the detection result is ensured.

[0077] Embodiment 3

[0078] On the basis of embodiment 1, each data packet in the packet-level data stream is parsed and converted to generate a traffic graph, as shown in Figure 3 , which includes

[0079] Each data packet in the packet-level data stream is parsed to generate a packet header matrix and a payload matrix;

[0080] According to the time sequence of the data packets, the packet header matrix and the payload matrix of a plurality of data packets in the packet-level data stream are spliced and encoded along the vertical axis to generate a two-dimensional traffic graph;

[0081] The two-dimensional traffic graph is mapped and processed through color, position and channel coding to obtain a three-channel traffic graph.

[0082] In this embodiment, the color, position and channel coding are implemented according to the following rules: the R channel corresponds to an incoming packet, the G channel corresponds to an outgoing packet, and the B channel encodes protocol stack information.

[0083] In this embodiment, the packet header matrix extracts fields such as IP header, TCP header, TLS header, and contains network communication basic information such as protocol type, source and destination address.

[0084] In this embodiment, the load matrix extracts the packet body byte content; fixed byte block size is filled or truncated to ensure image size consistency.

[0085] The beneficial effects of the above technical solutions are: the present application integrates the packet header information, load content and time sequence of the data packet to generate a two-dimensional flow graph, and then combines color, position and channel coding after splicing and coding along the time axis, to form an image representation containing rich semantic information, realizing multi-dimensional information fusion of flow data, which can comprehensively reflect the characteristics and behavior patterns of network flow, and is beneficial to more accurately depict the differences between normal flow and malicious flow, thereby significantly improving the accuracy of malicious encrypted flow detection and reducing the false positive and false negative rates. The present application can still extract the packet header information, data packet time sequence relationship and visual coding from the structure and behavior of the flow to mine potential patterns and abnormal characteristics in the flow data, bypassing the difficulty of traditional encrypted data content analysis, providing an effective solution for malicious encrypted flow detection, effectively enhancing the adaptability and detection ability of encrypted flow, and being beneficial to better cope with the increasing threat of encrypted malicious flow.

[0086] Embodiment 4:

[0087] On the basis of embodiment 1, the pre-trained stable diffusion model is used to learn forward noise and reverse denoising in the latent space for the three-channel flow graph, and output the denoising trajectory, including:

[0088] Generating a conditional embedding vector based on the session duration, packet count, average packet interval and direction ratio of each packet-level data flow;

[0089] Inputting the latent variable and the conditional embedding vector into the pre-trained stable diffusion model, learning forward noise and reverse denoising in the latent space for the three-channel flow graph, and obtaining the denoised latent variable;

[0090] Recording the latent variable input into the pre-trained stable diffusion model to generate the denoising trajectory.

[0091] The beneficial effects of the above technical solutions are: based on the session duration, packet count, average packet interval and direction ratio of the packet-level data flow, a condition embedding vector is generated, the key features of network traffic in the time dimension, quantity dimension, interval dimension and communication direction dimension are quantitatively fused, and input into a pre-trained stable diffusion model, so that the fusion of original traffic features is realized, and through forward noise adding and reverse denoising learning of the three-channel traffic graph in the latent space, the model can not only learn the original features of the traffic graph, but also mine the potential relationship and dependent structure between the features, more comprehensively and deeply learn the feature representation of the traffic data, especially for complex and variable malicious encrypted traffic, the model can identify abnormal features deviating from the normal mode through the denoising process, thereby improving the detection sensitivity and accuracy of malicious traffic. The latent variables input into the pre-trained stable diffusion model are recorded to generate denoising trajectories, which is beneficial to the discovery of potential risks and the improvement of the accuracy of suspicious traffic detection.

[0092] Embodiment 5

[0093] Based on the embodiment 1, the generation distance of the denoising trajectory and the normal diffusion trajectory is calculated, and according to the generation distance, it is judged whether the original traffic is suspicious traffic, comprising:

[0094] The generation distance of the denoising trajectory and the normal diffusion trajectory of the pre-trained stable diffusion model is calculated by using Sliced Wasserstein Distance;

[0095] The generation distance is compared with a preset distance threshold;

[0096] When the generation distance is greater than the preset distance threshold, it is determined that the original traffic is suspicious traffic.

[0097] In this embodiment, Sliced Wasserstein Distance (SWD) is a geometrically meaningful difference measure.

[0098] In this embodiment, the pre-trained stable diffusion model is divided into a forward diffusion process and a reverse denoising process;

[0099] Wherein, the latent representation at diffusion step t is given the original latent variable Z0:

[0100]

[0101] Wherein, Z t represents the latent variable at diffusion step t, represents the noise ratio in the fixed noise scheduling table; ε ~ N(0, I) represents a standard Gaussian noise;

[0102] The reverse denoising modeling is performed by constructing a parameterized network ε0(Zt t, c) for predicting noise, wherein c represents a conditional embedding vector containing time length, packet number, direction;

[0103] The minimization loss function for the pre-training stable diffusion model training stage is as follows:

[0104]

[0105] wherein, the minimum loss function of the pre-training stable diffusion model in the training stage, other embedding conditions (for example: encryption protocol parameters, domain name features, etc.) added according to user needs.

[0106] The beneficial effects of the above technical solutions are: the Sliced Wasserstein Distance (SWD) is used to calculate the generation distance of the denoised trajectory and the normal diffusion trajectory, which can effectively measure the difference between two distributions. In the malicious encrypted traffic detection scene, the denoised trajectory of the normal traffic will follow the normal distribution pattern learned by the pre-training stable diffusion model, while the denoised trajectory of the malicious traffic will deviate from this pattern. SWD can capture this distribution difference. Even in high-dimensional space, by integrating the one-dimensional distribution difference on the random projection direction, it can accurately reflect the difference degree of the two trajectories in the overall distribution. Compared with the traditional Euclidean distance or cosine similarity, SWD can more sensitively discover potential malicious traffic features and improve the accuracy of detection. Moreover, the calculation of the generation distance realizes the mining of abnormal features hidden behind encrypted traffic and the effective identification of encrypted malicious traffic, which makes up for the limitations of traditional content analysis methods in the face of encrypted traffic. It can more accurately distinguish between normal traffic and suspicious traffic, effectively reducing the false positive rate. By comparing the generation distance with the preset distance threshold, automatic suspicious traffic judgment based on quantitative indicators is realized, which effectively improves the detection efficiency and realizes the rapid response of traffic changes in the network. It is beneficial to timely discover suspicious traffic. At the same time, the threshold can be adjusted according to different network environments and security needs, enhancing the flexibility and adaptability of the detection method, and being suitable for various sizes and types of network systems.

[0107] Embodiment 6:

[0108] On the basis of embodiment 5, when the generation distance is less than or equal to the preset distance threshold, comprising:

[0109] The elements of the conditional embedding vector corresponding to each packet-level data stream are compared with the corresponding preset standard interval to obtain a first index difference, and the comprehensive index difference of the conditional embedding is calculated based on the first index difference of each element and the corresponding preset weight.

[0110] When the comprehensive index difference is less than or equal to a preset difference, it is determined that the original traffic is normal traffic.

[0111] Otherwise, the average packet number and the direction ratio of the maximum sending frequency period corresponding to each packet-level traffic data are obtained, and a second index difference is calculated based on the average packet number and the direction ratio and the preset standard interval corresponding thereto.

[0112] The second index difference is compared with the comprehensive index difference to obtain an element deviation coefficient, and the preset weight corresponding to the average packet number and the direction ratio is re-distributed based on the average packet number and the direction ratio.

[0113] According to the re-distributed weight corresponding to the average packet number and the direction ratio and the element deviation coefficient corresponding thereto, a threshold correction coefficient is calculated.

[0114] Based on the threshold correction coefficient, the classification confidence of the pre-trained stable diffusion model, and a preset distance threshold, an adjusted distance threshold is obtained.

[0115] When the generated distance is less than the adjusted distance threshold, it is determined that the original traffic is normal traffic.

[0116] Otherwise, it is determined that the original traffic is suspicious traffic.

[0117] In this embodiment, the first index difference refers to the error value calculated by comparing each element (including session duration, packet count, average packet interval, and direction ratio) of the conditional embedding vector with the corresponding preset standard interval. The error value refers to the ratio of the absolute value of the difference between the actual value of each element and the upper and lower limits of the corresponding preset standard interval to the difference between the upper limit of the preset standard interval.

[0118] In this embodiment, the comprehensive index difference refers to the sum of the product of the first index difference corresponding to each element and the preset weight corresponding thereto. The preset weight of each element can be flexibly adjusted according to detection requirements.

[0119] In this embodiment, the second index difference refers to the error value of the average packet number and the direction ratio of the maximum sending frequency period corresponding to each packet-level traffic data and the corresponding preset standard interval.

[0120] In this embodiment, the weight re-distribution based on the preset weight corresponding to the average packet number and the direction ratio refers to the weight value obtained after normalization processing according to the preset weight corresponding to the average packet number and the direction ratio.

[0121] In this embodiment, the element deviation coefficient refers to the quotient of the second index difference and the comprehensive index difference.

[0122] In this embodiment, the threshold correction coefficient refers to the sum of the redistribution weight corresponding to the average packet number and the direction ratio and the product of the corresponding element deviation coefficient.

[0123] In this embodiment, the specific calculation process of adjusting the distance threshold value is as follows:

[0124] SWD' = a SWD0 + (1-a)(1-b)

[0125] Wherein, SWD' represents the adjusted distance threshold value; SWD0 represents the preset distance threshold value; a represents the threshold correction weight; b represents the classification confidence of the pre-trained stable diffusion model.

[0126] The beneficial effects of the above technical solution are: by analyzing the comprehensive index difference of the conditional embedding vector first, the application can quickly filter out obviously abnormal traffic; for traffic at the threshold boundary, further refined analysis is carried out through the second index difference and the element deviation coefficient, the elements of the conditional embedding vector are compared and calculated with the preset standard interval to obtain the first index difference, and the comprehensive index difference is calculated based on the preset weight, the abstract traffic feature difference is converted into a quantifiable numerical value, so that the traffic judgment is more objective and accurate, and then the average packet number and the direction ratio of the maximum sending frequency period corresponding to each packet level traffic data are obtained, based on the average packet number and the direction ratio and the corresponding preset standard interval, the second index difference is calculated, which can capture the subtle changes of traffic behavior patterns, further improving the sensitivity of detection; then the weight is redistributed according to the element deviation coefficient and the preset weight to obtain the threshold correction coefficient, and the distance threshold value is dynamically adjusted in combination with the classification confidence of the pre-trained stable diffusion model, which can automatically adjust the judgment standard according to the real-time change of traffic features, effectively cope with the dynamic change of network environment and the continuous evolution of attack means, realize the adaptive adjustment of the preset threshold value, effectively reduce the false positive rate and the false negative rate, effectively enhance the network security protection capability, and timely discover potential security threats.

[0127] Embodiment 6:

[0128] On the basis of embodiment 1, the full connection layer of the pre-trained stable diffusion model is fine-tuned through the LORA low-rank matrix, and inference is performed according to the fine-tuned full connection layer to judge whether the suspicious traffic is malicious traffic, including:

[0129] The weight matrix in the full connection layer of the pre-trained stable diffusion model is decomposed based on the LORA low-rank matrix to complete the fine-tuning of the pre-trained stable diffusion model;

[0130] Through the fine-tuned full connection layer, suspicious traffic is inferred by using the accelerated sampling, dynamic early stopping, resource-aware scheduling and learnable noise scheduling mechanism to judge whether the suspicious traffic is malicious traffic.

[0131] In this embodiment, the learnable noise scheduling function adopts a multi-layer perception to perform time-condition double mapping on the noise amplitude.

[0132] In this embodiment, decomposing the weight matrix in the full connection layer of the pre-trained stable diffusion model based on the LORA low-rank matrix refers to decomposing the weight matrix in the full connection layer into

[0133] W' = W + AW = W + A·B

[0134] wherein W' represents the weight matrix in the fine-tuned full connection layer, W represents the weight matrix in the full connection layer before fine-tuning, AW represents the fine-tuning matrix of the weight matrix in the full connection layer; the rank r of the low-rank matrix is much smaller than min(d, k), d represents the number of rows of the weight matrix in the full connection layer, k represents the number of columns of the weight matrix in the full connection layer; A represents the left factor, which is the input side projection; B represents the right factor, which is the output side reconstruction matrix,

[0135] Since r << min(d, k) reduces the amount of parameters that need to be trained / stored, and can flexibly adjust the original weight W through the combination of A and B in a fine-grained manner, the training parameters and memory occupation are significantly reduced, while the detection accuracy is maintained, and the calculation and time delay overheads are reduced.

[0136] In this embodiment, the diffusion reverse reasoning adopts the DDIM 10-20 step fast sampling strategy.

[0137] The beneficial effects of the above technical solutions are as follows: the present application decomposes and fine-tunes the weight matrix in the full connection layer of the pre-trained stable diffusion model based on the LORA low-rank matrix, only a small amount of learnable parameters need to be trained, and the calculation overhead is greatly reduced, then the accelerated sampling technology (such as DDIM, PLMS, etc.) can effectively improve the inference speed of the model, combined with the dynamic early stopping mechanism, the sampling step can be automatically adjusted according to the complexity of the traffic characteristics, avoiding redundant calculation. For simple traffic samples, the system can terminate the inference process in advance, compressing the single detection time consumption from seconds to milliseconds, meeting the real-time detection requirements in high-speed network environment. The resource-aware scheduling mechanism further optimizes the allocation of computing resources, ensuring that critical traffic is processed first, effectively dealing with sudden traffic flood scenarios such as DDoS (Distributed Denial of Service) attacks, and then through the learnable noise scheduling mechanism, the model can adaptively adjust the noise level in the denoising process, more sensitively capturing subtle abnormal features in suspicious traffic, dynamically optimizing the noise distribution for different encryption algorithms and traffic patterns, so that the model can more clearly distinguish between normal and malicious patterns of traffic encryption in the latent space, which can greatly improve the accuracy of malicious traffic detection. Finally, according to the inference result, it is judged whether the suspicious traffic is malicious traffic, which can effectively identify advanced persistent threats (APT) disguised as normal traffic.​

[0138] Embodiment 7:

[0139] On the basis of Embodiment 6, by using the accelerated sampling, the resource-aware scheduling and the learnable noise scheduling mechanism, the suspicious traffic is inferred by the fine-tuned full connection layer to determine whether the suspicious traffic is malicious traffic, including:

[0140] In the process of inferring the suspicious traffic by the fine-tuned full connection layer, the real-time denoising trajectory is obtained, and based on the number of execution diffusion steps corresponding to the real-time denoising trajectory, the real-time trajectory of the normal diffusion trajectory is intercepted to obtain a real-time comparison trajectory.

[0141] The real-time distance between the real-time denoising trajectory and the real-time comparison trajectory corresponding thereto is calculated by using the Sliced Wasserstein Distance.

[0142] When the real-time distance is greater than the preset distance threshold for a first preset number of diffusion steps, it is determined that the original traffic corresponding to the real-time denoising trajectory is malicious traffic, and the real-time denoising trajectory inference is ended.

[0143] When the real-time distance is less than the adjusted distance threshold for a second preset number of diffusion steps, it is determined that the original traffic corresponding to the real-time denoising trajectory is normal traffic, and the real-time denoising trajectory inference is ended.

[0144] Otherwise, the denoising trajectory inference is continued until the inference is completed, and when the final generated distance of the suspicious traffic is less than the adjusted distance threshold, it is determined that the suspicious traffic is normal traffic.

[0145] Otherwise, it is determined that the suspicious traffic is malicious traffic.

[0146] In this embodiment, before inferring the suspicious traffic, the adjusted distance threshold of the suspicious traffic is first confirmed and calculated.

[0147] In this embodiment, the first preset number is less than or equal to the second preset number.

[0148] In this embodiment, the inference completion may be caused by a dynamic early stopping mechanism or may be caused by a reverse denoising of the diffusion model.

[0149] The beneficial effects of the above technical solutions are: the present application acquires the denoised trajectory in real time, and intercepts the normal diffusion trajectory according to the number of diffusion steps, which can flexibly adapt to the dynamic change characteristics of different flow types. For example, some malicious traffic may have an abnormal behavior of traffic surge in a short time, and this mechanism can accurately capture such mutation characteristics, avoid feature loss caused by fixed analysis mode, ensure comprehensive and accurate extraction of traffic characteristics, and set the first preset and the second preset continuous judgment condition, combine the preset distance threshold and the adjusted distance threshold, and effectively avoid misjudgment caused by single data fluctuation. For rapidly exploding malicious attacks, when the real-time distance continuously exceeds the threshold within the first preset diffusion step, the attack can be quickly judged and blocked, realizing efficient completion of malicious traffic detection; for normal traffic, if the real-time distance continuously falls below the threshold within the second preset diffusion step, the traffic is quickly released, reducing unnecessary consumption of computing resources, and greatly improving the reliability and efficiency of detection. If the malicious judgment of the traffic cannot be completed in the early stage, the denoised trajectory reasoning is continuously performed until the end, and the conclusion is obtained according to the comparison between the finally generated distance and the threshold. The whole process analysis can cope with various complex attack scenes, such as phased penetration attack. Even if the characteristics are not obvious in the early stage of attack, differences can be accumulated in the whole traffic life cycle, ensuring that no potential threat is missed, and effectively improving the defense ability against complex attacks.

[0150] Embodiment 8:

[0151] Based on the embodiment 1, the malicious encrypted traffic detection method based on diffusion model further comprises:

[0152] The display module is used to display the real-time reasoning step number and resource usage of the pre-trained stable diffusion model in real time;

[0153] After the reasoning is completed, the traffic detection record is automatically generated based on the reasoning related data and uploaded to the cloud.

[0154] The beneficial effects of the above technical solutions are: the present application acquires the denoised trajectory in real time, and intercepts the normal diffusion trajectory according to the number of diffusion steps, which can flexibly adapt to the dynamic change characteristics of different flow types. For example, some malicious traffic may have an abnormal behavior of traffic surge in a short time, and this mechanism can accurately capture such mutation characteristics, avoid feature loss caused by fixed analysis mode, ensure comprehensive and accurate extraction of traffic characteristics, and set the first preset and the second preset continuous judgment condition, combine the preset distance threshold and the adjusted distance threshold, and effectively avoid misjudgment caused by single data fluctuation. For rapidly exploding malicious attacks, when the real-time distance continuously exceeds the threshold within the first preset diffusion step, the attack can be quickly judged and blocked, realizing efficient completion of malicious traffic detection; for normal traffic, if the real-time distance continuously falls below the threshold within the second preset diffusion step, the traffic is quickly released, reducing unnecessary consumption of computing resources, and greatly improving the reliability and efficiency of detection. If the malicious judgment of the traffic cannot be completed in the early stage, the denoised trajectory reasoning is continuously performed until the end, and the conclusion is obtained according to the comparison between the finally generated distance and the threshold. The whole process analysis can cope with various complex attack scenes, such as phased penetration attack. Even if the characteristics are not obvious in the early stage of attack, differences can be accumulated in the whole traffic life cycle, ensuring that no potential threat is missed, and effectively improving the defense ability against complex attacks.

[0155] Embodiment 9:

[0156] Based on the embodiment 5, the malicious encrypted traffic detection method based on diffusion model further comprises:

[0157] Based on the current network traffic, the preset distance threshold is real-time regulated, comprising:

[0158] Obtaining the condition embedding vector, the encrypted protocol parameter and the domain name feature of the normal traffic in the multiple traffic burst periods in the current time interval;

[0159] Comparing and extracting the features of the condition embedding vector, the encrypted protocol parameter and the domain name feature of the multiple traffic burst periods respectively, obtaining the condition embedding vector feature, the encrypted protocol parameter feature and the domain name comprehensive feature of the current time interval;

[0160] Inputting the condition embedding vector feature, the encrypted protocol parameter feature and the domain name comprehensive feature into the pre-training stable diffusion model, processing the normal traffic, and obtaining the normal traffic adversarial sample;

[0161] Using Sliced Wasserstein Distance to calculate the difference degree between the normal traffic adversarial sample and the corresponding normal traffic;

[0162] Based on the difference degree corresponding to all normal traffic, generating a difference interval, and taking the maximum value of the difference degree interval as the preset distance threshold of the next time interval.

[0163] In this embodiment, the traffic burst period is the traffic peak period.

[0164] The beneficial effects of the above technical scheme are: the application obtains the condition embedding vector, encryption protocol parameters and domain name features in the traffic burst period in real time, can closely follow the dynamic changes of network traffic, for example, in the traffic surge scene such as e-commerce promotion, online education peak period, the mechanism can quickly capture the feature changes of normal traffic in different dimensions, avoid the normal traffic being misjudged as malicious traffic due to the fixed threshold, and significantly improve the adaptability of the model in complex network environment. Then, the condition embedding vectors, encryption protocol parameters and domain name features of multiple traffic periods are compared and extracted to form a comprehensive feature set. Taking the encryption protocol parameters as an example, the parameter distribution of the TLS version, key exchange algorithm and the like used by the normal traffic in different periods may be different, combined with the domain name features (such as subdomain name change, access frequency), a more comprehensive normal traffic portrait can be constructed, avoiding the one-sidedness of single-dimensional feature extraction, thereby improving the accuracy of the normal traffic feature description of the diffusion model. Then, the pre-trained stable diffusion model is used to generate normal traffic adversarial samples to simulate abnormal fluctuations that may occur in the real network environment, and a dynamic threshold is generated based on the normal traffic difference degree, which can avoid the problem that the static threshold is difficult to balance the false positive rate and the false negative rate. When the network environment changes (such as the introduction of a new business system leading to changes in traffic patterns), the maximum difference interval will be dynamically adjusted according to the latest normal traffic features, ensuring that the preset distance threshold always fits the current network situation, reducing the malicious traffic missed detection or normal traffic misjudgment caused by the lag of the threshold.

[0165] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application claims and their equivalents, the present application also intends to include these modifications and variations.

Claims

1. A method for detecting malicious encrypted traffic based on a diffusion model, characterized in that, include: The received raw traffic is segmented to obtain multiple session streams, and corresponding packet-level data streams are generated. Each data packet in the packet-level data stream is parsed and transformed to generate a three-channel traffic graph. Using a pre-trained stable diffusion model, forward noise addition and backward denoising learning are performed on the three-channel flow map in the latent space, and the denoised trajectory is output. The generation distance between the denoised trajectory and the normal diffusion trajectory is calculated, and the original flow is judged as suspicious flow based on the generation distance. By using the LORA low-rank matrix, the fully connected layer of the pre-trained stable diffusion model is fine-tuned, and inference is performed based on the fine-tuned fully connected layer to determine whether suspicious traffic is malicious traffic.

2. The malicious encrypted traffic detection method based on a diffusion model according to claim 1, characterized in that, The system receives raw traffic, segments it to obtain multiple session streams, and generates corresponding data packet streams, including: Receive raw traffic; The original traffic is segmented according to the time window and the five-tuple rule to obtain multiple session streams; Based on each session stream, and by reordering the packets in each session stream, multiple data packets are obtained; For each session stream, a packet sequence is extracted to obtain a packet sequence, and a corresponding packet-level data stream is generated based on the packet sequence.

3. The malicious encrypted traffic detection method based on a diffusion model according to claim 1, characterized in that, Each packet in the packet-level data stream is parsed and transformed to generate a traffic graph, including: Each data packet in the packet-level data stream is parsed to generate a header matrix and a payload matrix; Following the time sequence of data packets along the vertical axis, the header matrix and payload matrix of multiple data packets within the packet-level data stream are concatenated and encoded to generate a two-dimensional traffic graph; A three-channel flow map is obtained by mapping the two-dimensional flow map using color, position, and channel encoding.

4. The malicious encrypted traffic detection method based on a diffusion model according to claim 1, characterized in that, Using a pre-trained stable diffusion model, forward denoising and backward denoising learning are performed on the three-channel flow map in the latent space, and the denoised trajectory is output, including: Conditional embedding vectors are generated based on session duration, packet count, average packet interval, and directional ratio of each packet-level data stream. Input latent variables and conditional embedding vectors into a pre-trained stable diffusion model, perform forward noise addition and backward denoising learning on the three-channel flow graph in the latent space, and obtain the denoised latent variables. The latent variables input to the pre-trained stable diffusion model are recorded to generate denoised trajectories.

5. The malicious encrypted traffic detection method based on a diffusion model according to claim 1, characterized in that, Calculate the generation distance between the denoised trajectory and the normal diffusion trajectory, and determine whether the original traffic is suspicious based on the generation distance, including: The Sliced ​​Wasserstein Distance was used to calculate the generation distance between the denoised trajectory and the normal diffusion trajectory of the pre-trained stable diffusion model; Compare the generated distance with a preset distance threshold; When the generated distance is greater than a preset distance threshold, the original traffic is determined to be suspicious traffic.

6. The malicious encrypted traffic detection method based on a diffusion model according to claim 5, characterized in that, When the generated distance is less than or equal to a preset distance threshold, including: The conditional embedding vector corresponding to each package-level data stream is obtained and compared with the corresponding preset standard interval to obtain the first index difference. Based on the first index difference corresponding to each element and its corresponding preset weight, the comprehensive index difference of the conditional embedding is calculated. When the difference in the comprehensive index is less than or equal to the preset difference, the original traffic is determined to be normal traffic. Otherwise, obtain the average number of packets and the directional ratio of the maximum transmission frequency period corresponding to each packet-level traffic data, and calculate the second index difference based on the average number of packets and the directional ratio and their corresponding preset standard intervals. The difference between the second indicator and the difference between the comprehensive indicator are compared to obtain the element deviation coefficient, and the weights are redistributed based on the preset weights corresponding to the average number of packages and the direction ratio. The threshold correction coefficient is calculated based on the redistribution weights corresponding to the average number of packages and the directional ratio, as well as their corresponding element deviation coefficients. The adjusted distance threshold is obtained based on the threshold correction coefficient, the classification confidence of the pre-trained stable diffusion model, and the preset distance threshold. When the generated distance is less than the adjusted distance threshold, the original traffic is determined to be normal traffic; Otherwise, the original traffic is determined to be suspicious traffic.

7. The malicious encrypted traffic detection method based on a diffusion model according to claim 1, characterized in that, The fully connected layers of a pre-trained stable diffusion model are fine-tuned using the LORA low-rank matrix, and inference is performed based on the fine-tuned fully connected layers to determine whether suspicious traffic is malicious, including: The weight matrix in the fully connected layer of the pre-trained stable diffusion model is decomposed based on the LORA low-rank matrix to complete the fine-tuning of the pre-trained stable diffusion model. By utilizing accelerated sampling, dynamic early stopping, resource-aware scheduling, and learnable noise scheduling mechanisms, the system infers whether suspicious traffic is malicious through a fine-tuned fully connected layer.

8. The malicious encrypted traffic detection method based on a diffusion model according to claim 7, characterized in that, By utilizing accelerated sampling, dynamic early stopping, resource-aware scheduling, and learnable noise scheduling mechanisms, a fine-tuned fully connected layer is used to infer whether suspicious traffic is malicious, including: During the reasoning process of suspicious traffic through the fine-tuned fully connected layer, real-time denoised trajectories are obtained, and based on the number of diffusion steps corresponding to the real-time denoised trajectories, real-time trajectory interception is performed on the normal diffusion trajectories to obtain real-time comparison trajectories. The real-time distance between the real-time denoised trajectory and its corresponding real-time comparison trajectory is calculated using the Sliced ​​Wasserstein Distance. If the real-time distance is continuously greater than the preset distance threshold in the first preset diffusion step, the original traffic corresponding to the real-time denoising trajectory is determined to be malicious traffic, and the real-time denoising trajectory inference ends. If the real-time distance is continuously less than the adjusted distance threshold in the second preset diffusion step, the original traffic corresponding to the real-time denoising trajectory is determined to be normal traffic, and the real-time denoising trajectory inference ends. Otherwise, continue the denoised trajectory reasoning until the reasoning is complete. When the final generation distance of the suspicious traffic is less than the adjusted distance threshold, the suspicious traffic is determined to be normal traffic. Otherwise, the suspicious traffic is determined to be malicious traffic.

9. The malicious encrypted traffic detection method based on a diffusion model according to claim 1, characterized in that, Also includes: The display module provides real-time information on the inference steps and resource usage of the pre-trained stable diffusion model. After the inference is completed, traffic detection records are automatically generated and uploaded to the cloud based on the inference-related data.

10. A method for detecting malicious encrypted traffic based on a diffusion model according to claim 5, characterized in that, Also includes: Based on current network traffic, the preset distance threshold is adjusted in real time, including: Obtain the conditional embedding vectors, encryption protocol parameters, and domain characteristics of normal traffic during multiple traffic surge periods within the current time interval; The conditional embedding vectors, encryption protocol parameters, and domain name features of multiple traffic burst periods are compared and features are extracted to obtain the conditional embedding vector features, encryption protocol parameter features, and comprehensive domain name features of the current time interval. The conditional embedding vector features, encryption protocol parameter features, and domain name comprehensive features are input into the pre-trained stable diffusion model to process normal traffic and obtain normal traffic adversarial samples. The difference between the normal traffic adversarial sample and its corresponding normal traffic is calculated using the Sliced ​​Wasserstein Distance. Based on the degree of difference corresponding to all normal traffic, a difference interval is generated, and the maximum value of the difference interval is used as the preset distance threshold for the next time interval.

Images