A malicious encrypted traffic detection method based on diffusion model

Abstract

The application provides a malicious encrypted traffic detection method based on a diffusion model, comprising: cutting the received original traffic to obtain multiple session flows, and generating corresponding packet-level data flows; analyzing and converting each data packet in the packet-level data flows to generate a three-channel traffic graph; using a pre-trained stable diffusion model to perform forward noise addition and reverse denoising learning on the three-channel traffic graph in a latent space, and output a denoised trajectory; calculating the generation distance between the denoised trajectory and a normal diffusion trajectory, and judging whether the original traffic is suspicious traffic according to the generation distance; and using a LORA low-rank matrix to fine-tune the full connection layer of the pre-trained stable diffusion model, and judging whether the suspicious traffic is malicious traffic according to the fine-tuned full connection layer. The application realizes efficient and accurate identification of malicious encrypted traffic without decrypting the payload.

Description

Technical Field

[0001] This invention relates to the field of malicious encrypted traffic detection technology, and in particular to a method for detecting malicious encrypted traffic based on a diffusion model. Background Technology

[0002] With the mandatory implementation of TLS 1.3, QUIC, and HTTPS, the proportion of encrypted traffic on the global internet has exceeded 85%, and this proportion is even higher than 90% within enterprise campuses and cloud data centers. These encryption protocols have achieved significant results in ensuring data confidentiality and integrity, but they have also provided covert channels for malware, advanced persistent threats (APTs), command and control (C2) communications, and data breaches. Traditional protection systems based on deep packet inspection (DPI) have gradually lost their effectiveness against zero-day attacks, defense bypasses, and privacy protections because they cannot examine packet content. The limitation of existing detection technologies lies in the fact that all mainstream methods focus on a discriminative paradigm: finding a classification hyperplane in a predefined feature space. When traffic distributions exhibit conceptual drift, or when encountering unseen new threats (such as zero-day attacks or variants), the model often lacks a reliable measure of uncertainty, leading to missed detections or false positives. Summary of the Invention

[0003] This invention provides a method for detecting malicious encrypted traffic based on a diffusion model, which solves the problems of weak generalization, heavy reliance on feature engineering, and insufficient zero-day attack detection capabilities of existing technologies. It achieves efficient and accurate identification of malicious encrypted traffic without the need for decryption payload.

[0004] This invention provides a method for detecting malicious encrypted traffic based on a diffusion model, comprising:

[0005] The received raw traffic is segmented to obtain multiple session streams, and corresponding packet-level data streams are generated. Each data packet in the packet-level data stream is parsed and transformed to generate a three-channel traffic graph.

[0006] Using a pre-trained stable diffusion model, forward noise addition and backward denoising learning are performed on the three-channel flow map in the latent space, and the denoised trajectory is output. The generation distance between the denoised trajectory and the normal diffusion trajectory is calculated, and the original flow is judged as suspicious flow based on the generation distance.

[0007] By using the LORA low-rank matrix, the fully connected layer of the pre-trained stable diffusion model is fine-tuned, and inference is performed based on the fine-tuned fully connected layer to determine whether suspicious traffic is malicious traffic.

[0008] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, the original traffic is received and segmented to obtain multiple session streams, and corresponding data packet streams are generated, including:

[0009] Receive raw traffic;

[0010] The original traffic is segmented according to the time window and the five-tuple rule to obtain multiple session streams;

[0011] Based on each session stream, and by reordering the packets in each session stream, multiple data packets are obtained;

[0012] For each session stream, a packet sequence is extracted to obtain a packet sequence, and a corresponding packet-level data stream is generated based on the packet sequence.

[0013] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, each data packet in the packet-level data stream is parsed and transformed to generate a traffic graph, including:

[0014] Each data packet in the packet-level data stream is parsed to generate a header matrix and a payload matrix;

[0015] Following the time sequence of data packets along the vertical axis, the header matrix and payload matrix of multiple data packets within the packet-level data stream are concatenated and encoded to generate a two-dimensional traffic graph;

[0016] A three-channel flow map is obtained by mapping the two-dimensional flow map using color, position, and channel encoding.

[0017] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, a pre-trained stable diffusion model is used to learn forward denoising and backward denoising on a three-channel traffic graph in the latent space, and outputs a denoised trajectory, including:

[0018] Conditional embedding vectors are generated based on session duration, packet count, average packet interval, and directional ratio of each packet-level data stream.

[0019] Input latent variables and conditional embedding vectors into a pre-trained stable diffusion model, perform forward noise addition and backward denoising learning on the three-channel flow graph in the latent space, and obtain the denoised latent variables.

[0020] The latent variables input to the pre-trained stable diffusion model are recorded to generate denoised trajectories.

[0021] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, the generation distance between the denoised trajectory and the normal diffusion trajectory is calculated, and based on the generation distance, it is determined whether the original traffic is suspicious traffic, including:

[0022] The Sliced ​​Wasserstein Distance was used to calculate the generation distance between the denoised trajectory and the normal diffusion trajectory of the pre-trained stable diffusion model;

[0023] Compare the generated distance with a preset distance threshold;

[0024] When the generated distance is greater than a preset distance threshold, the original traffic is determined to be suspicious traffic.

[0025] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, when the generation distance is less than or equal to a preset distance threshold, the method includes:

[0026] The conditional embedding vector corresponding to each package-level data stream is obtained and compared with the corresponding preset standard interval to obtain the first index difference. Based on the first index difference corresponding to each element and its corresponding preset weight, the comprehensive index difference of the conditional embedding is calculated.

[0027] When the difference in the comprehensive index is less than or equal to the preset difference, the original traffic is determined to be normal traffic.

[0028] Otherwise, obtain the average number of packets and the directional ratio of the maximum transmission frequency period corresponding to each packet-level traffic data, and calculate the second index difference based on the average number of packets and the directional ratio and their corresponding preset standard intervals.

[0029] The difference between the second indicator and the difference between the comprehensive indicator are compared to obtain the element deviation coefficient, and the weights are redistributed based on the preset weights corresponding to the average number of packages and the direction ratio.

[0030] The threshold correction coefficient is calculated based on the redistribution weights corresponding to the average number of packages and the directional ratio, as well as their corresponding element deviation coefficients.

[0031] The adjusted distance threshold is obtained based on the threshold correction coefficient, the classification confidence of the pre-trained stable diffusion model, and the preset distance threshold.

[0032] When the generated distance is less than the adjusted distance threshold, the original traffic is determined to be normal traffic;

[0033] Otherwise, the original traffic is determined to be suspicious traffic.

[0034] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, the fully connected layer of a pre-trained stable diffusion model is fine-tuned using a low-rank LORA matrix, and inference is performed based on the fine-tuned fully connected layer to determine whether suspicious traffic is malicious, including:

[0035] The weight matrix in the fully connected layer of the pre-trained stable diffusion model is decomposed based on the LORA low-rank matrix to complete the fine-tuning of the pre-trained stable diffusion model.

[0036] By utilizing accelerated sampling, dynamic early stopping, resource-aware scheduling, and learnable noise scheduling mechanisms, the system infers whether suspicious traffic is malicious through a fine-tuned fully connected layer.

[0037] Preferably, in a malicious encrypted traffic detection method based on a diffusion model, accelerated sampling, dynamic early stopping, resource-aware scheduling, and learnable noise scheduling mechanisms are used to infer suspicious traffic through a fine-tuned fully connected layer to determine whether the suspicious traffic is malicious, including:

[0038] During the reasoning process of suspicious traffic through the fine-tuned fully connected layer, real-time denoised trajectories are obtained, and based on the number of diffusion steps corresponding to the real-time denoised trajectories, real-time trajectory interception is performed on the normal diffusion trajectories to obtain real-time comparison trajectories.

[0039] The real-time distance between the real-time denoised trajectory and its corresponding real-time comparison trajectory is calculated using the Sliced ​​Wasserstein Distance.

[0040] If the real-time distance is continuously greater than the preset distance threshold in the first preset diffusion step, the original traffic corresponding to the real-time denoising trajectory is determined to be malicious traffic, and the real-time denoising trajectory inference ends.

[0041] If the real-time distance is continuously less than the adjusted distance threshold in the second preset diffusion step, the original traffic corresponding to the real-time denoising trajectory is determined to be normal traffic, and the real-time denoising trajectory inference ends.

[0042] Otherwise, continue the denoised trajectory reasoning until the reasoning is complete. When the final generation distance of the suspicious traffic is less than the adjusted distance threshold, the suspicious traffic is determined to be normal traffic.

[0043] Otherwise, the suspicious traffic is determined to be malicious traffic.

[0044] Preferably, in a method for detecting malicious encrypted traffic based on a diffusion model, the method further includes:

[0045] The display module provides real-time information on the inference steps and resource usage of the pre-trained stable diffusion model.

[0046] After the inference is completed, traffic detection records are automatically generated and uploaded to the cloud based on the inference-related data.

[0047] Preferably, in a method for detecting malicious encrypted traffic based on a diffusion model, the method further includes:

[0048] Based on current network traffic, the preset distance threshold is adjusted in real time, including:

[0049] Obtain the conditional embedding vectors, encryption protocol parameters, and domain characteristics of normal traffic during multiple traffic surge periods within the current time interval;

[0050] The conditional embedding vectors, encryption protocol parameters, and domain name features of multiple traffic burst periods are compared and features are extracted to obtain the conditional embedding vector features, encryption protocol parameter features, and comprehensive domain name features of the current time interval.

[0051] The conditional embedding vector features, encryption protocol parameter features, and domain name comprehensive features are input into the pre-trained stable diffusion model to process normal traffic and obtain normal traffic adversarial samples.

[0052] The difference between the normal traffic adversarial sample and its corresponding normal traffic is calculated using the Sliced ​​Wasserstein Distance.

[0053] Based on the degree of difference corresponding to all normal traffic, a difference interval is generated, and the maximum value of the difference interval is used as the preset distance threshold for the next time interval.

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] This invention divides the detection of malicious encrypted traffic into three parts: traffic-to-image conversion, application of a pre-trained diffusion model, and fine-tuning of the diffusion model. The traffic-to-image conversion part segments the raw traffic into session streams and converts them into a three-channel traffic graph. This transforms network traffic from raw binary data into a visualized image, breaking through the traditional feature-engineering-based detection method. It maps the time-series features, packet structure features, and protocol interaction features of the traffic data to the pixel space of the image. Without parsing encrypted content or accessing the actual user payload data, it can capture subtle pattern changes and abnormal features in encrypted traffic, presenting the inherent characteristics of the traffic more comprehensively and intuitively, and significantly improving the detection capability for complex encrypted traffic. Application of the pre-trained diffusion model: The pre-trained stable diffusion model is used to learn forward denoising and backward denoising in the latent space to simulate the data generation process. Suspicious traffic is judged by calculating the generation distance between the denoised trajectory and the normal diffusion trajectory. This allows the diffusion model to learn the data distribution and generation rules of normal traffic and form a robust representation of the characteristics of normal traffic. When encountering abnormal traffic, the significant change in generation distance can sensitively identify traffic that deviates from the normal pattern, effectively distinguishing between normal and suspicious traffic. It has good generalization detection capability for unknown types of malicious traffic, overcoming the problem that traditional rule-based or statistical feature-based detection methods are insufficient in detecting zero-day attacks and new variant malicious traffic. The diffusion model fine-tuning section fine-tunes the fully connected layers of the pre-trained stable diffusion model using a low-rank LORA matrix. While maintaining the overall model structure and parameters, it optimizes model performance for specific scenarios and datasets with lower computational cost and less training data. This not only accelerates model training and reduces computational resource consumption but also allows for flexible model adjustments based on different network environments and attack characteristics. This improves the accuracy of identifying malicious traffic within suspicious traffic, achieving high-precision malicious traffic identification while reducing false positives and false negatives, thus enhancing the practicality and reliability of the detection system. This invention employs a two-stage detection strategy: first judging suspicious traffic, then identifying malicious traffic within it. This hierarchical approach gradually narrows the detection range, reducing computational complexity. While ensuring detection accuracy, it also effectively enhances the system's processing power and robustness, facilitating the application of malicious encrypted traffic detection in large-scale, complex, and ever-changing network traffic scenarios.

[0056] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.

[0057] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0058] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0059] Figure 1 This is a framework diagram of a malicious encrypted traffic detection method based on a diffusion model;

[0060] Figure 2 A flowchart for processing raw traffic;

[0061] Figure 3 This is a flowchart for converting a three-channel flow chart. Detailed Implementation

[0062] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0063] Example 1:

[0064] This invention provides a method for detecting malicious encrypted traffic based on a diffusion model, comprising:

[0065] The received raw traffic is segmented to obtain multiple session streams, and corresponding packet-level data streams are generated. Each data packet in the packet-level data stream is parsed and transformed to generate a three-channel traffic graph.

[0066] Using a pre-trained stable diffusion model, forward noise addition and backward denoising learning are performed on the three-channel flow map in the latent space, and the denoised trajectory is output. The generation distance between the denoised trajectory and the normal diffusion trajectory is calculated, and the original flow is judged as suspicious flow based on the generation distance.

[0067] By using the LORA low-rank matrix, the fully connected layer of the pre-trained stable diffusion model is fine-tuned, and inference is performed based on the fine-tuned fully connected layer to determine whether suspicious traffic is malicious traffic.

[0068] In this embodiment, LORA is a low-resource fine-tuning method for large models. Using LORA, the training parameters are only one ten-thousandth of the overall parameters, the GPU memory usage is reduced by 2 / 3, and no additional inference time is introduced.

[0069] The beneficial effects of the above technical solution: The present invention is as follows Figure 1As shown, the detection of malicious encrypted traffic is divided into three parts: traffic-to-image conversion, application of pre-trained diffusion models, and fine-tuning of diffusion models. The traffic-to-image conversion part: The original traffic is segmented into session streams and converted into a three-channel traffic graph. This realizes the transformation of network traffic from raw binary data to a visualized image, breaking through the traditional feature engineering-based detection method. It maps the time-series features, packet structure features, and protocol interaction features of traffic data to the pixel space of the image. Without parsing encrypted content or accessing the actual user payload data, it can capture subtle pattern changes and abnormal features in encrypted traffic, presenting the inherent characteristics of traffic more comprehensively and intuitively, and significantly improving the detection capability for complex encrypted traffic. Application of the pre-trained diffusion model: The pre-trained stable diffusion model is used to learn forward denoising and backward denoising in the latent space to simulate the data generation process. Suspicious traffic is judged by calculating the generation distance between the denoised trajectory and the normal diffusion trajectory. This allows the diffusion model to learn the data distribution and generation rules of normal traffic and form a robust representation of the characteristics of normal traffic. When encountering abnormal traffic, the significant change in generation distance can sensitively identify traffic that deviates from the normal pattern, effectively distinguishing between normal and suspicious traffic. It has good generalization detection capability for unknown types of malicious traffic, overcoming the problem that traditional rule-based or statistical feature-based detection methods are insufficient in detecting zero-day attacks and new variant malicious traffic. The diffusion model fine-tuning section fine-tunes the fully connected layers of the pre-trained stable diffusion model using a low-rank LORA matrix. While maintaining the overall model structure and parameters, it optimizes model performance for specific scenarios and datasets with lower computational cost and less training data. This not only accelerates model training and reduces computational resource consumption but also allows for flexible model adjustments based on different network environments and attack characteristics. This improves the accuracy of identifying malicious traffic within suspicious traffic, achieving high-precision malicious traffic identification while reducing false positives and false negatives, thus enhancing the practicality and reliability of the detection system. This invention employs a two-stage detection strategy: first judging suspicious traffic, then identifying malicious traffic within it. This hierarchical approach gradually narrows the detection range, reducing computational complexity. While ensuring detection accuracy, it also effectively enhances the system's processing power and robustness, facilitating the application of malicious encrypted traffic detection in large-scale, complex, and ever-changing network traffic scenarios.

[0070] Example 2:

[0071] Based on Example 1, the raw traffic is received and segmented to obtain multiple session streams, and corresponding data packet streams are generated, such as... Figure 2 As shown, it includes:

[0072] Receive raw traffic;

[0073] The original traffic is segmented according to the time window and the five-tuple rule to obtain multiple session streams;

[0074] Based on each session stream, and by reordering the packets in each session stream, multiple data packets are obtained;

[0075] For each session stream, a packet sequence is extracted to obtain a packet sequence, and a corresponding packet-level data stream is generated based on the packet sequence.

[0076] The beneficial effects of the above technical solution are as follows: This invention segments the raw traffic according to time windows and the five-tuple rule, dividing the massive and disordered raw traffic into multiple independent session streams. The time window can be flexibly set according to the changing patterns of network traffic, ensuring the temporal correlation of captured traffic. The five-tuple (source IP, destination IP, source port, destination port, protocol) rule accurately locates the communicating parties and protocol type, ensuring that each session stream corresponds to a specific network communication process. This achieves precise segmentation of session streams, avoids interference between traffic characteristics of different sessions, significantly improves the targeting and accuracy of malicious encrypted traffic detection in specific communication scenarios, and provides an accurate data foundation for subsequent malicious encrypted traffic detection. Furthermore, packet reordering and data packet sequence extraction are performed on each session stream to ensure that data packets are arranged in the correct order, completely restoring the real process of network communication. This effectively solves the problem of data packets being out of order due to various reasons during network transmission, thereby avoiding the loss or misreading of traffic characteristics due to disordered data packet order. It generates packet-level data streams, transforming traffic information into structured data and fully preserving key information such as the temporal characteristics and interaction patterns of the traffic. This provides an accurate and complete data foundation for subsequent generation of three-channel traffic maps and diffusion model-based analysis, ensuring the reliability of the detection results.

[0077] Example 3:

[0078] Based on Example 1, each data packet in the packet-level data stream is parsed and transformed to generate a traffic graph, such as... Figure 3 As shown, it includes:

[0079] Each data packet in the packet-level data stream is parsed to generate a header matrix and a payload matrix;

[0080] Following the time sequence of data packets along the vertical axis, the header matrix and payload matrix of multiple data packets within the packet-level data stream are concatenated and encoded to generate a two-dimensional traffic graph;

[0081] A three-channel flow map is obtained by mapping the two-dimensional flow map using color, position, and channel encoding.

[0082] In this embodiment, color, position, and channel encoding are implemented according to the following rules: the R channel corresponds to the incoming packet, the G channel corresponds to the outgoing packet, and the B channel encodes the protocol stack information.

[0083] In this embodiment, the packet header matrix extracts fields such as IP header, TCP header, and TLS header, which contain basic network communication information such as protocol type and source / destination address.

[0084] In this embodiment, the load matrix extracts the packet body byte content; fixed byte block sizes are used for padding or truncation to ensure image size consistency.

[0085] The beneficial effects of the above technical solution are as follows: This invention integrates multi-dimensional information such as packet header information, payload content, and time sequence to generate a two-dimensional traffic graph. After being spliced ​​and encoded along the time axis, combined with color, position, and channel encoding, it forms an image representation containing rich semantic information. This achieves multi-dimensional information fusion of traffic data, comprehensively reflecting the characteristics and behavioral patterns of network traffic. It is beneficial to more accurately depict the differences between normal and malicious traffic, thereby significantly improving the accuracy of malicious encrypted traffic detection and reducing false positives and false negatives. Even with encrypted payload data, this invention can still use packet header information, packet sequence relationships, and visual encoding to mine potential patterns and abnormal features in traffic data from the structural and behavioral levels. It bypasses the difficulties of traditional encrypted data content analysis, providing an effective solution for malicious encrypted traffic detection. This effectively enhances the adaptability and detection capability of encrypted traffic, and is conducive to better responding to the increasing threats of encrypted malicious traffic.

[0086] Example 4:

[0087] Based on Example 1, a pre-trained stable diffusion model is used to learn forward denoising and backward denoising of the three-channel flow map in the latent space, and the denoised trajectory is output, including:

[0088] Conditional embedding vectors are generated based on session duration, packet count, average packet interval, and directional ratio of each packet-level data stream.

[0089] Input latent variables and conditional embedding vectors into a pre-trained stable diffusion model, perform forward noise addition and backward denoising learning on the three-channel flow graph in the latent space, and obtain the denoised latent variables.

[0090] The latent variables input to the pre-trained stable diffusion model are recorded to generate denoised trajectories.

[0091] The beneficial effects of the above technical solution are as follows: This invention generates conditional embedding vectors based on session duration, packet count, average packet interval, and directional ratio of packet-level data streams. It quantifies and fuses key features of network traffic in the time, quantity, interval, and communication direction dimensions, and inputs them into a pre-trained stable diffusion model. This achieves the fusion of original traffic features. Furthermore, by performing forward denoising and backward denoising on the three-channel traffic graph in the latent space, the model not only learns the original features of the traffic graph but also uncovers the potential relationships and dependencies between features, enabling a more comprehensive and in-depth learning of the feature representation of traffic data. Especially for complex and variable malicious encrypted traffic, the model can identify abnormal features deviating from normal patterns through the denoising process, thereby improving the sensitivity and accuracy of malicious traffic detection. Recording the latent variables input to the pre-trained stable diffusion model to generate denoising trajectories is beneficial for discovering potential risks and improving the accuracy of suspicious traffic detection.

[0092] Example 5:

[0093] Based on Example 1, the generation distance between the denoised trajectory and the normal diffusion trajectory is calculated, and based on the generation distance, it is determined whether the original traffic is suspicious traffic, including:

[0094] The Sliced ​​Wasserstein Distance was used to calculate the generation distance between the denoised trajectory and the normal diffusion trajectory of the pre-trained stable diffusion model;

[0095] Compare the generated distance with a preset distance threshold;

[0096] When the generated distance is greater than a preset distance threshold, the original traffic is determined to be suspicious traffic.

[0097] In this embodiment, Sliced ​​Wasserstein Distance (SWD) is a geometrically meaningful measure of difference.

[0098] In this embodiment, the pre-trained stable diffusion model is divided into forward diffusion and reverse denoising processes;

[0099] Wherein, the forward diffusion process, given the original latent variable Z0, has the latent representation at time t of the diffusion step as:

[0100]

[0101] Among them, Z t The latent variable at time t represents the diffusion step. ε represents the proportion of noise in the fixed noise schedule; ε~N(0,I) represents standard Gaussian noise;

[0102] Inverse denoising modeling is achieved by constructing a parameterized network ε0(Z)t ,t,c) are used to predict noise, where c represents a conditional embedding vector containing duration, number of packets, and orientation;

[0103] The loss function to be minimized during the training phase of the pre-trained stable diffusion model is as follows:

[0104]

[0105] in, This represents the minimum loss function of the pre-trained stable diffusion model during the training phase. This indicates additional embedded conditions added based on user needs (e.g., encryption protocol parameters, domain name characteristics, etc.).

[0106] The beneficial effects of the above technical solution are as follows: This invention uses Sliced ​​Wasserstein Distance (SWD) to calculate the generation distance between the denoised trajectory and the normal diffusion trajectory, which can effectively measure the difference between the two distributions. In the scenario of malicious encrypted traffic detection, the denoised trajectory of normal traffic will follow the normal distribution pattern learned by the pre-trained stable diffusion model, while the denoised trajectory of malicious traffic will deviate from this pattern. SWD can capture this distribution difference. Even in high-dimensional space, it can accurately reflect the degree of difference between the two trajectories in the overall distribution by integrating the one-dimensional distribution difference in the random projection direction. Compared with traditional Euclidean distance or cosine similarity, SWD can more sensitively discover potential malicious traffic features and improve detection accuracy. Moreover, the calculation of the generation distance enables the mining of abnormal features hidden behind encrypted traffic and the effective identification of encrypted malicious traffic, making up for the limitations of traditional content analysis-based methods when facing encrypted traffic. It can more accurately distinguish between normal traffic and suspicious traffic and effectively reduce the false alarm rate. By comparing the generated distance with a preset distance threshold, automated suspicious traffic judgment based on quantitative indicators is achieved, which effectively improves detection efficiency, enables rapid response to changes in network traffic, and facilitates timely detection of suspicious traffic. At the same time, the threshold setting can be adjusted according to different network environments and security requirements, enhancing the flexibility and adaptability of the detection method, making it suitable for network systems of various sizes and types.

[0107] Example 6:

[0108] Based on Example 5, when the generated distance is less than or equal to a preset distance threshold, the following applies:

[0109] The conditional embedding vector corresponding to each package-level data stream is obtained and compared with the corresponding preset standard interval to obtain the first index difference. Based on the first index difference corresponding to each element and its corresponding preset weight, the comprehensive index difference of the conditional embedding is calculated.

[0110] When the difference in the comprehensive index is less than or equal to the preset difference, the original traffic is determined to be normal traffic.

[0111] Otherwise, obtain the average number of packets and the directional ratio of the maximum transmission frequency period corresponding to each packet-level traffic data, and calculate the second index difference based on the average number of packets and the directional ratio and their corresponding preset standard intervals.

[0112] The difference between the second indicator and the difference between the comprehensive indicator are compared to obtain the element deviation coefficient, and the weights are redistributed based on the preset weights corresponding to the average number of packages and the direction ratio.

[0113] The threshold correction coefficient is calculated based on the redistribution weights corresponding to the average number of packages and the directional ratio, as well as their corresponding element deviation coefficients.

[0114] The adjusted distance threshold is obtained based on the threshold correction coefficient, the classification confidence of the pre-trained stable diffusion model, and the preset distance threshold.

[0115] When the generated distance is less than the adjusted distance threshold, the original traffic is determined to be normal traffic;

[0116] Otherwise, the original traffic is determined to be suspicious traffic.

[0117] In this embodiment, the first index difference refers to the error value calculated by comparing each element of the conditional embedding vector (including session duration, packet count, average packet interval, and direction ratio) with the corresponding preset standard interval. The error value is the ratio of the absolute value of the difference between the actual value of each element and the upper and lower limits of the corresponding preset standard interval to the difference of the upper limit of the preset standard interval.

[0118] In this embodiment, the comprehensive index difference refers to the sum of the product of the first index difference corresponding to each element and its corresponding preset weight; the preset weight of each element can be flexibly adjusted according to the detection requirements.

[0119] In this embodiment, the second index difference refers to the error values ​​between the average number of packets and the directional ratio of the maximum transmission frequency period corresponding to each packet-level traffic data and their corresponding preset standard intervals.

[0120] In this embodiment, weight redistribution based on the preset weights corresponding to the average number of packets and the direction ratio refers to the weight value obtained after normalization processing according to the preset weights corresponding to the average number of packets and the direction ratio, which is the redistribution weight.

[0121] In this embodiment, the element deviation coefficient refers to the quotient of the difference between the second index and the difference between the comprehensive index.

[0122] In this embodiment, the threshold correction coefficient is the sum of the product of the average number of packets and the redistribution weights corresponding to the direction ratio and their corresponding element deviation coefficients.

[0123] In this embodiment, the specific calculation process for adjusting the distance threshold is as follows:

[0124] SWD′=α·SWD0+(1-α)(1-β)

[0125] Where SWD′ represents the adjusted distance threshold; SWD0 represents the preset distance threshold; α represents the threshold correction weight; and β represents the classification confidence of the pre-trained stable diffusion model.

[0126] The beneficial effects of the above technical solution are as follows: This invention can quickly filter obviously abnormal traffic by first analyzing the comprehensive index differences of the conditional embedding vector; for traffic at the threshold boundary, further refined analysis is performed through the second index difference and element deviation coefficient. The elements of the conditional embedding vector are compared with a preset standard interval to obtain the first index difference, and the comprehensive index difference is calculated based on preset weights. This transforms the abstract traffic characteristic differences into quantifiable values, making traffic judgment more objective and accurate. Subsequently, the average number of packets and the direction ratio for the maximum transmission frequency period corresponding to each packet-level traffic data are obtained. Based on the average number of packets and... The difference between the directional proportions and their corresponding preset standard intervals is calculated to obtain the second indicator difference, which can capture subtle changes in traffic behavior patterns and further improve the detection sensitivity. Then, the weights are redistributed according to the element deviation coefficient and preset weights to calculate the threshold correction coefficient. Combined with the classification confidence of the pre-trained stable diffusion model, the distance threshold is dynamically adjusted. It can automatically adjust the judgment criteria according to the real-time changes in traffic characteristics, effectively cope with the dynamic changes in the network environment and the continuous evolution of attack methods, realize the adaptive adjustment of the preset threshold, effectively reduce the false alarm rate and false negative rate, effectively enhance network security protection capabilities, and timely detect potential security threats.

[0127] Example 6:

[0128] Based on Example 1, the fully connected layers of the pre-trained stable diffusion model are fine-tuned using the LORA low-rank matrix, and inference is performed based on the fine-tuned fully connected layers to determine whether suspicious traffic is malicious, including:

[0129] The weight matrix in the fully connected layer of the pre-trained stable diffusion model is decomposed based on the LORA low-rank matrix to complete the fine-tuning of the pre-trained stable diffusion model.

[0130] By utilizing accelerated sampling, dynamic early stopping, resource-aware scheduling, and learnable noise scheduling mechanisms, the system infers whether suspicious traffic is malicious through a fine-tuned fully connected layer.

[0131] In this embodiment, the learnable noise scheduling function uses a multilayer perceptron to perform a time-conditional dual mapping of the noise amplitude.

[0132] In this embodiment, decomposing the weight matrix in the fully connected layer of the pre-trained stable diffusion model based on the LORA low-rank matrix means decomposing the weight matrix in the fully connected layer... Decomposed into:

[0133] W′=W+ΔW=W+A·B

[0134] Where W′ represents the weight matrix in the fine-tuned fully connected layer, W represents the weight matrix in the fully connected layer before fine-tuning, and ΔW represents the fine-tuning matrix of the weight matrix in the fully connected layer; the rank r of the low-rank matrix is ​​r << min(d,k), where d represents the number of rows in the weight matrix in the fully connected layer, and k represents the number of columns in the weight matrix in the fully connected layer; A represents the left factor, which is the input-side projection; B represents the right factor, which is the output-side reconstruction matrix.

[0135] Since r << min(d,k) reduces the number of parameters that need to be trained / stored, it also allows for fine-grained adjustment of the original weights W through the combination of A and B, significantly reducing training parameters and memory usage, and reducing computational and latency overhead while maintaining detection accuracy.

[0136] In this embodiment, diffusion backward inference adopts the DDIM 10-20 step fast sampling strategy.

[0137] The beneficial effects of the above technical solution are as follows: This invention decomposes and fine-tunes the weight matrix of the fully connected layer of the pre-trained stable diffusion model based on the LORA low-rank matrix, requiring only a small number of learnable parameters to be trained, significantly reducing computational overhead. Subsequently, the use of accelerated sampling techniques (such as DDIM, PLMS, etc.) can effectively improve the inference speed of the model. Combined with a dynamic early stopping mechanism, the number of sampling steps can be automatically adjusted according to the complexity of traffic features, avoiding redundant calculations. For simple traffic samples, the system can terminate the inference process early, compressing the time of a single detection from seconds to milliseconds, meeting the real-time detection requirements in high-speed network environments. The resource-aware scheduling mechanism further optimizes the allocation of computing resources, ensuring priority processing of critical traffic and effectively coping with sudden traffic surges such as DDoS (Distributed Denial of Service) attacks. Furthermore, through a learnable noise scheduling mechanism, the model can adaptively adjust the noise level during the denoising process, more sensitively capturing subtle abnormal features in suspicious traffic. It dynamically optimizes the noise distribution for different encryption algorithms and traffic patterns, enabling the model to more clearly distinguish between normal and malicious modes of traffic encryption in the latent space, which can significantly improve the accuracy of malicious traffic detection. Finally, based on the inference results, it can be determined whether the suspicious traffic is malicious, which can effectively identify advanced persistent threats (APTs) disguised as normal traffic.

[0138] Example 7:

[0139] Building upon Example 6, this example utilizes accelerated sampling, resource-aware scheduling, and learnable noise scheduling mechanisms to infer whether suspicious traffic is malicious through a fine-tuned fully connected layer. This includes:

[0140] During the reasoning process of suspicious traffic through the fine-tuned fully connected layer, real-time denoised trajectories are obtained, and based on the number of diffusion steps corresponding to the real-time denoised trajectories, real-time trajectory interception is performed on the normal diffusion trajectories to obtain real-time comparison trajectories.

[0141] The real-time distance between the real-time denoised trajectory and its corresponding real-time comparison trajectory is calculated using the Sliced ​​Wasserstein Distance.

[0142] If the real-time distance is continuously greater than the preset distance threshold in the first preset diffusion step, the original traffic corresponding to the real-time denoising trajectory is determined to be malicious traffic, and the real-time denoising trajectory inference ends.

[0143] If the real-time distance is continuously less than the adjusted distance threshold in the second preset diffusion step, the original traffic corresponding to the real-time denoising trajectory is determined to be normal traffic, and the real-time denoising trajectory inference ends.

[0144] Otherwise, continue the denoised trajectory reasoning until the reasoning is complete. When the final generation distance of the suspicious traffic is less than the adjusted distance threshold, the suspicious traffic is determined to be normal traffic.

[0145] Otherwise, the suspicious traffic is determined to be malicious traffic.

[0146] In this embodiment, before reasoning about suspicious traffic, the adjustment distance threshold of suspicious traffic is first confirmed and calculated.

[0147] In this embodiment, the first preset number is less than or equal to the second preset number.

[0148] In this embodiment, the completion of inference may be due to the dynamic early stopping mechanism or the completion of inverse denoising of the diffusion model.

[0149] The beneficial effects of the above technical solution are as follows: This invention acquires the denoised trajectory in real time and extracts the normal diffusion trajectory based on the number of diffusion steps, which can flexibly adapt to the dynamic changes of different traffic types. For example, some malicious traffic may exhibit abnormal behavior such as a surge in traffic within a short period of time. This mechanism can accurately capture such sudden change characteristics, avoid feature loss caused by fixed analysis modes, ensure comprehensive and accurate extraction of traffic features, and set continuous judgment conditions for the first and second preset times. Combined with preset distance thresholds and adjusted distance thresholds, it effectively avoids misjudgments caused by single data fluctuations. For rapidly emerging malicious attacks, if the real-time distance continuously exceeds the threshold within the first preset diffusion step, the attack can be quickly identified and blocked, achieving efficient completion of malicious traffic detection. For normal traffic, if the real-time distance continuously falls below the threshold within the second preset diffusion step, it is quickly allowed to pass, reducing unnecessary computational resource consumption and significantly improving the reliability and efficiency of detection. If the maliciousness of the traffic cannot be determined in the early stage, the denoising trajectory reasoning continues until the end, and the conclusion is drawn based on the comparison between the final generated distance and the threshold. The full-process analysis can cope with a variety of complex attack scenarios, such as staged penetration attacks. Even if the characteristics are not obvious in the early stage of the attack, differences can be accumulated throughout the entire traffic life cycle to ensure that no potential threats are missed, effectively improving the defense capability against complex attacks.

[0150] Example 8:

[0151] Based on Example 1, a malicious encrypted traffic detection method based on a diffusion model further includes:

[0152] The display module provides real-time information on the inference steps and resource usage of the pre-trained stable diffusion model.

[0153] After the inference is completed, traffic detection records are automatically generated and uploaded to the cloud based on the inference-related data.

[0154] The beneficial effects of the above technical solution are as follows: This invention displays the inference steps and resource usage of the pre-trained stable diffusion model in real time through a display module, which helps maintenance personnel to promptly grasp the model's operating status. For example, when the inference steps abnormally stop or the CPU and memory usage suddenly increase, it can promptly detect potential operational faults or resource bottlenecks in the model, avoiding missed detection of malicious traffic due to inference interruption; and automatically generates traffic detection records (including key information such as inference steps, resource consumption, and detection results) after inference is completed, forming a standardized data archive, which facilitates subsequent auditing, review, and traceability, and helps improve the standardization of network security incident management. The traffic detection records are automatically uploaded to the cloud, breaking the physical limitations of data storage, enabling collaborative access and analysis by multiple departments and regions of the maintenance unit, thereby improving the processing speed of maintenance personnel in detecting abnormal model behavior and ensuring the continuity and stability of the detection process.

[0155] Example 9:

[0156] Based on Example 5, a malicious encrypted traffic detection method based on a diffusion model further includes:

[0157] Based on current network traffic, the preset distance threshold is adjusted in real time, including:

[0158] Obtain the conditional embedding vectors, encryption protocol parameters, and domain characteristics of normal traffic during multiple traffic surge periods within the current time interval;

[0159] The conditional embedding vectors, encryption protocol parameters, and domain name features of multiple traffic burst periods are compared and features are extracted to obtain the conditional embedding vector features, encryption protocol parameter features, and comprehensive domain name features of the current time interval.

[0160] The conditional embedding vector features, encryption protocol parameter features, and domain name comprehensive features are input into the pre-trained stable diffusion model to process normal traffic and obtain normal traffic adversarial samples.

[0161] The difference between the normal traffic adversarial sample and its corresponding normal traffic is calculated using the Sliced ​​Wasserstein Distance.

[0162] Based on the degree of difference corresponding to all normal traffic, a difference interval is generated, and the maximum value of the difference interval is used as the preset distance threshold for the next time interval.

[0163] In this embodiment, the period of traffic surge is the peak period of traffic.

[0164] The beneficial effects of the above technical solution are as follows: This invention acquires conditional embedding vectors, encryption protocol parameters, and domain name features during traffic surge periods in real time, enabling it to closely follow the dynamic changes in network traffic. For example, in scenarios with surges in traffic such as e-commerce promotions and peak online education periods, this mechanism can quickly capture the feature changes of normal traffic in different dimensions, avoiding the misjudgment of normal traffic as malicious traffic due to fixed thresholds, and significantly improving the model's adaptability in complex network environments. Then, the conditional embedding vectors, encryption protocol parameters, and domain name features from multiple traffic periods are compared and extracted to form a comprehensive feature set. Taking encryption protocol parameters as an example, the distribution of parameters such as the TLS version and key exchange algorithm used by normal traffic in different periods may differ. Combined with domain name features (such as subdomain changes and access frequency), a more comprehensive normal traffic profile can be constructed, avoiding the one-sidedness of single-dimensional feature extraction, thereby improving the accuracy of the diffusion model in characterizing normal traffic features. Subsequently, a pre-trained stable diffusion model is used to generate adversarial examples of normal traffic, simulating abnormal fluctuations that may occur in real network environments. Then, a dynamic threshold is generated based on the difference in normal traffic, avoiding the problem that static thresholds cannot balance the false positive rate and the false negative rate. When the network environment changes (such as the introduction of a new business system that leads to a change in traffic patterns), the maximum value of the difference range will be dynamically adjusted according to the latest normal traffic characteristics to ensure that the preset distance threshold always fits the current network conditions and reduces the chance of missing malicious traffic or misjudging normal traffic due to threshold lag.

[0165] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for detecting malicious encrypted traffic based on a diffusion model, characterized in that, The method comprises the following steps: cutting the received original traffic to obtain multiple session flows, and generating corresponding packet-level data streams, and parsing and converting each data packet in the packet-level data stream to generate a three-channel traffic graph; using a pre-trained stable diffusion model to perform forward noise addition and reverse noise removal learning on the three-channel traffic graph in the latent space, and outputting a denoising trajectory, calculating the generation distance between the denoising trajectory and the normal diffusion trajectory, and determining whether the original traffic is suspicious traffic according to the generation distance; fine-tuning the full connection layer of the pre-trained stable diffusion model through a LORA low-rank matrix, and determining whether the suspicious traffic is malicious traffic according to the fine-tuned full connection layer; wherein using a pre-trained stable diffusion model to perform forward noise addition and reverse noise removal learning on the three-channel traffic graph in the latent space, and outputting a denoising trajectory, comprises: generating a conditional embedding vector based on the session duration, packet count, average packet interval and direction ratio of each packet-level data stream; inputting the latent variable and the conditional embedding vector into the pre-trained stable diffusion model, performing forward noise addition and reverse noise removal learning on the three-channel traffic graph in the latent space, and obtaining the denoised latent variable; recording the latent variable input into the pre-trained stable diffusion model to generate a denoising trajectory; wherein the pre-trained stable diffusion model comprises a forward diffusion and a reverse noise removal process; where the forward diffusion process is given by the original latent variable The latent representation at diffusion step t is given by: ； wherein, denotes the latent variable at diffusion step t, denotes the noise proportion in the fixed noise schedule; denotes the standard Gaussian noise; The reverse denoising modeling is performed by constructing a parameterized network for predicting the noise, wherein c denotes a conditional embedding vector comprising a duration, a packet number, a direction; The minimum loss function for the training stage of the pre-trained stable diffusion model is as follows: ； wherein, denotes the minimum loss function of the pre-trained stable diffusion model in the training stage, denotes other embedding conditions added according to user needs.

2. The method of claim 1, wherein, receiving original traffic and cutting to obtain multiple session flows, and generating corresponding data packet streams, comprising: receiving original traffic; cutting the original traffic according to the time window and the five-tuple rule to obtain multiple session flows; based on each session flow and packet sequence reorganization of each session flow, obtaining multiple data packets; extracting the data packet sequence of each session flow to obtain a packet sequence, and generating a corresponding packet-level data stream based on the packet sequence.

3. The method of claim 1, wherein, parsing and converting each data packet in the packet-level data stream to generate a traffic graph, comprising: parsing each data packet in the packet-level data stream to generate a packet header matrix and a payload matrix; according to the time sequence of the data packets, the packet header matrix and the payload matrix of multiple data packets in the packet-level data stream are spliced and encoded along the vertical axis to generate a two-dimensional traffic graph; mapping the two-dimensional traffic graph through color, position and channel coding to obtain a three-channel traffic graph.

4. The method of claim 1, wherein, calculating the generation distance between the denoising trajectory and the normal diffusion trajectory, and determining whether the original traffic is suspicious traffic according to the generation distance, comprising: calculating the generation distance between the denoising trajectory and the normal diffusion trajectory of the pre-trained stable diffusion model using Sliced Wasserstein Distance; comparing the generation distance with a preset distance threshold; when the generation distance is greater than the preset distance threshold, determining that the original traffic is suspicious traffic.

5. The method of claim 4, wherein, when the generation distance is less than or equal to the preset distance threshold, comprising: calculating the first index difference by comparing each element of the conditional embedding vector corresponding to each packet-level data stream with the corresponding preset standard interval, and calculating the comprehensive index difference of the conditional embedding based on the first index difference of each element and the corresponding preset weight of each element; When the comprehensive index difference is less than or equal to the preset difference, it is determined that the original traffic is normal traffic; Otherwise, the average number of packets and the direction ratio of each packet-level traffic data corresponding to the maximum sending frequency period are obtained, and a second index difference is calculated based on the average number of packets and the direction ratio and the preset standard interval corresponding thereto; The second index difference is compared with the comprehensive index difference to obtain an element deviation coefficient, and the average number of packets and the direction ratio are re-allocated based on the preset weight corresponding thereto; A threshold correction coefficient is calculated based on the re-allocated weight corresponding to the average number of packets and the direction ratio and the element deviation coefficient corresponding thereto; Based on the threshold correction coefficient, the classification confidence of the pre-trained stable diffusion model, and the preset distance threshold, an adjusted distance threshold is obtained; When the generated distance is less than the adjusted distance threshold, it is determined that the original traffic is normal traffic; Otherwise, it is determined that the original traffic is suspicious traffic.

6. The method of claim 1, wherein, Through the LORA low-rank matrix, the full connection layer of the pre-trained stable diffusion model is fine-tuned, and inference is performed according to the fine-tuned full connection layer to determine whether the suspicious traffic is malicious traffic, including: Based on the LORA low-rank matrix, the weight matrix in the full connection layer of the pre-trained stable diffusion model is decomposed to complete the fine-tuning of the pre-trained stable diffusion model; Using the acceleration sampling, dynamic early stopping, resource-aware scheduling and learnable noise scheduling mechanisms, the suspicious traffic is inferred through the fine-tuned full connection layer to determine whether the suspicious traffic is malicious traffic.

7. The method of claim 6, wherein, Using the acceleration sampling, dynamic early stopping, resource-aware scheduling and learnable noise scheduling mechanisms, the suspicious traffic is inferred through the fine-tuned full connection layer to determine whether the suspicious traffic is malicious traffic, including: During the inference of the suspicious traffic through the fine-tuned full connection layer, a real-time denoising trajectory is obtained, and a real-time trajectory is obtained by real-time trajectory cutting of the normal diffusion trajectory based on the number of execution diffusion steps corresponding to the real-time denoising trajectory; The real-time distance between the real-time denoising trajectory and the real-time comparison trajectory corresponding thereto is calculated using Sliced Wasserstein Distance; When the real-time distance is greater than the preset distance threshold within the first preset number of diffusion steps, it is determined that the original traffic corresponding to the real-time denoising trajectory is malicious traffic, and the real-time denoising trajectory inference is ended; When the real-time distance is less than the adjusted distance threshold within the second preset number of diffusion steps, it is determined that the original traffic corresponding to the real-time denoising trajectory is normal traffic, and the real-time denoising trajectory inference is ended; Otherwise, continue to perform denoising trajectory inference until the inference is completed, and when the final generated distance of the suspicious traffic is less than the adjusted distance threshold, it is determined that the suspicious traffic is normal traffic; Otherwise, it is determined that the suspicious traffic is malicious traffic.

8. The method of claim 1, wherein, Further comprising: Based on the display module, the real-time inference step number and resource usage of the pre-trained stable diffusion model are displayed in real time; And after the inference is completed, the traffic detection record is automatically generated based on the inference-related data and uploaded to the cloud.

9. The method of claim 4, wherein, Further comprising: Based on the current network traffic, the preset distance threshold is real-time regulated, including: Obtain the condition embedding vector, the encrypted protocol parameter and the domain name feature of the normal flow in the multiple flow burst periods in the current time interval; Respectively compare and extract features of the condition embedding vector, the encrypted protocol parameter and the domain name feature of the multiple flow burst periods, to obtain the condition embedding vector feature, the encrypted protocol parameter feature and the domain name comprehensive feature of the current time interval; Input the condition embedding vector feature, the encrypted protocol parameter feature and the domain name comprehensive feature into the pre-training stable diffusion model to process the normal flow, to obtain the normal flow adversarial sample; Calculate the difference degree between the normal flow adversarial sample and the corresponding normal flow by using Sliced Wasserstein Distance; Based on the difference degrees corresponding to all normal flows, generate a difference interval, and take the maximum value of the difference interval as the preset distance threshold of the next time interval.

Images