Conditional generative adversarial network traffic data enhancement method based on verification feedback

Abstract

The invention discloses a conditional generative adversarial network traffic data enhancement method based on verification feedback, and relates to the technical field of network security and generative data enhancement. According to the method, a double-closed-loop collaborative framework composed of a condition generator, a condition discriminator and a verification feedback classifier is adopted, the authenticity of a generated sample is improved through an adversarial training mechanism, and the verification feedback mechanism is utilized to regulate and control a generation strategy according to classification performance on a minority class verification set; therefore, collaborative optimization of authenticity and classifiability of the generated sample is realized. Meanwhile, the method introduces a parameter importance screening strategy to constrain the updating range of a generator and enhance the stability and efficiency of a training process, and guides a generated sample to reasonably cover a sparse feature region in combination with feature distribution analysis based on kernel density estimation and an adaptive generation quantity distribution mechanism. According to the method, the problem that normal and abnormal samples in the network traffic data are unbalanced can be effectively relieved, and the detection precision of minority abnormal samples is remarkably improved.

Description

Technical Field

[0001] This invention belongs to the technical field of combining network security and artificial intelligence, specifically relating to a conditional generative adversarial network traffic data augmentation method based on verification feedback. It is suitable for small-sample network intrusion detection scenarios under conditions of uneven distribution of network traffic data categories. It can be applied to enterprise network security protection, critical information infrastructure operation monitoring, IoT terminal traffic analysis, and other application scenarios requiring network traffic anomaly detection and intrusion identification. Background Technology

[0002] With the deepening of digital transformation and the widespread application of technologies such as the Internet of Things, cloud computing, and artificial intelligence in various information systems, the number of network terminal devices continues to grow, the network environment structure is becoming increasingly complex, and network attacks are exhibiting diversified, covert, and cross-domain characteristics, making the cyberspace security situation increasingly severe. Network Intrusion Detection Systems (NIDS), as one of the key technologies in network security protection systems, monitor and analyze network traffic and system behavior to identify abnormal behavior and intrusion attacks, and have been widely used in enterprise network security protection, government information systems, and critical information infrastructure operation monitoring. However, network traffic data collected in actual network environments generally suffers from a highly unbalanced distribution of categories, with normal traffic samples accounting for the vast majority, while the number of abnormal attack traffic samples is relatively small, and the sample size varies significantly between different attack types. Some attack types, due to their low frequency or difficulty in collection, often contain only a small number of samples, making it difficult for supervised learning-based intrusion detection models to fully learn the characteristics of minority attacks during training. Consequently, their ability to identify minority attacks is insufficient during the detection phase, easily leading to false negatives or missed positives, becoming a significant factor restricting the performance improvement of network intrusion detection systems.

[0003] To address the aforementioned data imbalance problem, existing technologies primarily focus on data preprocessing, improved detection algorithms, and feature engineering. Among these, oversampling, undersampling, and combined sampling techniques are widely used in data preprocessing. Oversampling expands the data by interpolating minority class samples to generate new samples, while undersampling removes redundant majority class samples to balance the distribution. Combined sampling combines the advantages of both, but simple undersampling can easily lose important information. In improving detection algorithms, cost-sensitive learning enhances minority class recognition capabilities by allocating different misclassification costs, but it struggles to fundamentally solve the problem of sample scarcity. Feature engineering reduces dimensionality and enhances separability by selecting key features, but it cannot compensate for the insufficient amount of minority class sample data.

[0004] In deep learning research on oversampling techniques, various generative models have been developed for minority class data augmentation. For example, the method combining Conditional Wasserstein Generative Adversarial Networks and Gradient Penalty (CWGAN-GP) can generate high-quality samples, but its training computation is high and it is sensitive to hyperparameters. The VAE-CWGAN-based method uses VAEs to extract latent variables and generate samples, but information loss during training limits sample diversity. The improved Conditional Variational Autoencoder (ICVAE) introduces noise to generate attack samples, but Gaussian noise causes unstable sample quality, affecting detection accuracy and generalization ability. The improved CWGAN combines the advantages of CGAN and WGAN and introduces regularization, but it is still limited by generator performance and prone to pattern collapse. Using isolated forests to remove noise and then combining them with CWGAN to synthesize samples, and GAN attack models incorporating attention mechanisms, the former relies on the noise removal effect, while the latter's precise control of feature perturbation depends on the effectiveness of the attention mechanism; if the key steps are ineffective, the quality of data augmentation cannot be guaranteed.

[0005] In general, existing network traffic data augmentation methods, when applied to imbalanced network intrusion detection scenarios, still suffer from problems such as high training complexity, strong hyperparameter dependence, insufficient diversity and stability of generated samples, and limited adaptability of generated samples to downstream detection tasks. They struggle to achieve high-quality augmentation of minority attack samples while maintaining training efficiency. Therefore, it is necessary to propose an efficient data augmentation method that can balance the quality, diversity, and task adaptability of generated samples to meet the practical application needs of network intrusion detection in imbalanced network traffic environments. Summary of the Invention

[0006] To address the aforementioned issues, this invention discloses a conditional generative adversarial network traffic data augmentation method based on verification feedback. By introducing a verification feedback-driven generator optimization mechanism, the generated samples approximate the real data distribution while effectively improving their discrimination ability in downstream intrusion detection tasks. Furthermore, through quantitative analysis of the sparsity of minority class sample feature distribution, the number of generated samples for different attack categories is adaptively determined, thereby ensuring data augmentation quality while avoiding repeated generation of feature-dense regions, thus improving overall data augmentation efficiency and detection performance.

[0007] To achieve the above objectives, the technical solution of the present invention is as follows:

[0008] A method for augmenting traffic data in a conditional generative adversarial network based on validation feedback, comprising the following steps:

[0009] Step 1: Dataset Preprocessing. Collect the raw network traffic dataset and perform data cleaning, feature encoding, feature standardization, and dataset partitioning operations on the dataset in sequence.

[0010] Step 2: Construct a data augmentation framework. Construct a data augmentation framework that includes a condition generator, a condition discriminator, and a validation feedback classifier, forming a dual-loop structure with the synergistic effect of the adversarial optimization loop and the validation feedback loop.

[0011] Step 3: Calculate the number of small sample generation. For each minority class attack sample, a generation allocation strategy driven by both sample number density and feature distribution density is adopted.

[0012] Step 4: Enhanced Sample Fusion. Based on the number of samples generated in Step 3, the conditional generator generates a corresponding number of synthetic minority class samples, which are then fused with the corresponding class samples in the original training set to construct an enhanced training set.

[0013] Optionally, the dataset preprocessing described in step 1 includes systematically preprocessing the raw network traffic data to convert it into a unified, structured numerical representation suitable for deep neural network learning, thereby providing a high-quality input foundation for subsequent feature modeling, conditional generative adversarial training, and validation feedback-driven optimization. Step 1 specifically includes:

[0014] Step 1.1: Raw data collection: Collect a network traffic intrusion detection dataset as the input data source. The dataset can be a public network traffic dataset or actual collected business network traffic data, such as NSL-KDD, UNSW-NB15, etc.

[0015] Step 1.2: Data Cleaning: Perform data cleaning processing on the collected raw network traffic data to reduce noise interference and improve data quality.

[0016] Step 1.3: Feature Encoding: In order to enable non-numerical features to be used as input to the neural network model, feature encoding and vectorization processing are performed on the network traffic data.

[0017] Step 1.4: Standardization: To prevent gradient instability caused by numerical bias due to differences in the dimensions of different features, this invention employs a standardization method to ensure that the feature data follows a distribution with zero mean and unit variance. The standardization formula is as follows:

[0018] ;

[0019] in, These are the original eigenvalues. The sample mean. The standard deviation is denoted as . This treatment ensures the balance of gradient updates for each feature during model training, significantly improving the convergence speed and stability of the generative network.

[0020] Step 1.5: Unified Labeling: This invention remaps the original attack labels into five categories: Normal, DoS, Probe, R2L, and U2R. A label encoder is used to convert the categories into integer form, facilitating the use of the dual-loop data augmentation framework.

[0021] Step 1.6: Dataset partitioning: The preprocessed dataset is partitioned using stratified sampling to obtain a training set and a test set; and the training set is further partitioned into a validation feedback dataset.

[0022] Through the above preprocessing steps, the original network traffic data is effectively converted into a unified numerical input form, noise and abnormal data are effectively suppressed, and different feature dimensions are normalized.

[0023] Optionally, step 2 describes the construction of a data augmentation framework:

[0024] The framework includes generators Conditional discriminator and validation feedback classifier The three core modules form a dual-closed-loop collaborative optimization structure through parameter interaction and loss feedback. Among them, the condition generator module... The conditional discriminator module is responsible for generating synthetic samples of the target class based on the input noise and class labels. Used to distinguish between genuine and fake input samples and extract deep feature distribution information, validating the feedback classifier. It is used to evaluate the discriminative performance of generated samples in downstream classification tasks and to provide task-level feedback signals to the generator.

[0025] The condition generator Receive random noise vector and category labels As input, the category label is converted into a dense vector by the embedding layer and then concatenated with the random noise vector as a joint input to the generator network, thereby introducing category condition constraints in the feature generation process.

[0026] The generator internally employs a multi-layer fully connected neural network structure, sequentially incorporating nonlinear activation layers and batch normalization layers to achieve nonlinear mapping and distribution modeling from a low-dimensional random noise space to a high-dimensional feature space. The generator output layer uses... The activation function imposes bounded constraints on the generated feature values ​​to stabilize the training process and ensure that the generated samples are consistent with the normalized real samples on a numerical scale.

[0027] The generator output samples are represented as follows:

[0028] ;

[0029] in, These are the generator parameters.

[0030] During generator training, a task-feedback-driven joint optimization strategy is introduced, with its overall loss function defined as follows:

[0031] ;

[0032] This is the loss weight.

[0033] Countermeasures loss in formula Generate classification loss and verification feedback loss The characteristics are as follows:

[0034] Combat losses The binary cross-entropy loss is used to measure the ability of generated samples to deceive the discriminator, including but not limited to the following equivalent expressions:

[0035] ;

[0036] in, This represents the discriminator's estimate of the probability that a sample is genuine.

[0037] Generate classification loss The consistency between the generated samples and the target category label is constrained by sparse cross-entropy loss.

[0038] ;

[0039] in, For the distribution of noise vector data, This represents the class prediction probability output by the discriminator. This is the sparse cross-entropy loss.

[0040] Verification feedback loss The classification performance on the minority class validation set is calculated to provide feedback signals to the generator, thereby improving the classifiability of the generated samples.

[0041] Loss weights It's not fixed, but rather varies with the number of training iterations. Dynamic decay ensures that the generator focuses on class discrimination in the early stages of training, and gradually focuses on improving sample fidelity in the later stages, as defined below:

[0042] ;

[0043] in, This is the current training iteration number. Set a lower limit for the total number of training iterations. Ensure that the validation feedback signal remains valid throughout the training process.

[0044] The condition discriminator Used to determine the authenticity of input samples and assist the generator in distribution approximation learning. Receives data feature vectors. Corresponding category tags As input, the class labels are mapped through the embedding layer and concatenated with the sample features. The discriminator network consists of multiple fully connected layers and... The activation layer is configured, and settings are made between each layer. A random deactivation mechanism is used to prevent overfitting.

[0045] The discriminator outputs the true probability value, which guides the backpropagation of the generator. Its objective function is defined as:

[0046] ;

[0047] in, It is a counter-loss. It is feature matching loss. It is a weighting coefficient used to balance the contributions of different loss terms.

[0048] Adversarial loss The binary cross-entropy method is used to drive the discriminator to accurately distinguish between real samples and generated samples, and its definition is as follows:

[0049] ;

[0050] in, These are real samples. These are the corresponding category tags. It is a noise vector. These are samples generated by the generator. This represents the discriminator's estimate of the probability that a sample is genuine. and These represent the distributions of real sample and noise vector data, respectively. It is the real sample loss, which measures the discriminator's ability to recognize real samples. The closer the probability output by the discriminator is to 1, the smaller the loss. This is the generated sample loss, which measures the discriminator's ability to recognize generated samples. The closer the probability output by the discriminator is to 0, the smaller the loss.

[0051] Feature matching loss To ensure that the representation of the constrained generated samples in the high-level feature space of the discriminator is as close as possible to the real samples, the mean squared error is calculated and defined as follows:

[0052] ;

[0053] in, The feature output of the discriminator's intermediate layer minimizes the difference between the features of real samples and generated samples, making the generated samples closer to the real samples in the feature space.

[0054] The verification feedback classifier The validation feedback classifier is used to evaluate the discriminative performance of generated samples in downstream classification tasks and to provide task-level feedback signals to the generator. It employs a lightweight neural network architecture to reduce computational complexity and support rapid adaptation.

[0055] Step 1: Construct a validation feedback classifier and adapt its parameters: collect noise. and target class Through generator Generate samples ,in, The parameters for the generator. Clone the current validation feedback classifier. The parameters are used to obtain a temporary classifier. Samples are generated using only a minority class. A K-step gradient update is performed on the temporary classifier to simulate the task adaptation process and evaluate the discriminative ability of the generated samples in the downstream classification task. The calculation is as follows:

[0056] ;

[0057] in, Let these be the temporary classifier parameters updated in step K. It's the learning rate. The loss is cross-entropy, and K is the number of task adaptation steps. This process forms a validation feedback loop: the generator generates minority class samples, the temporary validation feedback classifier evaluates the classification performance of the generated samples on the validation set, and feeds the gradient back to the generator to guide the targeted optimization of the generator's core parameters.

[0058] Step 2: Verify feedback loss calculation: In the validation set Above, use the updated temporary classifier Calculate the verification feedback loss The definition is as follows:

[0059] ;

[0060] Where M is the number of samples in the validation set. , These are the verification sample and the label, respectively. Measuring the contribution of generated samples to the classification performance of the minority class validation set is an important basis for adjusting the generator parameters.

[0061] Step 3: High-impact parameter selection: Filtering the generator parameter set Based on generated samples Based on the validation feedback, calculate the total loss of the generator for each parameter. gradient And calculate the parameter influence index The formulas are as follows:

[0062] ;

[0063] According to the preset threshold Select high-impact parameters and combine The generator undergoes a validation feedback loop update, while the remaining parameters do not participate in the validation feedback loop update in the current training round.

[0064] ;

[0065] Step 4: Joint Optimization of Generators: Based on Validation Feedback Loss Generate classification loss and the loss of combat Together they constitute the generator's total loss function The set of high-influence parameters is updated through backpropagation in the outer loop. This improves the overall performance of generated samples in terms of authenticity and task discriminativeness.

[0066] Step 5: Dual-loop collaborative training:

[0067] The adversarial closed loop, generator With discriminator By combating losses Game-theoretic optimization is employed. The generator attempts to generate samples that approximate the real distribution to deceive the discriminator, while the discriminator optimizes its own capabilities by distinguishing between real samples and generated samples. The two processes are trained iteratively, alternating between each other, to improve the realism of the generated samples and the diversity of the feature space.

[0068] The verification feedback closed loop, generator Through temporary validation feedback classifier verification loss The generalization ability of the generated minority class samples in downstream classification tasks is quantified. The generator adjusts the core parameters based on this loss to enhance the discriminative and generalization performance of the minority class samples.

[0069] The adversarial loop and the validation feedback loop are executed alternately during training, constituting the generator parameters. The dual constraints and bidirectional feedback mechanism enable the generator to achieve joint optimality in the feature space and task space.

[0070] Step 6: High-Influence Parameter Update: In the parameter update phase, based on the parameter influence calculated in Step 3, the parameter set for the high-influence generator is determined. .use The optimizer performs an operation based on the generator's total loss only on the subset of high-influence parameters. The gradient update is performed using the following formula:

[0071] ;

[0072] in, The outer loop learning rate controls the parameter update step size. The remaining generator parameters not selected for the high-influence parameter set do not participate in the validation feedback-driven updates in this round. By selectively updating parameters, the core generator parameters are optimized using the task-layer information carried by the validation feedback loss, improving the class discrimination ability of the generated minority class samples in downstream intrusion detection classification tasks while ensuring training efficiency.

[0073] The three modules described above form a two-layer closed-loop structure: the adversarial optimization loop between the generator and discriminator constrains the generated samples to approximate the real data distribution, while the task feedback loop between the generator and the validation feedback classifier enhances the classification and discrimination capabilities of the generated samples. Through this dual-loop collaborative mechanism, joint optimization of the generated samples in terms of distribution space realism and task space usability is achieved.

[0074] Optionally, step 3 calculates the number of small samples generated:

[0075] In imbalanced network traffic data, minority class samples are not only significantly insufficient in number, but their distribution in the feature space often exhibits high dispersion and local sparsity. Traditional sample generation methods based on fixed ratios or uniform strategies struggle to distinguish the importance of different feature regions, easily generating redundant samples in feature-dense areas, leading to wasted generation resources and weakening the model's discriminative ability. To address this, this invention proposes an adaptive calculation method for the number of generated samples, driven by the synergistic effect of sample quantity density and feature distribution density. By jointly characterizing the sparsity of minority class samples in the feature space and the global class sample quantity differences, the method dynamically determines the number of generated samples for each class, thereby achieving focused enhancement of sparse feature regions.

[0076] First, calculate the feature distribution density factor for each minority class. Let the original sample size be... The sample feature set is The probability density estimation method is used for each feature sample in the feature set. Calculate their probability density values ​​in the feature space respectively. Based on the density distribution of each sample point, a characteristic distribution density factor is constructed. Defined as:

[0077] ;

[0078] in, and These represent the minimum and maximum values ​​of the log density estimate for this category of samples, respectively. Characteristic distribution density factor. Used to characterize the overall concentration of minority class samples in the feature space. The smaller the value, the sparser the sample distribution, and the higher the demand for generating samples. When the maximum and minimum values ​​are equal, a value is set... .

[0079] The probability density value Indicates sample The density of local sample distributions in the feature space is obtained through a probability density estimation method based on training samples. Specifically:

[0080] ;

[0081] in, For bandwidth The kernel function is preferably a Gaussian kernel function, i.e.:

[0082] ;

[0083] Then calculate the small sample generation rate, using the median of the original number of samples in the global category. times As a reference value, and combined with the characteristic distribution density factor Calculation category Number of generated samples :

[0084] ;

[0085] in, This is a lower bound parameter for the generation ratio, used to ensure that each minority class still obtains the necessary number of generated samples when the feature distribution is relatively concentrated. When setting the number of samples generated for that category. .

[0086] By using the above method, while ensuring that the overall number of category samples tends to be balanced, a feature space distribution density sensing mechanism is introduced, which enables a higher proportion of data augmentation for a few categories with sparse sample distribution, thereby reducing the repeated generation of feature-dense regions and improving the diversity and discrimination effectiveness of the generated data.

[0087] Optionally, step 4 involves fusing and enhancing the samples:

[0088] After calculating the number of minority class samples generated and generating the corresponding number of synthetic minority class samples by the condition generator, this invention fuses the generated samples with the original training samples to construct an enhanced training dataset with balanced class distribution and continuous feature distribution, in order to support the stable training of the subsequent detection model, as follows:

[0089] The original training set With the generated minority class sample set Merge the data by category to form an enhanced training set. :

[0090] ;

[0091] By fusing augmented samples, the number and features of minority class samples are optimized, resulting in a high-quality, class-balanced augmented dataset that provides a solid data foundation for small-sample network intrusion detection.

[0092] Optionally, the present invention also provides a computer-readable storage medium having a computer program stored thereon:

[0093] When the program is executed by a processor in a computer system, the computer system executes the method for enhancing unbalanced network traffic data based on verification feedback in a conditional generative adversarial network according to the present invention, the method comprising at least:

[0094] The data preprocessing step involves cleaning, feature encoding, and standardization of the raw network traffic data.

[0095] Construct a dual-closed-loop collaborative data augmentation framework that includes a condition generator, a condition discriminator, and a validation feedback classifier;

[0096] Calculate the number of minority class generated samples based on feature distribution density factor and sample number constraint;

[0097] A validation feedback loop is used to guide the generator parameter updates and generate synthetic minority class samples.

[0098] The generated samples are fused with the original training samples to construct an enhanced training set;

[0099] The network traffic detection model is trained using the enhanced training set, thereby enabling the identification of abnormal network traffic behavior and intrusion detection.

[0100] The beneficial effects of this invention are as follows:

[0101] (1) The present invention constructs a dual closed-loop collaborative framework consisting of a condition generator, a condition discriminator and a validation feedback classifier. The authenticity of the generated samples is improved through an adversarial training mechanism, and the generation strategy is adjusted based on the classification performance on the minority class validation set using a validation feedback mechanism, thereby achieving collaborative optimization of the authenticity and classifiability of the generated samples.

[0102] (2) This invention introduces a parameter importance screening strategy to constrain the update range of the generator, enhancing the stability and efficiency of the training process. Simultaneously, it combines feature distribution analysis based on kernel density estimation with an adaptive generation allocation mechanism to guide generated samples to reasonably cover sparse feature regions. This method can effectively alleviate the imbalance between normal and abnormal samples in network traffic data, significantly improving the detection accuracy of minority abnormal samples. Attached Figure Description

[0103] Figure 1 This is a flowchart of a conditional generative adversarial network traffic data augmentation method based on verification feedback.

[0104] Figure 2 This is a general framework diagram for a conditional generative adversarial network traffic data augmentation method based on validation feedback.

[0105] Figure 3 This is a diagram of a dual-closed-loop collaborative training structure.

[0106] Figure 4 A graph showing the change in the number of high-influence parameters for each epoch.

[0107] Figure 5 To verify the loss curves of the discriminator, generator, and validation feedback classifier during the training process.

[0108] Figure 6 This is a confusion matrix diagram of the MLP classification results after data augmentation according to the present invention. Detailed Implementation

[0109] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0110] To address the problem of low detection accuracy and high false negative rate in network intrusion detection systems due to the scarcity of minority class attack samples in imbalanced network traffic data, this invention proposes a conditional generative adversarial network (CGAN) traffic data augmentation method based on validation feedback. This method introduces a validation set-based feedback adjustment mechanism into the traditional CGAN structure, constructing a data augmentation framework that collaboratively works with a condition generator, a condition discriminator, and a validation feedback classifier. This allows generated samples to adaptively optimize based on classification performance feedback during the validation phase, while satisfying the constraints of the real data distribution, thus significantly improving the effectiveness of generated samples for intrusion detection tasks. Furthermore, this invention introduces a feature distribution sparsity measurement mechanism based on kernel density estimation, combining global class sample quantity information to adaptively determine the number of generated samples for each minority class. This enables targeted augmentation of sparse feature regions, avoiding bias towards majority class or high-density areas.

[0111] Example:

[0112] All implementation examples of this invention are based on experimental verification using publicly available network traffic data NSL-KDD. The datasets NSL_KDD_Train.csv and NSL_KDD_Test.csv are selected as the training and test sets for the experiments of this invention, respectively. These datasets contain five common attack types and can effectively cover the data traffic types in real-world network environments.

[0113] This invention is based on the Windows 10 operating system, uses an Intel(R) Core(TM) i7-9750H CPU and an NVIDIA GeForce GTX 1050 GPU, uses Python 3.7 as the development language, TensorFlow and Keras as deep learning frameworks, and conducts related experiments in the PyCharm integrated development environment.

[0114] See Figure 1 The present invention proposes a method for enhancing traffic data in conditional generative adversarial networks based on verification feedback. The overall process includes the following steps:

[0115] Step 1: Data Preprocessing: Using publicly available network traffic data NSL-KDD, the data is sequentially processed through data cleaning, feature encoding, standardization, and dataset partitioning. Data cleaning removes missing values, duplicate records, and outliers; feature encoding converts non-numerical features into structured numerical vectors and strengthens category semantic representation through label embedding; standardization ensures that each feature follows a zero-mean, unit-variance distribution to improve model training stability; stratified sampling is used to partition the dataset into training, validation, and test sets, ensuring consistency in category distribution across subsets and providing a learnable data foundation for subsequent model training and performance evaluation.

[0116] Step 2: Construct a data augmentation framework for conditional generative adversarial networks (GANs) based on validation feedback. This framework comprises three core modules: a conditional generator, a conditional discriminator, and a validation feedback classifier, forming a dual-loop training structure with the synergistic effect of an adversarial optimization loop and a validation feedback adjustment loop. Specifically, the conditional generator generates synthetic samples corresponding to the class based on random noise vectors and class labels; the conditional discriminator generates samples by constraining them with adversarial loss and feature matching loss, making them approximate real samples in terms of feature distribution; and the validation feedback classifier evaluates the classification performance of the generated samples on an independent validation set and transmits the performance feedback signal from the validation phase to the generator, guiding its parameter update direction.

[0117] Step 3: Calculate the number of small samples generated: A generation allocation strategy driven by the synergy of sample number density and feature distribution density is adopted. First, the sparsity of the feature distribution of minority class samples is quantified by kernel density estimation combined with local distance weighting coefficient. Then, the target generation number of each minority class is dynamically calculated with a preset multiple of the median of the global class sample number as a reference benchmark. This achieves differentiated allocation by focusing on enhancing sparse areas and generating reasonably in dense areas, avoiding generation bias towards the majority class.

[0118] Step 4: Dual-Loop Collaborative Training: During the model training phase, a dual-loop collaborative optimization strategy is adopted, alternating between adversarial loop and validation feedback loop. In the adversarial loop, the generator is optimized based on the adversarial loss and the generation classification loss, while the discriminator is updated based on the adversarial loss and the feature matching loss, to improve the realism and feature consistency of the generated samples. In the validation feedback loop, the validation feedback classifier calculates the validation loss based on the classification results of the generated samples on the validation set, and selects a subset of high-contribution parameters based on the degree of influence of the generator parameters on the validation loss. Only these parameters are updated with emphasis, thereby reducing training complexity while allowing the generator to focus more on feature directions that actually contribute to improving classification performance.

[0119] Step 5: Enhanced Sample Fusion: The generated minority class synthetic samples are fused with the original training data according to category to construct an enhanced training dataset; a network intrusion detection classification model is trained based on the enhanced dataset to improve the detection accuracy of minority class attack traffic and the overall system performance, and to verify the actual effect of the data augmentation method based on verification feedback.

[0120] The specific operations for step 1, data preprocessing, are as follows:

[0121] Raw network traffic data often suffers from problems such as missing values, outliers, duplicate samples, and redundant fields due to the complex collection environment. Directly using it for model training can easily introduce noise interference, affecting model convergence stability and detection accuracy. Therefore, this invention performs systematic preprocessing on the raw network traffic data before feature extraction and model training to improve data quality and provide reliable input for the subsequent conditional generative adversarial network (GAN) data augmentation model based on validation feedback. Step 1, data preprocessing, includes the following:

[0122] Step 1.1. Raw Data Cleaning: Targeted data cleaning strategies are employed to improve data quality by addressing missing values, outliers, duplicates, and irrelevant fields in the raw network traffic data. For missing numerical features, the median of the feature in the training set is used to impute them, reducing the impact of extreme values ​​on the statistics. For missing categorical features, the mode of the feature in the training set is used to impute them. Outlier detection is performed on numerical features, based on... Calculate its mean in principle with standard deviation and will exceed the range Outlier values ​​are removed or truncated to reduce the interference of outliers on model training; completely duplicate data records are deleted; and fields that are irrelevant to modeling or are redundant are removed so that the retained features only contain the effective fields used for subsequent feature modeling and learning.

[0123] Step 1.2. One-hot encoding of categorical features: Selecting features from the cleaned feature set... These seven categorical features are subjected to one-hot encoding, which maps each category to a mutually exclusive 0-1 vector representation to avoid introducing numerical relationships between categories and to improve the model's ability to express discrete features.

[0124] Step 1.3. Macro-level mapping and integer encoding of attack tags: Based on the characteristics of attack behavior, the 22 sub-categories of attack tags are classified into 5 macro-level tags: and After mapping the labels in the training and test sets, the five macro-attack labels are further encoded using integers to adapt to the training requirements of the classification model.

[0125] Step 1.4. Numerical Feature Standardization: Eliminating dimensional differences and stabilizing model training. Select numerical features and perform standardization to ensure each feature follows a zero mean. Unit variance The distribution, standardized formula is:

[0126] ;

[0127] in, These are the original eigenvalues. The mean of this feature is used to train the set. The standard deviation of this feature is used for the training set.

[0128] Step 1.5. Dataset Stratification: After completing the above preprocessing operations, the sample data is stratified. Based on the attack category labels, samples are stratified and sampled to divide the dataset into a training subset for model parameter learning and a validation subset for performance evaluation and feedback tuning. This ensures that the category distribution remains consistent across subsets, providing stable and reliable data support for subsequent processing.

[0129] Step 2 involves constructing a conditional generative adversarial network (GAN) data augmentation framework based on validation feedback, as detailed below:

[0130] By constructing a condition generator Conditional discriminator and validation feedback classifier The three-module collaborative structure combines adversarial generation mechanisms with verification feedback adjustment mechanisms to achieve dual-constraint learning on the authenticity of generated samples and the classifiability of the task. This overcomes the technical deficiency of traditional CGANs, which only focus on sample distribution approximation and neglect the adaptability to downstream classification tasks. Its specific construction method is as follows:

[0131] Condition generator Receive random noise vector and category labels As input, the class labels are converted into dense vectors by the embedding layer and then concatenated with the noise vector before being fed into the generator network. The generator internally includes multiple fully connected networks, non-linear activation layers, and batch normalization layers to map from low-dimensional noise to a high-dimensional feature space. The output layer uses the tanh activation function to ensure that the generated feature range is consistent with the normalized real samples. The generator output sample is represented as follows:

[0132] ;

[0133] in, These are the generator parameters.

[0134] The loss function for designing the generator is: It is to combat losses Generate classification loss and verification feedback loss Weighted sum:

[0135] ;

[0136] Combat losses The binary cross-entropy loss is used to measure the ability of generated samples to deceive the discriminator.

[0137] ;

[0138] Generate classification loss The consistency between the generated samples and the target category label is constrained by sparse cross-entropy loss.

[0139] ;

[0140] Verification feedback loss The classification performance on the minority class validation set is calculated to provide feedback signals to the generator, thereby improving the classifiability of the generated samples.

[0141] Loss weights It's not fixed, but rather varies with the number of training iterations. Dynamic decay ensures that the generator focuses on class discrimination in the early stages of training, and gradually focuses on improving sample fidelity in the later stages, as defined below:

[0142] ;

[0143] in, These are the corresponding category tags. It is a noise vector. This represents the discriminator's estimate of the probability that a sample is genuine. These are samples generated by the generator. This represents the class prediction probability output by the discriminator. For sparse cross-entropy loss, This is the current training iteration number. Set a lower limit for the total number of training iterations. Ensure that the validation feedback signal remains valid throughout the training process.

[0144] Through the above joint optimization strategy, the generator can not only learn the distribution characteristics of samples of each category, but also adaptively enhance the discrimination performance of the generated samples at the task level.

[0145] Conditional discriminator Used to determine the authenticity of input samples and assist the generator in distribution approximation learning. Receives data feature vectors. Corresponding category tags As input, the class labels are mapped through the embedding layer and concatenated with the sample features. The discriminator network consists of multiple fully connected layers and... The activation layer is configured, and settings are made between each layer. A random deactivation mechanism is used to prevent overfitting.

[0146] The discriminator outputs the true probability value, which guides the backpropagation of the generator. Its objective function is defined as:

[0147] ;

[0148] in, It is a counter-loss. It is feature matching loss. It is a weighting coefficient used to balance the contributions of different loss terms.

[0149] Adversarial loss The binary cross-entropy method is used to drive the discriminator to accurately distinguish between real samples and generated samples, and its definition is as follows:

[0150] ;

[0151] in, These are real samples. These are the corresponding category tags. It is a noise vector. These are samples generated by the generator. This represents the discriminator's estimate of the probability that a sample is genuine. and These represent the distributions of real sample and noise vector data, respectively. It is the real sample loss, which measures the discriminator's ability to recognize real samples. The closer the probability output by the discriminator is to 1, the smaller the loss. This is the generated sample loss, which measures the discriminator's ability to recognize generated samples. The closer the probability output by the discriminator is to 0, the smaller the loss.

[0152] Feature matching loss To ensure that the representation of the constrained generated samples in the high-level feature space of the discriminator is as close as possible to the real samples, the mean squared error is calculated and defined as follows:

[0153] ;

[0154] in, The feature output of the discriminator's intermediate layer minimizes the difference between the features of real samples and generated samples, making the generated samples closer to the real samples in the feature space.

[0155] Validation Feedback Classifier It is used to evaluate the discriminative performance of generated samples in downstream network traffic classification tasks, and the classification loss on the validation set is passed as a feedback signal to the generator to guide its parameter update direction.

[0156] The validation feedback classifier employs a lightweight neural network structure to quickly classify and model the generated samples. In each training round, after initial classification training using the generated samples, it performs classification on an independent validation set. Calculate and verify feedback loss This is used to measure the generalization ability of generated samples to downstream tasks.

[0157] ;

[0158] Where M is the number of samples in the validation set. Measure the generalization contribution of generated samples to downstream classification tasks.

[0159] The structure diagram of the dual closed-loop collaborative training is as follows: Figure 3 The demonstration detailed how this patented implementation involves alternating execution and collaborative optimization of adversarial closed loops and task feedback closed loops.

[0160] Step 3, calculating the number of small samples, is as follows:

[0161] First, calculate the feature distribution density factor for each minority class. Let the original sample size be... The sample feature set is The probability density estimation method is used for each feature sample in the feature set. Calculate their probability density values ​​in the feature space respectively. Based on the density distribution of each sample point, a characteristic distribution density factor is constructed. Defined as:

[0162] ;

[0163] in, and These represent the minimum and maximum values ​​of the log density estimate for this category of samples, respectively. Characteristic distribution density factor. Used to characterize the overall concentration of minority class samples in the feature space. The smaller the value, the sparser the sample distribution, and the higher the demand for generating samples. When the maximum and minimum values ​​are equal, a value is set... .

[0164] The probability density value Indicates sample The density of local sample distributions in the feature space is obtained through a probability density estimation method based on training samples. Specifically:

[0165] ;

[0166] in, For bandwidth The kernel function is preferably a Gaussian kernel function, i.e.:

[0167] ;

[0168] Then calculate the small sample generation rate, using the median of the original number of samples in the global category. times As a reference value, and combined with the characteristic distribution density factor Calculation category Number of generated samples :

[0169] ;

[0170] in, This is a lower bound parameter for the generation ratio, used to ensure that each minority class still obtains the necessary number of generated samples when the feature distribution is relatively concentrated. When setting the number of samples generated for that category. .

[0171] By using the above method, while ensuring that the overall number of category samples tends to be balanced, a feature space distribution density sensing mechanism is introduced, which enables a higher proportion of data augmentation for a few categories with sparse sample distribution, thereby reducing the repeated generation of feature-dense regions and improving the diversity and discrimination effectiveness of the generated data.

[0172] This example and patent are based on the NSLKDD dataset, parameter settings. =0.2, =1.85, thus yielding the target fill size. =21563.6, the total number of Probe samples is 11656, and the feature distribution density factor is... It is 0.7612. The value is 9907.6, and the final number of generated samples is 3874; the total number of R2L samples is 995, and the feature distribution density factor is... It is 0.8301. The value was 20568.6, and the final number of generated samples was 6909; the total number of U2R samples was 52, and the feature distribution density factor was... It is 0.5674. The value is 21511.6, and the final number generated is 11748.

[0173] The table below shows the number of samples in each category of the training set before and after data augmentation for normal, DoS, Probe, R2L, and U2R categories:

[0174] category training set Augmented training set test set normal 67343 67343 9711 DoS 45927 45927 7458 Probe 11656 15530 2421 R2L 995 7904 2885 U2R 52 11800 69

[0175] Step 4, dual-closed-loop collaborative training, is detailed below:

[0176] The generator forms two independent yet mutually constraining closed loops with the conditional discriminator and the validation feedback classifier, respectively. The outer adversarial loop ensures that the generated samples approximate the real network traffic data distribution in the feature space through adversarial game between the generator and the discriminator. The inner validation feedback loop ensures that the generated samples effectively improve the discrimination performance of downstream intrusion detection classification tasks through task feedback adjustment between the generator and the validation feedback classifier. The two closed loops share generator parameters and form a dual constraint mechanism through alternating optimization.

[0177] The outer adversarial closed loop aims to improve the realism and distribution consistency of generated samples, with the generator as the participating module. With discriminator Generator input random noise With category labels Output synthetic samples The goal is to minimize the adversarial loss to deceive the discriminator; the discriminator is input with real samples. Or generate samples and corresponding labels The output sample probability is to maximize the adversarial loss to distinguish between real and fake samples.

[0178] The core of this closed loop is the design and optimization of the discriminator's total loss function, namely... Among them, combating losses Used to drive the game between the two sides. The feature matching loss is in the form of mean squared error, constraining generated samples to be consistent with real samples in the discriminator's high-level feature space to avoid pattern collapse. During optimization, the generator is first fixed, and the discriminator parameters are updated using gradient descent. Then, the discriminator is fixed again, and the adversarial loss of the generator is calculated. It is temporarily stored to prepare for subsequent integration with verification feedback loss.

[0179] The inner validation feedback loop aims to improve the discriminability and generalization ability of generated samples in downstream intrusion detection classification tasks. Participating modules include the condition generator. With validation feedback classifier In this closed loop, the generator outputs synthesized samples. The validation feedback classifier takes generated samples and their corresponding labels as input to perform fast classification modeling, and calculates the validation feedback loss on the independent validation set. This is used to measure the impact of generated samples on the performance of downstream classification tasks and is passed to the generator as a task feedback signal to guide the optimization direction of generator parameters.

[0180] The optimization steps of this closed loop are as follows: To avoid unstable interference from the verification feedback signal on the overall parameters of the generator, a selective update mechanism based on parameter influence is introduced in this invention. Let the generator parameter set be... The generator's total loss function is calculated based on the generated samples and validation feedback loss. Gradients of each parameter:

[0181] ;

[0182] Further define the parameter influence metric:

[0183] ;

[0184] According to the preset threshold The set of high-impact parameters that have a significant impact on the validation feedback loss and generation performance was selected. :

[0185] ;

[0186] Only the high-impact parameters are updated based on validation feedback, while the other parameters remain unchanged in the current training round. This ensures training stability while enabling precise adjustment of the generator by the validation feedback signal.

[0187] Based on verification feedback loss Generate classification loss Traditional combat losses Together they constitute the generator's total loss function: The generator parameters are updated through backpropagation via the outer loop. This aims to improve the overall performance of generated samples in terms of realism and task discriminativeness.

[0188] In the first round of training in this embodiment, there are 6 high-influence parameters: Param1:Name=embedding / embeddings:0,Shape=(5,50), Param2:Name=dense / kernel:0,Shape=(250,512), Param3:Name=batch_normalization / gamma:0,Shape=(512,), Param4:Name=dense_1 / kernel:0,Shape=(512,256), Param5:Name=batch_normalization_1 / gamma:0,Shape=(256,), and Param6:Name=dense_2 / kernel:0,Shape=(256,37).

[0189] The number of high-impact parameters in other rounds, such as Figure 4 .

[0190] The loss reduction statistics for the Conditional Generative Adversarial Network (CGN) based on validation feedback are as follows: Discriminator loss D: 9.552269 → 4.288661 (a decrease of 5.263608), Generator loss G: 3.808438 → 3.377272 (a decrease of 0.431166), Meta-loss VFG: 1.901768 → 0.498201 (a decrease of 1.403567). The loss curves of the discriminator, generator, and validation feedback classifier during the CGN training process are shown below. Figure 5 .

[0191] Step 5, which enhances sample fusion, is detailed below:

[0192] After calculating the number of minority class samples generated and generating the corresponding number of synthetic minority class samples by the condition generator, this invention fuses the generated samples with the original training samples to construct an enhanced training dataset with balanced class distribution and continuous feature distribution, in order to support the stable training of the subsequent detection model, as follows:

[0193] The original training set With the generated minority class sample set Merge the data by category to form an enhanced training set. :

[0194] ;

[0195] By fusing augmented samples, the number and features of minority class samples are optimized, resulting in a high-quality, class-balanced augmented dataset that provides a solid data foundation for small-sample network intrusion detection.

[0196] After data augmentation, the training set size is X=(148504,37),y=(148504,).

[0197] The following shows five samples generated in this embodiment, along with their seven feature values:

[0198] Serial Number Label protocol_type service flag duration src_bytes dst_bytes 0 Probe 7.73 7.32 4.39 0.178221 -0.792583 -0.898457 1 Probe 9.14 9.53 4.42 0.181085 -0.812246 0.687444 2 Probe 5.93 8.53 4.95 -0.060335 0.864768 -0.585264 3 Probe 8.78 4.97 6.93 0.871436 -0.477771 0.665319 4 Probe 7.70 7.07 5.75 0.551632 -0.579589 -0.831704

[0199] The augmented dataset was then subjected to a five-class classification using an MLP classifier. The evaluation metrics for each class are as follows:

[0200] precision recall f1-score DoS 0.93 0.78 0.85 Probe 0.72 0.76 0.74 R2L 0.96 0.35 0.51 U2R 0.59 0.19 0.29 normal 0.74 0.97 0.84

[0201] Final evaluation metrics: Accuracy: 0.8022, Precision: 0.8305, Recall: 0.8022, F1 Score: 0.7892, ROC AUC Score: 0.9192, Macro F1: 0.6461. Confusion matrix as follows: Figure 6 As shown.

[0202] The experiment compared the performance of the MLP model in five-class classification under three different data processing methods: ① data augmentation based on the data augmentation method of this patent; ② data augmentation based on the SMOTH method; ③ no augmentation. The specific comparison results of the three methods in terms of recall and F1 score are shown in the table below:

[0203] ① Data enhancement based on this patent ②SMOTH-based data augmentation ③ No enhancements were made. Recall (%) 80.22 76.27 75.44 f1-score(%) 78.92 74.88 72.32

[0204] The performance data for MLP five-class classification without any augmentation comes from the paper "NetworkAbnormal Traffic Detection Model Based on Semi-Supervised Deep Reinforcement Learning". Experimental results show that, compared to the SMOTH data augmentation method and the unaugmented original data, the MLP five-class classification task performed better on both core metrics after augmentation using the data from this patent. This demonstrates that the data augmentation method of this invention can effectively improve the model's classification performance.

[0205] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A method for augmenting traffic data in a conditional generative adversarial network based on validation feedback, characterized in that, Specifically, the following steps are included: Step 1: Dataset preprocessing: Collect the original network traffic dataset and perform data cleaning, structured coding, label embedding, standardization, and hierarchical partitioning strategies in sequence to ensure that the class distribution of the training set, validation set and test set are consistent, so as to provide the input basis for the subsequent generator training and validation feedback loop; Step 2: Construct a data augmentation framework: Build a framework that includes a condition generator, a condition discriminator, and a validation feedback classifier, forming a dual-loop collaborative structure of adversarial loop and validation feedback loop; the condition generator generates synthetic samples based on random noise and class labels; the condition discriminator generates samples that approximate the true distribution by constraining them with adversarial loss and feature matching loss. The validation feedback classifier provides feedback signals to the generator based on the classification performance of the minority class validation set. It updates the generator's key weights by filtering high-influence parameters, thereby achieving joint optimization of the generated samples in terms of authenticity and classifiability. Step 3: Calculate the number of small samples generated: A minority class generation strategy driven by the feature space distribution density factor and sample size constraints is adopted; the feature distribution density factor of the minority class is constructed based on kernel density estimation, and the generation benchmark is based on a preset multiple of the median of the number of global class samples. The number of generated samples is adaptively calculated according to the sparsity of each minority class to ensure that the generated samples are coordinated between quantity balance and feature diversity, avoid excessive concentration in the original high-density area, and improve the discrimination effectiveness of the augmented data. Step 4: Enhanced Sample Fusion: Merge the minority class samples generated by the condition generator with the original training set according to the target number and category to construct an enhanced training set with balanced category distribution and coherent feature distribution, providing high-quality training data for the downstream network traffic anomaly detection model.

2. The method for enhancing traffic data in a conditional generative adversarial network based on verification feedback according to claim 1, characterized in that: Step 2 involves constructing a dual-closed-loop collaborative data augmentation framework. The model framework consists of three parts: a condition generator, a condition discriminator, and a validation feedback classifier. The condition generator Receive random noise vector and category labels As input, generated samples with a distribution similar to the real data are generated through a multi-layer fully connected network. The generator loss is composed of adversarial loss, class classification loss, and validation feedback loss, which is used to simultaneously improve the realism of generated samples and downstream classification performance. The condition discriminator Then assess the authenticity of the input data and receive the data feature vector. Corresponding category tags As input, distinguish real samples and generate samples The discriminator loss is calculated based on the adversarial loss and feature matching loss, and is used to constrain the generated samples to approximate the real samples in the high-level feature space and assist the generator in optimization. The verification feedback classifier The classification performance of generated samples is evaluated on the minority class validation set. Feedback signals are provided to the generator based on the classification results of the validation set. The key weights of the generator are updated by screening high-influence parameters, thereby realizing closed-loop collaborative optimization between the generator and the validation feedback classifier, which enhances the classifiability and discriminative ability of minority class samples.

3. The method for enhancing traffic data in a conditional generative adversarial network based on verification feedback according to claim 2, characterized in that: A dual-closed-loop collaborative data augmentation framework is constructed, wherein the generator loss is as follows: The loss function of the generator is: It is to combat losses Generate classification loss and verification feedback loss Weighted sum: For loss weights; Countermeasures loss in formula Generate classification loss and verification feedback loss The characteristics are as follows: Combat losses The binary cross-entropy loss is used to measure the ability of generated samples to deceive the discriminator, including but not limited to the following equivalent expressions: in, This represents the discriminator's estimate of the probability that a sample is genuine; These are the corresponding category tags. It is a noise vector. Generate classification loss The consistency between the generated samples and the target category labels is constrained by sparse cross-entropy loss. in, For the distribution of noise vector data, This represents the class prediction probability output by the discriminator. For sparse cross-entropy loss; Verification feedback loss The classification performance on the minority class validation set is calculated to provide feedback signals to the generator, thereby improving the classifiability of the generated samples. Loss weights It's not fixed, but rather varies with the number of training iterations. Dynamic decay ensures that the generator focuses on class discrimination in the early stages of training, and gradually focuses on improving sample fidelity in the later stages, as defined below: in, This is the current training iteration number. Set a lower limit for the total number of training iterations. Ensure that the validation feedback signal remains valid throughout the training process.

4. The method for enhancing traffic data in a conditional generative adversarial network based on verification feedback according to claim 2, characterized in that: A dual-closed-loop collaborative data augmentation framework is constructed, in which the discriminator loss is jointly calculated through adversarial loss and feature matching loss. The discriminator loss Including combating losses Feature matching loss This is used to constrain the generated samples to approximate the real samples in the high-level feature space of the discriminator, and to assist in the optimization of the generator. It is defined as follows: in, It is to combat losses. It is feature matching loss. These are weighting coefficients used to balance the contributions of different loss terms; Adversarial loss The discriminator is driven by a binary cross-entropy mechanism to accurately distinguish between real and generated samples, and its definition is as follows: in, These are real samples. These are the corresponding category tags. It is a noise vector. These are samples generated by the generator. This represents the discriminator's estimate of the probability that a sample is genuine. and These represent the distributions of real sample and noise vector data, respectively. It is the real sample loss, which measures the discriminator's ability to recognize real samples. The closer the probability output by the discriminator is to 1, the smaller the loss. This is the generated sample loss, which measures the discriminator's ability to recognize generated samples. The closer the probability output by the discriminator is to 0, the smaller the loss. Feature matching loss To ensure that the representation of the constrained generated samples in the high-level feature space of the discriminator is as close as possible to the real samples, the mean squared error is calculated and defined as follows: in, The feature output of the intermediate layer of the discriminator is to minimize the feature difference between the generated sample and the real sample, so that the generated sample is closer to the real sample in the feature space, thereby improving the authenticity and discrimination ability of the generated sample.

5. The method for enhancing traffic data in a conditional generative adversarial network based on verification feedback according to claim 2, characterized in that, A dual-closed-loop collaborative data augmentation framework is constructed, which involves validating the feedback closed-loop optimization generator. The steps are as follows: Step 1: Construct a validation feedback classifier and adapt its parameters: Collect the noise vector z and class label y, and use a generator... Generate samples ,in, The parameters for the generator; clone the current validation feedback classifier. The parameters are used to obtain a temporary classifier. Samples are generated using only a minority class. A K-step gradient update is performed on the temporary classifier to simulate the task adaptation process and evaluate the discriminative ability of the generated samples in the downstream classification task. The calculation is as follows: in, These are the temporary classifier parameters updated in step K. It's the learning rate. It is the cross-entropy loss, and K is the number of task adaptation steps; this process forms a validation feedback loop: the generator generates minority class samples, the temporary validation feedback classifier evaluates the classification performance of the generated samples on the validation set, and feeds the gradient back to the generator to guide the directional optimization of the generator's core parameters; Step 2: Verify feedback loss calculation: In the validation set Above, use the updated temporary classifier Calculate the verification feedback loss The definition is as follows: Where M is the number of samples in the validation set. , The first in the verification set One verification sample and label; Measuring the contribution of generated samples to the classification performance on the minority class validation set is an important basis for adjusting the generator parameters; Step 3: High-impact parameter selection: Filtering the generator parameter set Based on generated samples And validation feedback, calculate the total loss of the generator for each parameter. gradient And calculate the parameter influence index The formulas are as follows: According to the preset threshold Select high-impact parameters and combine The generator undergoes a validation feedback loop update, while the remaining parameters do not participate in the validation feedback loop update in the current training round. Step 4: Joint Optimization of Generators: Based on Validation Feedback Loss Generate classification loss and the loss of combat Together they constitute the generator's total loss function Update the set of high-influence parameters through backpropagation in the outer loop. This improves the overall performance of generated samples in terms of realism and task discriminativeness; Step 5: Dual-loop collaborative training: The adversarial closed loop, generator With discriminator By combating losses Game-theoretic optimization is performed; the generator attempts to generate samples that approximate the real distribution to deceive the discriminator, and the discriminator optimizes its own ability by distinguishing between real samples and generated samples. The two are trained alternately and iteratively to improve the realism of generated samples and the diversity of feature space. The verification feedback closed loop, generator Through temporary validation feedback classifier verification loss The generalization ability of the generated minority class samples in downstream classification tasks is quantified. The generator adjusts the core parameters based on this loss to enhance the discriminative and generalization performance of the minority class samples. The adversarial loop and the validation feedback loop are executed alternately during training, constituting the generator parameters. The dual constraints and bidirectional feedback mechanism enable the generator to achieve joint optimality in the feature space and task space. Step 6: High-Influence Parameter Update: In the parameter update phase, based on the parameter influence calculated in Step 3, the parameter set for the high-influence generator is determined. ;use The optimizer performs an operation based on the generator's total loss only on the subset of high-influence parameters. The gradient update is performed using the following formula: in, The outer loop learning rate is used to control the step size of parameter updates; the remaining generator parameters that are not selected into the high-influence parameter set do not participate in the validation feedback-driven updates in this round.

6. The method for enhancing traffic data in a conditional generative adversarial network based on verification feedback according to claim 1, characterized in that, Step 3 describes a minority class generation strategy jointly driven by the feature space distribution density factor and sample size constraints. The steps are as follows: Step 1: Calculate the feature distribution density factor: for each minority class Let the original sample size be... The sample feature set is The probability density estimation method is used for each feature sample in the feature set. Calculate their probability density values ​​in the feature space respectively. And construct a feature distribution density factor based on the overall density distribution of samples in this category. Defined as: in, and These represent the minimum and maximum values ​​of the log density estimate for that category of samples, respectively; when the maximum and minimum values ​​are equal, a condition is set... Characteristic distribution density factor , used to characterize the overall concentration of minority class samples in the feature space, where, The smaller the value, the sparser the distribution of samples of this category in the feature space, and the higher the demand for generating samples; The probability density value Indicates sample The density of local sample distribution in the feature space is obtained through a probability density estimation method based on training samples; Step 2: Calculate the small sample generation rate: based on the median of the original sample size for each category globally. The number of times the target reference sample size is denoted as . And combined with the characteristic distribution density factor Calculation category Number of generated samples The definition is as follows: in, This is a lower bound parameter for generating proportions, used to ensure that each minority class still obtains the necessary number of generated samples when the feature distribution is relatively concentrated; when When setting the number of samples generated for that category. .

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When a computer program is executed by a processor in a computer system, the computer system performs a method for enhancing unbalanced network traffic data based on verification feedback using a conditional generative adversarial network, as described in any one of claims 1 to 6, wherein the method comprises at least: The data preprocessing step involves cleaning, feature encoding, and standardization of the raw network traffic data. Construct a dual-closed-loop collaborative data augmentation framework that includes a condition generator, a condition discriminator, and a validation feedback classifier; Calculate the number of minority class generated samples based on feature distribution density factor and sample number constraint; A validation feedback loop is used to guide the generator parameter updates and generate synthetic minority class samples. The generated samples are fused with the original training samples to construct an enhanced training set; The network traffic detection model is trained using an enhanced training set, thereby enabling the identification of abnormal network traffic behavior and intrusion detection.

Images