A dual-branch cooperative adversarial defense method for network traffic intrusion detection

Abstract

This invention provides a dual-branch cooperative adversarial defense method for network traffic intrusion detection, relating to the field of network information security technology. The method includes: acquiring the network traffic feature vector to be detected; inputting the network traffic feature vector into a pre-trained denoising and diffusion probability model for feature reconstruction to obtain a reconstructed feature vector; calculating the reconstruction error between the network traffic feature vector and the reconstructed feature vector; based on the reconstruction error, determining whether the network traffic feature vector is an adversarial sample through an adversarial detection branch; if it is an adversarial sample, performing adversarial sample interception; if it is a non-adversarial sample, purifying the network traffic feature vector through an adversarial purification branch to obtain a purified feature vector; and inputting the purified feature vector into a classifier for detection to obtain the detection result. This invention solves the problem that existing network intrusion detection systems lack dynamic adaptability and defense generalization ability when facing different adversarial sample attacks.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and in particular to a dual-branch collaborative defense method for network traffic intrusion detection. Background Technology

[0002] With the rapid development of network technology and the widespread adoption of internet applications, network security issues have become increasingly prominent, and network traffic intrusion has become one of the main threats to cyberspace security. Traditional rule-based and signature-based intrusion detection methods often perform poorly when facing new and unknown attacks and are difficult to adapt to complex and ever-changing network environments. In recent years, deep learning-based Network Intrusion Detection Systems (NIDS) have made significant progress in the field of intrusion detection due to their powerful feature learning capabilities and good generalization performance, and have become a current research hotspot.

[0003] However, deep learning-based classifiers are inherently vulnerable to adversarial example attacks. Attackers generate adversarial examples (AEs) by adding minute perturbations to normal or malicious network traffic. These examples are virtually imperceptible to humans and can deceive deep learning models, causing them to make incorrect classifications. Therefore, adversarial example attacks seriously threaten the security and reliability of deep learning-based intrusion detection systems and have become a critical issue that urgently needs to be addressed in the field of cybersecurity.

[0004] Existing deep learning-based adversarial defense methods have the following limitations: First, while adversarial training methods can improve the model's ability to defend against known attacks, they heavily rely on known attack samples and lack generalization ability against unknown attack types, and the training process is computationally expensive. Second, while input preprocessing-based methods (such as randomization) are simple to implement, their defense effect is unstable and often comes at the cost of sacrificing the accuracy of normal traffic detection. Third, existing data-side defense mechanisms are mostly static strategies, typically employing fixed-step reconstruction strategies or single defense strategies, lacking the ability to dynamically and adaptively adjust to different attack intensities and types, making it difficult to maintain stable defense performance under diverse attack scenarios.

[0005] Therefore, there is an urgent need for a network intrusion detection defense method that can effectively deal with various adversarial attacks and has good generalization ability, so as to ensure the security and reliability of deep learning-based intrusion detection systems in practical applications. Summary of the Invention

[0006] To address the aforementioned problems, this invention provides a dual-branch collaborative adversarial defense method for network traffic intrusion detection, which solves the problem that existing network intrusion detection systems lack dynamic adaptability and defense generalization ability when facing adversarial sample attacks of different types and intensities.

[0007] This invention provides a dual-branch cooperative defense method for network traffic intrusion detection, the method comprising:

[0008] Obtain the network traffic feature vector to be detected, input the network traffic feature vector into a pre-trained denoising diffusion probability model for feature reconstruction, obtain the reconstructed feature vector, and calculate the reconstruction error between the network traffic feature vector and the reconstructed feature vector.

[0009] Based on the reconstruction error, the adversarial detection branch determines whether the network traffic feature vector is an adversarial sample; if it is an adversarial sample, an adversarial sample interception operation is performed; if it is a non-adversarial sample, the adversarial purification branch is used to purify the network traffic feature vector to obtain a purified feature vector.

[0010] The purified feature vector is input into a classifier for detection to obtain the detection result.

[0011] Furthermore, the training method for the denoising diffusion probability model includes:

[0012] Obtain a training sample set consisting of clean samples;

[0013] The clean samples in the training sample set are input into the denoising diffusion probability model. First, noise is gradually added to the samples through a forward diffusion process, and then the original samples are recovered from the noisy samples through a reverse denoising process.

[0014] The parameters of the denoising diffusion probability model are optimized by minimizing the loss function.

[0015] Furthermore, determining whether the network traffic feature vector is an adversarial sample through the adversarial detection branch specifically includes: comparing the reconstruction error with the adversarial detection threshold; if the reconstruction error is greater than the adversarial detection threshold, it is determined to be an adversarial sample; otherwise, it is determined to be a non-adversarial sample.

[0016] Furthermore, the method for determining the adversarial detection threshold includes:

[0017] Multiple clean samples are obtained and input into the trained denoising diffusion probability model respectively to obtain the reconstruction error of each clean sample.

[0018] The adversarial detection threshold is determined based on the statistical characteristics of the reconstruction errors of multiple clean samples.

[0019] Furthermore, the formula for calculating the adversarial detection threshold is as follows:

[0020] ;

[0021] in, To counter detection thresholds; This represents the mean of the reconstruction errors from multiple clean samples. The standard deviation of the reconstruction error for multiple clean samples. This is the scaling factor.

[0022] Furthermore, the network traffic feature vector is purified through an adversarial purification branch, specifically including:

[0023] The number of purification steps for the network traffic feature vector is determined based on the reconstruction error;

[0024] Based on the number of purification steps, the network traffic feature vector is purified using the denoising diffusion probability model.

[0025] Furthermore, the purification process includes: taking the network traffic feature vector as the starting point, performing iterative operations of forward diffusion process and reverse denoising process in the denoising diffusion probability model, with the number of iterations being the purification step number.

[0026] Furthermore, the forward diffusion process uses a Markov chain to progressively add Gaussian noise; the reverse denoising process uses a denoising diffusion probability model to predict noise and progressively denoise it.

[0027] Furthermore, the number of purification steps is determined as follows:

[0028] The reconstruction error is input into a pre-trained cleanup step estimator, which then outputs the corresponding cleanup step count.

[0029] Furthermore, the training method for the purification step estimator includes:

[0030] Construct a training dataset where each sample includes the reconstruction error and the corresponding optimal cleanup step number label;

[0031] Based on the training dataset, a machine learning model is trained as a cleanup step estimator.

[0032] In summary, this invention provides a dual-branch cooperative adversarial defense method for network traffic intrusion detection, which achieves the following advantages compared with existing technologies:

[0033] (1) This invention combines adversarial detection and adversarial purification through a dual-branch collaborative mechanism, achieving effective defense against adversarial sample attacks in network traffic intrusion detection systems. On the one hand, the adversarial detection branch can quickly identify and directly intercept obvious adversarial samples, purifying only suspicious samples to prevent them from entering subsequent detection processes, saving unnecessary computational overhead, reducing system latency and improving computational efficiency while ensuring defense effectiveness; on the other hand, the adversarial purification branch can adaptively adjust the purification strategy according to the attack intensity, effectively eliminating adversarial disturbances while ensuring detection accuracy. This dual-branch collaborative mechanism significantly improves the dynamic adjustment and generalization capabilities of intrusion detection systems when facing adversarial attacks of different intensities and types, while maintaining low computational overhead.

[0034] (2) This invention introduces the denoising diffusion probability model into the field of network traffic adversarial defense. By reconstructing and purifying network traffic features through the denoising diffusion probability model, the model can more accurately learn and fit the distribution of clean traffic features by learning the data distribution of network traffic features. This effectively addresses attack types and strategies not seen during training, restores the feature distribution destroyed by adversarial disturbances, and makes the purified features closer to the true distribution of the original normal or malicious traffic. This achieves highly robust reconstruction and purification of adversarial disturbance samples. At the same time, the inherent randomness of the model increases the difficulty for attackers to infer gradients and launch effective attacks, improves the system's generalization ability to defend against unknown adversarial attacks, provides additional security for the system, and thus significantly improves the detection accuracy of the classifier.

[0035] (3) This invention introduces an adaptive purification step estimator based on reconstruction error, which can dynamically adjust the purification intensity according to the attack intensity. This avoids feature distortion caused by over-purification and ensures the effective elimination of strong attacks, enabling the system to stably cope with various adversarial samples ranging from slight perturbations to strong attacks, thus achieving adaptive optimization of the purification strategy. In addition, it can dynamically allocate computing resources according to the estimated attack intensity of each sample, avoiding the problems of insufficient or excessive purification under a fixed step strategy, and optimizing computational efficiency while ensuring the defense effect.

[0036] (4) By setting a detection threshold based on the statistical characteristics of clean samples, the present invention can effectively distinguish adversarial samples from real clean traffic (including normal traffic and malicious traffic), avoid false interception of real traffic, and ensure the normal function of the intrusion detection system. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0038] Figure 1 This is a schematic diagram of the dual-branch cooperative adversarial defense framework of a dual-branch cooperative adversarial defense method for network traffic intrusion detection provided by the present invention;

[0039] Figure 2 This is a schematic diagram of the overall process of a dual-branch cooperative adversarial defense method for network traffic intrusion detection provided by the present invention;

[0040] Figure 3 This is a schematic diagram of the training process of the denoising diffusion probability model of a dual-branch cooperative adversarial defense method for network traffic intrusion detection provided by the present invention. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0042] It should be noted that, in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a method, step, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to the method, step, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the method, step, or apparatus that includes that element.

[0043] To address the lack of dynamic adaptability and defense generalization capabilities in existing network intrusion detection systems when facing adversarial attacks of varying types and intensities, this invention proposes a dual-branch collaborative adversarial defense method for network traffic intrusion detection. This method establishes a dual-branch collaborative data-end defense mechanism comprising an adversarial detection branch and an adversarial deconstruction branch. The adversarial detection branch reconstructs features based on a denoising diffusion probability model and detects adversarial examples through reconstruction errors. The adversarial deconstruction branch cleanses sample features based on a diffusion model. This mechanism fully leverages the complementary performance of adversarial detection (sensitive to large disturbances) and adversarial deconstruction (effective against small disturbances) under different attack intensities, achieving dynamic adaptive defense against attacks ranging from mild to severe, significantly improving the system's generalization ability in the face of unknown and diverse attacks.

[0044] like Figure 1 and Figure 2 As shown, the method specifically includes:

[0045] S100: Obtain the network traffic feature vector to be detected, input the network traffic feature vector into the pre-trained denoising diffusion probability model for feature reconstruction, obtain the reconstructed feature vector, and calculate the reconstruction error between the network traffic feature vector and the reconstructed feature vector.

[0046] A network traffic feature vector is a structured and numerical representation of raw network traffic data (such as packet sequences and flow records) transformed through a series of predefined feature extraction rules. It is a multi-dimensional vector in which each dimension represents a specific traffic attribute and is used to quantitatively describe the behavioral characteristics of network traffic.

[0047] Behavioral characteristics typically include one or more of the following: basic connectivity characteristics, time-related characteristics, statistical characteristics, and content-related characteristics. Basic connectivity characteristics include source / destination IP addresses, port numbers, and protocol types; time-related characteristics include flow duration, packet arrival time intervals, and flow rate; statistical characteristics include packets per second, bytes per second, average packet size, and flow direction; and content-related characteristics include the frequency of occurrence of specific protocol flags and payload length distribution.

[0048] Network traffic feature vectors can usually be obtained using feature extraction tools, such as CICF Low Meter, NFStream, and Zeek.

[0049] The network traffic feature vector is input into a pre-trained denoising and diffusion probability model for reconstruction. Specifically, using the pre-trained denoising and diffusion probability model, the network traffic feature vector is taken as the starting point and, through a process of adding and removing noise, an output vector is generated that is structurally similar to the input feature vector but better conforms to the clean data distribution learned by the model. The goal is not simply to copy the input, but to use the denoising and diffusion probability model to reconstruct or clean up any anomalies or perturbations that may exist in the input vector, making it closer to the original traffic feature pattern, whether normal or malicious.

[0050] The denoising diffusion probability model is the core technological foundation for achieving adversarial detection and decontamination. It uses a clean traffic sample set and trains a noise prediction network through forward diffusion and reverse denoising processes, enabling it to learn to recover the feature distribution of clean samples from noise. This allows it to understand both the characteristics of normal network traffic and the typical patterns of malicious network traffic, thereby identifying and defending against malicious attacks that violate these patterns.

[0051] As an example, the training method for the denoising diffusion probability model includes:

[0052] Obtain a training sample set consisting of clean samples;

[0053] Clean samples from the training sample set are input into the denoising diffusion probability model. First, noise is gradually added to the samples through a forward diffusion process, and then the original samples are recovered from the noisy samples through a reverse denoising process.

[0054] The parameters of the denoising diffusion probability model are optimized by minimizing the loss function.

[0055] It should be noted that, in order to ensure that the model can accurately reconstruct and clean up various real traffic features, this invention uses a training sample set composed of clean samples for training. Clean samples refer to raw network traffic data that has not been subjected to any adversarial perturbations.

[0056] The purpose of using clean samples for training is to ensure that the samples used to train the denoising diffusion probability model faithfully reflect its original data distribution and cannot be artificially perturbed by small disturbances intended to attack the model. If only normal network traffic is used to train the model, the model will only learn the distribution of normal traffic. When encountering raw, undisturbed malicious network traffic, the model may incorrectly reconstruct or clean it as normal traffic because it does not conform to the learned distribution, leading to missed detections. Therefore, to ensure that the model can accurately reconstruct and clean various real traffic features and prevent misclassification of raw malicious traffic as adversarial examples, the clean sample set used for training in this invention should also include both normal network traffic samples and malicious network traffic samples.

[0057] As a specific example, such as Figure 3 As shown, input a clean sample set Set training parameters, including the number of diffusion steps. Training rounds wait;

[0058] During the forward diffusion process, Gaussian noise is added stepwise according to a Markov chain:

[0059] , ;

[0060] in, In time step The Feature vectors of noise samples; This represents the total number of samples. This is the noise dispatch coefficient; The feature vector of the initial clean sample refers to... The feature vector of the raw network traffic sampled in the middle, without any noise added; It is standard Gaussian noise.

[0061] Perform a reverse denoising process to train a noise prediction network. By minimizing the loss function and continuously optimizing the network parameters, the noise prediction network can be improved. It can predict the noise added at each step with increasing accuracy, thus enabling it to gradually recover clean samples from the current noisy samples during the reverse denoising process.

[0062] It should be noted that the noise prediction network is a core component of the denoising diffusion probability model. It is a trained neural network whose task is to predict the noise included in the data based on a noisy data sample and the number of noise addition steps (time steps) corresponding to that sample.

[0063] Furthermore, the formula for calculating the minimum loss function can be: ; Standard Gaussian noise; According to and Predicted noise. Network parameters. The optimization formula can be: That is, the current model parameters Subtract the learning rate With loss gradient The product of these parameters yields the updated, better model parameters. .

[0064] Repeated iterative training This yields the denoising diffusion probability model.

[0065] It should be noted that in this invention, the denoising diffusion probability model is the engine of the entire defense system. This invention cleverly utilizes the different functional characteristics of the model at different stages of the defense process, thereby achieving two different processing objectives: reconstruction and purification.

[0066] On the one hand, the model's reconstruction capability is utilized as a reconstructor for adversarial detection. A simplified, low-step reverse denoising process is performed on the input sample to quickly generate a reconstructed version, with the aim of calculating the reconstruction error with the original input.

[0067] When a network traffic feature vector is input, the model reconstructs it into its perceived clean form. If the input is a clean sample, reconstruction is easy with minimal error; however, if the input is an adversarial sample that has been maliciously perturbed, its distribution differs significantly from the clean distribution learned by the model, making reconstruction difficult and resulting in a substantial increase in error. This method is used to determine whether an input sample is abnormal.

[0068] On the other hand, the model's data generation / recovery capabilities are utilized as a purifier for adversarial purification. A complete, multi-step forward noise addition and reverse noise reduction process is performed on the input sample. The aim is to wash away adversarial perturbations and pull the features of the input sample from the distribution area of ​​adversarial samples back to the distribution area of ​​clean samples, thereby purifying the sample features.

[0069] For adversarial examples that are not detected, the denoising diffusion probability model acts as a purifier to perform a more complex denoising process. Through a Markov chain process of gradually adding noise and then gradually denoising, it uses its learned knowledge of the distribution of clean samples to remove unnatural and malicious perturbations from the input samples, restoring them to a state close to that of clean samples, so that subsequent classifiers can make correct judgments.

[0070] As can be seen, to address the problem that existing methods are unable to defend against adversarial attacks of different types and intensities, this invention introduces a trained denoising diffusion probability model. By calling its different functions (rapid reconstruction of detection or deep cleansing features) at different defense stages, it can not only reconstruct sample features more robustly and exhibit stronger robustness and generalization against various adversarial attacks, but also fit the distribution characteristics of clean samples with higher accuracy, effectively recover sample features affected by adversarial perturbations, achieve synergy between detection and cleansing, and achieve the goal of defending against different adversarial attacks.

[0071] When the denoising diffusion probability model is used as a reconstructor for adversarial detection, it focuses on reconstructing network traffic features. To achieve a fast response, a one-step denoising reconstruction can be employed. As an example, the method for obtaining the reconstructed feature vector specifically includes: inputting the network traffic feature vector to be detected into the trained denoising diffusion probability model, and directly performing a one-step reverse denoising process starting from the network traffic feature vector to obtain the reconstructed feature vector. This simplified process fully utilizes the model's denoising capability, treating the input sample as an intermediate state to be repaired, achieving rapid reconstruction to meet the real-time requirements of adversarial detection branches.

[0072] As a fast implementation method, only one reverse denoising process can be performed; to improve reconstruction accuracy, an iterative process including finite-step forward diffusion and reverse denoising can also be performed.

[0073] In another embodiment, the method for obtaining the reconstructed feature vector specifically includes: inputting the network traffic feature vector to be detected into the denoising diffusion probability model, firstly performing a forward diffusion process quickly to obtain a feature vector of a slightly noisy noise sample; then, starting from the feature vector of the noise sample, performing one or more reverse denoising processes; and repeating the iteration for a preset number of steps to obtain the reconstructed feature vector.

[0074] Network traffic feature vectors are input into a pre-trained denoising diffusion probability model for reconstruction. The reconstruction error between the input and output of the denoising diffusion probability model can be used as a criterion for detecting adversarial examples. The reconstruction error of the denoising diffusion probability model for clean samples will be lower than the reconstruction error of other samples from adversarial traffic feature distributions.

[0075] As an example, the specific method for calculating the reconstruction error is to use at least one of mean squared error, cross-entropy loss, or KL divergence to calculate the difference between the network traffic feature vector and the reconstructed feature vector. Furthermore, depending on specific needs, other distance or difference metrics, such as L1 norm or cosine distance, can also be used.

[0076] For example, the reconstruction error can be calculated as follows: ;in, This represents the network traffic feature vector. To be The reconstructed feature vector is input into the trained denoising diffusion probability model and undergoes forward diffusion and reverse denoising processes.

[0077] S200: Based on the reconstruction error, the adversarial detection branch determines whether the network traffic feature vector is an adversarial sample; if it is an adversarial sample, the adversarial sample interception operation is performed; if it is a non-adversarial sample, the adversarial purification branch is used to purify the network traffic feature vector to obtain a purified feature vector.

[0078] In other words, this invention comprises two working branches: an adversarial detection branch and an adversarial decontamination branch. The adversarial detection branch identifies potential adversarial examples by reconstructing errors; the adversarial decontamination branch, based on a denoising diffusion probability model, dynamically adjusts the diffusion step count for input features that are not detected as adversarial examples based on a decontamination step estimator, and performs a multi-step forward diffusion process and a reverse denoising process to purify the sample features.

[0079] The adversarial detection branch and the adversarial decontamination branch are complementary under different perturbation amplitudes. When the adversarial perturbation amplitude is large, the denoising diffusion probability model struggles to completely purify the adversarial sample features because the statistical distance between the adversarial sample distribution and the clean sample distribution is large, leading to significant reconstruction errors. This allows the adversarial detection branch to efficiently identify such samples. Conversely, when the adversarial perturbation amplitude is small, the adversarial sample distribution and the clean sample distribution are close, resulting in smaller reconstruction errors, which may lead to missed detections. However, the adversarial decontamination branch, through forward diffusion to introduce noise and reverse denoising for accurate reconstruction, can effectively purify samples with small perturbation amplitudes.

[0080] Therefore, the adversarial detection branch excels at identifying adversarial samples with significant perturbations, while the adversarial decontamination branch exhibits higher robustness when dealing with small perturbations. This collaborative mechanism solves the problem of insufficient generalization of a single static defense strategy, enabling the defense system to dynamically adapt to various adversarial attacks ranging from mild to severe, covering a wide range of attack intensities, and jointly improving the defense generalization capability of the intrusion detection system.

[0081] As an example, determining whether a network traffic feature vector is an adversarial sample through an adversarial detection branch specifically includes: comparing the reconstruction error with an adversarial detection threshold; if the reconstruction error is greater than the adversarial detection threshold, it is determined to be an adversarial sample; otherwise, it is determined to be a non-adversarial sample.

[0082] In other words, in the adversarial detection branch, the adversarial detection threshold is determined by the reconstruction error of clean samples during training; for network traffic feature vectors, if their reconstruction error exceeds the adversarial detection threshold, they are judged as adversarial samples, otherwise they are judged as non-adversarial samples.

[0083] Furthermore, the method for determining the adversarial detection threshold includes: obtaining multiple clean samples, inputting the multiple clean samples into the trained denoising diffusion probability model respectively, and obtaining the reconstruction error of each clean sample; and determining the adversarial detection threshold based on the statistical characteristics of the reconstruction errors of multiple clean samples.

[0084] It should be noted that the statistical characteristics include the mean and standard deviation. The mean reflects the central tendency of the reconstruction error of clean samples; the standard deviation reflects the deviation of the reconstruction error of clean samples.

[0085] As an example, the scaling factor can be obtained by: calculating the mean of the reconstruction errors of multiple clean samples; calculating the difference between the reconstruction error of each clean sample and the corresponding mean; squaring the difference and summing them by dividing by the number of clean samples to obtain the standard deviation; determining the adversarial detection threshold based on the mean and the standard deviation; and controlling the deviation of the adversarial detection threshold from the mean by using the scaling factor.

[0086] Specifically, the adversarial detection threshold can be calculated using the following formula:

[0087] ;

[0088] in, To counter detection thresholds; This represents the mean of the reconstruction errors from multiple clean samples. The standard deviation of the reconstruction error for multiple clean samples. This is the scaling factor.

[0089] Furthermore, ; ; This indicates the number of clean samples.

[0090] In the adversarial purification branch, traffic features that are not detected as adversarial samples are purified, and the purification steps are input into the denoising diffusion model for diffusion and denoising to obtain purified sample features. Finally, these purified sample features are input into the downstream classifier for classification to obtain the detection results.

[0091] As an example, the network traffic feature vector is purified by an adversarial purification branch, which specifically includes: determining the number of purification steps for the network traffic feature vector based on the reconstruction error; and purifying the network traffic feature vector using a denoising diffusion probability model based on the number of purification steps.

[0092] It should be noted that by using the reconstruction error calculated in the adversarial detection branch as an indicator of attack strength, and dynamically estimating the optimal number of cleanup steps based on the reconstruction error, the number of cleanup steps is no longer a fixed value but can dynamically change according to the adversarial attack. This dynamic adjustment mechanism and dual-branch collaborative defense can effectively cope with adversarial attacks of different types and intensities, avoiding both insufficient cleanup (too few steps, resulting in unremoved perturbations) and excessive cleanup (too many steps, which may damage the original feature information or increase computational overhead). Thus, it achieves an optimal balance between defense effectiveness and efficiency, significantly improving the generalization and robustness of the defense.

[0093] It should be noted that while the denoising diffusion probability model can recover the traffic features of clean samples from a Gaussian distribution, the clean samples in the training set include both normal and malicious network traffic samples. If the traffic features of the recovered noisy samples are obtained when the inverse denoising process starts with Gaussian noise, they may not be classified in the same category as the traffic features of the input samples. Therefore, the inverse denoising process should prioritize obtaining information from the input samples to guide the process.

[0094] As an example, the purification process includes: starting from the network traffic feature vector, performing iterative operations of forward diffusion and reverse denoising in the denoising diffusion probability model, with the number of iterations being the purification steps.

[0095] Furthermore, the forward diffusion process uses a Markov chain to progressively add Gaussian noise; the reverse denoising process uses a denoising diffusion probability model to predict noise and progressively denoise it. By introducing Gaussian noise through the forward diffusion process, it is possible to effectively submerge and counteract disturbances; subsequently, the reverse denoising process can accurately reconstruct the feature distribution of clean flow samples, thereby achieving effective purification of samples with small-amplitude disturbances.

[0096] It should be noted that the starting point of the forward diffusion process can be set from the feature vector of the pure noise sample or from the network traffic feature vector. Preferably, in order to partially drown out any adversarial perturbations that may exist due to noise, some input information can be retained, and the network traffic feature vector can be used as the starting point.

[0097] Specifically, starting with the input network traffic feature vector, a forward diffusion process and a reverse denoising process are carried out for the purification steps. This process utilizes the characteristics of the denoising diffusion probability model to gradually submerge the tiny malicious disturbances in the sample, and uses the clean data distribution knowledge learned by the denoising diffusion probability model to pull the sample features back to the clean distribution area.

[0098] Furthermore, to obtain more sample information, the diffusion results of an appropriate number of steps in the forward diffusion process of the input samples can be selected as the starting point for the reverse denoising process. In the forward diffusion process of the adversarial purification branch, clean samples... Add random adversarial perturbation Adversarial examples are formed later. , After forward noise addition steps Later obtained ,Will This serves as the starting point for the reverse denoising process. The specific purification process can be as follows:

[0099] ;

[0100] ;

[0101] With the number of positive noise addition steps The increase in input sample weights Gradually decrease, noise weight Gradually increase; find a suitable one This makes standard Gaussian noise It can submerge the anti-disturbance while retaining some input sample information for the reverse process to recover the clean flow sample characteristics.

[0102] It should be noted that, It is a randomly sampled standard Gaussian noise (mean 0, variance 1), with random perturbations added at each step of the reverse denoising process. That is, at each step of the reverse denoising, after the model predicts the approximate direction, a new random standard Gaussian noise is injected. This means that even starting from the same noise source, two independent reverse processes may produce slightly different output results.

[0103] The denoising diffusion probability model introduces inherent randomness in the forward diffusion and backward denoising processes, which significantly increases the difficulty of adversarial attack methods. Due to the existence of randomness, attackers find it difficult to accurately predict the gradient information of the model or determine the optimal attack direction. This mechanism plays a key role in enhancing the robustness of the model and provides additional security against complex adversarial attacks.

[0104] The strength of adversarial attacks is estimated by calculating the reconstruction error between the input sample features and the reconstructed sample features, and thus the optimal number of cleanup steps is estimated. A larger reconstruction error suggests a potentially stronger attack and requires more cleanup steps. To further fit the relationship between the reconstruction error and the optimal number of cleanup steps, an adaptive mechanism can be constructed that dynamically estimates the optimal number of cleanup steps based on the reconstruction error. This mechanism obtains the reconstruction error through a finite number of reconstruction steps and outputs the optimal number of cleanup steps based on this error, achieving efficient adversarial cleanup.

[0105] As an example, the purification steps are determined by inputting the reconstruction error into a pre-trained purification step estimator, which then outputs the corresponding purification steps.

[0106] Specifically, purification steps The process of obtaining it can be represented as: ;in, The process of estimating the number of purification steps, Represents the feature vector of the input sample The reconstruction results This refers to the number of purification steps.

[0107] As an example, the training method for the cleanup step count estimator includes: constructing a training dataset, wherein each sample includes a reconstruction error and a corresponding optimal cleanup step count label; and training a machine learning model as a cleanup step count estimator based on the training dataset.

[0108] Specifically, constructing the training dataset includes: generating adversarial samples with different perturbation amplitudes, reconstructing these samples using a denoising diffusion probability model, and calculating their reconstruction errors; determining the number of purification diffusion steps required to achieve the best adversarial purification effect for different adversarial samples, thereby constructing a training dataset that includes the reconstruction error and the optimal number of purification steps.

[0109] When constructing the training dataset, the optimal cleansing step number label is determined as follows: For an adversarial sample with a given reconstruction error, a cleansing experiment is conducted within a preset number of steps (e.g., 1 to 100 steps). The number of steps corresponding to the highest classification accuracy obtained by inputting the cleaned features into the classifier is used as the optimal cleansing step number label for that sample.

[0110] Based on the training dataset, a machine learning model is trained as a cleanup step estimator to fit the relationship between reconstruction error and the optimal cleanup step count. The machine learning model can be any of the following: decision tree, random forest, linear regression, support vector machine, or neural network.

[0111] To better fit the relationship between reconstruction error and the optimal number of cleanup steps, multiple candidate models were trained and comprehensively evaluated and compared. Since decision trees showed significant advantages in prediction accuracy, interpretability, and computational efficiency when trained as cleanup step estimators, the machine learning model preferred decision trees.

[0112] S300: Input the cleaned feature vector into the classifier for detection and obtain the detection result.

[0113] In existing technologies, classifiers may receive raw feature vectors that have been contaminated by adversarial examples, making them prone to incorrect judgments. However, the dual-branch collaborative defense mechanism in the pre-processing flow of this invention outputs cleaned feature vectors that eliminate or weaken adversarial perturbations, ensuring that the features input to the classifier are clean or enhanced, thereby improving detection performance.

[0114] Furthermore, this invention does not rely on prior knowledge of specific attack types or classifiers, and its plug-and-play nature allows it to be widely applied to various intrusion detection systems.

[0115] In summary, this invention is the first to introduce a denoising diffusion probability model into the field of network traffic adversarial defense. It introduces a dual-branch collaborative adversarial defense mechanism based on this model, combining adversarial detection and adversarial decontamination. Furthermore, it dynamically adjusts the number of decontamination steps using a decontamination step estimator to achieve optimal adversarial decontamination results. This addresses the problem of insufficient generalization of existing defense methods against different adversarial attacks. On one hand, the adversarial detection branch can more robustly reconstruct sample features, thus exhibiting stronger detection capabilities against high-intensity adversarial attacks and demonstrating greater robustness and generalization against various adversarial attacks. On the other hand, the adversarial decontamination branch guides the adversarial decontamination process through reconstruction errors; the denoising diffusion probability model, by learning the generation process of clean data distribution, can fit the distribution characteristics of clean samples with higher accuracy, effectively recovering sample features affected by adversarial disturbances; moreover, dynamically adjusting the diffusion steps according to the intensity of the adversarial attack achieves optimal adversarial decontamination results, maintaining high defense performance even when attacks change dynamically, and better adapting to adversarial samples of different types and intensities of attacks.

[0116] It should be noted that, for the sake of simplicity, the foregoing embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0117] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0118] In the several embodiments provided in this application, it should be understood that the disclosed methods or systems can be implemented in other ways. For example, the embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0119] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0120] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0121] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0122] Those skilled in the art will understand that all or part of the circuits in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0123] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of embodiments of this disclosure upon considering the specification and practicing the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described herein. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

[0124] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A dual-branch cooperative adversarial defense method for network traffic intrusion detection, characterized in that, The method includes: The network traffic feature vector to be detected is obtained, and the network traffic feature vector is input into a pre-trained denoising diffusion probability model for feature reconstruction to obtain a reconstructed feature vector. The reconstruction error between the network traffic feature vector and the reconstructed feature vector is calculated. The denoising diffusion probability model is trained using a training sample set consisting of clean samples including normal network traffic samples and malicious network traffic samples. Based on the reconstruction error, an adversarial detection branch determines whether the network traffic feature vector is an adversarial sample. If it is an adversarial sample, an adversarial sample interception operation is performed. If it is a non-adversarial sample, the reconstruction error is input into a pre-trained purification step estimator, which outputs the corresponding purification step number. Based on the purification step number, the adversarial purification branch uses the denoising diffusion probability model to purify the network traffic feature vector, resulting in a purified feature vector. The purification process includes iterative operations of forward diffusion and reverse denoising processes in the denoising diffusion probability model, starting from the network traffic feature vector, with the number of iterations being the purification step number. The purified feature vector is input into a classifier for detection to obtain the detection result.

2. The dual-branch cooperative adversarial defense method for network traffic intrusion detection according to claim 1, characterized in that, The training method for the denoising diffusion probability model includes: Obtain a training sample set consisting of clean samples; The clean samples in the training sample set are input into the denoising diffusion probability model. First, noise is gradually added to the samples through a forward diffusion process, and then the original samples are recovered from the noisy samples through a reverse denoising process. The parameters of the denoising diffusion probability model are optimized by minimizing the loss function.

3. A dual-branch cooperative adversarial defense method for network traffic intrusion detection according to claim 1 or 2, characterized in that, Determining whether the network traffic feature vector is an adversarial sample through an adversarial detection branch specifically includes: comparing the reconstruction error with an adversarial detection threshold; if the reconstruction error is greater than the adversarial detection threshold, it is determined to be an adversarial sample; otherwise, it is determined to be a non-adversarial sample.

4. The dual-branch cooperative adversarial defense method for network traffic intrusion detection according to claim 3, characterized in that, The methods for determining the adversarial detection threshold include: Multiple clean samples are obtained and input into the trained denoising diffusion probability model respectively to obtain the reconstruction error of each clean sample. The adversarial detection threshold is determined based on the statistical characteristics of the reconstruction errors of multiple clean samples.

5. A dual-branch cooperative adversarial defense method for network traffic intrusion detection according to claim 4, characterized in that, The formula for calculating the adversarial detection threshold is: ； in, To counter detection thresholds; This represents the mean of the reconstruction errors from multiple clean samples. The standard deviation of the reconstruction error for multiple clean samples. This is the scaling factor.

6. The dual-branch cooperative adversarial defense method for network traffic intrusion detection according to claim 1, characterized in that, The forward diffusion process uses a Markov chain to progressively add Gaussian noise; the reverse denoising process uses a denoising diffusion probability model to predict noise and progressively denoise it.

7. A dual-branch cooperative adversarial defense method for network traffic intrusion detection according to claim 1, characterized in that, The training method for the purification step estimator includes: Construct a training dataset where each sample includes the reconstruction error and the corresponding optimal cleanup step number label; Based on the training dataset, a machine learning model is trained as a cleanup step estimator.

Images