Malicious traffic data enhancement method based on multi-starting point diffusion strategy

Abstract

The invention discloses a malicious traffic data enhancement method based on a multi-starting point diffusion strategy, and relates to the field of network security and artificial intelligence. The method comprises the following steps: collecting a network flow data packet, generating a labeled network flow sample set according to quintuple aggregation, and carrying out feature vectorization; training a denoising diffusion implicit model (DDIM) to learn potential distribution of network flows; setting a plurality of diffusion time steps as sampling starting points, and configuring a cumulative noise coefficient and a semantic retention rate; gaussian noise disturbance is applied to the network flow samples, and paired noise samples are generated through symmetrical sampling; utilizing a DDIM model to execute leapfrog back diffusion to generate an enhanced network flow sample; and combining the enhanced sample and the original sample, and constructing a category-balanced synthetic training set for training an intrusion detection model. According to the method, through a multi-starting-point diffusion and symmetric disturbance mechanism, high-quality malicious samples are accurately expanded on the premise that key discrimination features of original traffic are reserved, and the recognition capability of the model on variant attacks and unknown threats is remarkably improved.

Description

Technical Field

[0001] This invention relates to the fields of network security and artificial intelligence, specifically to a data augmentation method for malicious traffic detection, and more particularly to a malicious traffic data augmentation method based on a multi-starting point diffusion strategy that can precisely control the trade-off between the fidelity and diversity of generated samples. Background Technology

[0002] In the field of cybersecurity, the performance of machine learning-based malicious traffic detection models is highly dependent on the quality and quantity of training data. However, practical applications face two major challenges: severe class imbalance and insufficient sample diversity. Malicious traffic accounts for a very small percentage (usually <1%) in real networks, causing models to tend to classify all traffic as benign; at the same time, although attack methods are varied, the traffic patterns of similar attacks are similar, resulting in a lack of sufficient diversity in training samples and limiting the model's generalization ability.

[0003] Traditional data augmentation methods (such as SMOTE oversampling and GAN generation) have significant drawbacks. Interpolation methods like SMOTE tend to generate meaningless "noise samples" in high-dimensional nonlinear spaces, disrupting the semantic structure of the original data. While Generative Adversarial Networks (GANs) can generate realistic samples, their training process is unstable, and it's difficult to precisely and decouple the characteristics of the generated samples (such as fidelity and diversity) for control. More importantly, these methods typically generate samples from scratch, resulting in weak correlation with the original samples and an inability to effectively preserve key discriminative features.

[0004] In recent years, diffusion models have attracted attention due to their powerful generation capabilities and stable training process. However, standard diffusion models generate data from pure noise (…). The generation process begins inefficiently, resulting in weak correlation between the generated samples and the original data distribution, and the entire denoising process incurs huge computational costs. Therefore, there is an urgent need for a novel data augmentation technique that can efficiently generate high-quality samples while allowing for fine-tuning of the generation process, in order to solve the data dilemma in malicious traffic detection. Summary of the Invention

[0005] The purpose of this invention is to provide a malicious traffic data augmentation method based on a multi-starting-point diffusion strategy, aiming to overcome the problems of insufficient sample diversity, difficulty in balancing fidelity and diversity, and low computational efficiency in existing technologies when processing malicious traffic data. By introducing a multi-starting-point perturbation and controllable recovery mechanism, this invention can efficiently generate synthetic samples that are highly faithful to the original semantics and possess rich diversity, thereby significantly improving the performance of downstream malicious traffic detection models.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A method for enhancing malicious traffic data based on a multi-starting point diffusion strategy includes the following steps:

[0007] S1: Collect network traffic data packets, aggregate them into a labeled network flow sample set according to 5-tuples, and perform feature vectorization;

[0008] S2: Train the denoising diffusion implicit model DDIM based on the sample set to learn the latent distribution of network flow;

[0009] S3: Set multiple diffusion time steps as sampling start points, and configure the cumulative noise figure and semantic preservation rate of each start point;

[0010] S4: Based on the sampling starting point and the accumulated noise coefficient, Gaussian noise perturbation is applied to the network flow samples, and pairs of noisy samples are generated through symmetrical sampling;

[0011] S5: Using the trained DDIM model, perform a skip-step backdiffusion on noisy samples to generate enhanced network stream samples;

[0012] S6: Merge the enhanced network flow samples with the original network flow samples to construct a class-balanced synthetic training set for training the intrusion detection model.

[0013] 2. The network traffic anomaly detection method based on a dual filtering framework to mitigate label noise and dataset imbalance according to claim 1, characterized in that step S1 specifically includes the following steps:

[0014] S1.1 collects raw network data packets through network probes or traffic mirroring, and aggregates them into network flows based on the five-tuple information (source IP address, destination IP address, source port number, destination port number, and transport layer protocol);

[0015] S1.2 Extracts the multidimensional feature vector for each network flow, including statistical features such as the number of packets. Total bytes Flow duration Average package interval time Package length variance The temporal characteristic is a sequence of packet arrival time intervals. The hidden vector obtained by encoding through a one-dimensional convolutional neural network The statistical feature vector and the latent vector are concatenated and then mapped through a fully connected layer to... For feature vectors ;

[0016] S1.3 Assign a category label to each network flow based on the five-tuple information of the network flow. ( This indicates healthy traffic. (Indicating malicious traffic), constructing the original sample set. ;

[0017] in, This represents the original set of labeled samples. Indicates the first Feature vector of each sample Indicates the first The feature vector of each sample Indicates the total number of samples;

[0018] 3. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that step S2 specifically includes the following steps:

[0019] S2.1 Constructing the forward diffusion process: For any original sample During the diffusion time step The noise samples are represented as follows:

[0020] ,

[0021] in, Represents the cumulative noise figure. Indicates the first The noise scheduling coefficient of the step, Represents the current diffusion time step (integer, ... ), This represents the total number of diffusion steps. express Step with noisy samples, Represents a random noise vector;

[0022] S2.2 Design a noise prediction network based on the U-Net architecture Training is performed by minimizing the variational lower bound:

[0023]

[0024] in, Denotes the variational lower bound loss function. Represents the mathematical expectation. Represents the L2 norm. Represents a noise prediction network. This represents the set of trainable parameters of the network. Indicates the time step of diffusion;

[0025] 4. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that step S3 specifically includes the following steps:

[0026] S3.1 Define the set of sampling start points ,Require and ;

[0027] in, Indicates the number of sampling start points. Represents the set of sampling start points. Indicates the first One sampling starting point;

[0028] S3.2 for each Calculate the cumulative noise figure At the same time, determine the semantic preservation rate. With diversity coefficient ;

[0029] in, Indicates semantic preservation rate, The larger the value, the stronger the semantic preservation. Represents the diversity coefficient. The higher the value, the higher the sample diversity;

[0030] 5. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that step S4 specifically includes the following steps:

[0031] S4.1 on the original sample set Each sample in and each sampling starting point Sampling random noise vector ;

[0032] in, This represents a standard normally distributed random noise vector. This represents a multivariate Gaussian distribution with zero mean and covariance equal to the identity matrix.

[0033] S4.2 Based on cumulative noise figure Calculate the positive noisy samples:

[0034]

[0035] in, This represents a positive, noisy sample;

[0036] S4.3 Simultaneous calculation of negative noisy samples:

[0037]

[0038] Form semantically symmetric noisy sample pairs ;

[0039] in, This represents a negative, noisy sample.

[0040] 6. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that step S5 specifically includes the following steps:

[0041] S5.1 Using noisy samples As input, starting from the sampling point Start executing the skip-step reverse diffusion;

[0042] S5.2 adopts a deterministic DDIM sampling strategy (random control parameters) Iterative updates are performed according to the following formula:

[0043]

[0044] in, express The sample after denoising step This represents the output of the noise prediction network after training is complete. express The cumulative noise figure at any given time. Represents the randomness control parameter. Indicates deterministic sampling;

[0045] S5.3 with preset step size ( Decrease the time step and iterate through S5.2 until... Output enhanced network flow samples and and retain its original category label. ;

[0046] in, This indicates positively augmented network samples. This represents a negatively boosted network flow sample. Indicates the jump step size (integer);

[0047] 7. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that step S6 specifically includes the following steps:

[0048] S6.1 Calculate the total enhancement ratio ;

[0049] in, Indicates the number of noise variants at a single starting point. Represents the set of sampling start points The number of elements;

[0050] S6.2 Merge all augmented samples With the original sample set Construct a synthetic training set :

[0051]

[0052] in, This represents the probability that the model determines whether a real-time stream is malicious;

[0053] S6.3 Based on the aforementioned synthetic training set Training an intrusion detection model and the trained model Deployed in network security devices for real-time malicious traffic detection.

[0054] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0055] 1. This invention proposes a malicious traffic generation mechanism based on a multi-starting-point diffusion strategy. By introducing multiple initial noise samples in parallel at different time steps (t) during the diffusion process, it effectively overcomes the dependence of traditional single-starting-point diffusion models on the initial distribution. This strategy significantly improves the diversity and coverage of generated samples, especially enhancing the simulation capability for rare attack types and variant malicious traffic, thereby alleviating the problems of insufficient training data and long-tail categories.

[0056] 2. This invention deeply integrates time-step embedding with traffic semantic features, explicitly modeling the temporal evolution of malicious traffic within a denoising network. This ensures that the generated enhanced data not only retains the key structural features of the original attack behavior (such as protocol interaction sequences and payload patterns) but also possesses reasonable dynamic change characteristics. This significantly improves the robustness and generalization performance of downstream detection models when facing novel or disguised attacks. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0058] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] like Figure 1 As shown in this embodiment, a malicious traffic data enhancement method based on a multi-starting point diffusion strategy includes the following steps:

[0061] In some embodiments, the process of performing step S1 includes:

[0062] S1: Collect network traffic data packets, aggregate them into a labeled network flow sample set according to 5-tuples, and perform feature vectorization;

[0063] S2: Train the denoising diffusion implicit model DDIM based on the sample set to learn the latent distribution of network flow;

[0064] S3: Set multiple diffusion time steps as sampling start points, and configure the cumulative noise figure and semantic preservation rate of each start point;

[0065] S4: Based on the sampling starting point and the accumulated noise coefficient, Gaussian noise perturbation is applied to the network flow samples, and pairs of noisy samples are generated through symmetrical sampling;

[0066] S5: Using the trained DDIM model, perform a skip-step backdiffusion on noisy samples to generate enhanced network stream samples;

[0067] S6: Merge the enhanced network flow samples with the original network flow samples to construct a class-balanced synthetic training set for training the intrusion detection model.

[0068] In some specific embodiments, step S1 specifically includes the following steps:

[0069] S1.1 continuously collected raw network data packets (approximately 2.1 TB in total) for 7 days using traffic probes deployed on the mirror port of the core switch, and aggregated them into 50,000 network flow records based on the five-tuple (source IP address, destination IP address, source port number, destination port number, and transport layer protocol) using the CICFlowMeter tool;

[0070] S1.2 extracts multidimensional features for each network flow, including statistical features such as packet count. Total bytes Flow duration Average package interval time Package length variance The temporal characteristic is a sequence of packet arrival time intervals. The input is a one-dimensional convolutional neural network encoder containing two convolutional layers (kernel size 5, channels 32 and 64 respectively, ReLU activation layers), and the output is a 64-dimensional latent vector. Then the 5-dimensional statistical feature vector was combined with Concatenate and pass through an output dimension The fully connected layer is mapped to the final feature vector. ;

[0071] S1.3 Extract the five-tuple information of network flows and assign a category label to each network flow based on the threat intelligence platform and manual analysis results. ( This indicates healthy traffic. (Indicating malicious traffic), constructing the original sample set. ;

[0072] in, This represents the original set of labeled samples. Indicates the first Feature vector of each sample Indicates the first The feature vector of each sample Indicates the total number of samples;

[0073] In some embodiments, step S2 specifically includes the following steps:

[0074] S2.1 Construct the forward diffusion process, setting the total number of diffusion steps to... Linear noise scheduling is adopted. ( For any original sample During the diffusion time step The noise samples are represented as follows:

[0075] ,

[0076] in, Represents the cumulative noise figure. Indicates the first The noise scheduling coefficient of the step, Represents the current diffusion time step (integer, ... ), This represents the total number of diffusion steps. express Step with noisy samples, Represents a random noise vector;

[0077] S2.2 Design a noise prediction network based on the U-Net architecture Its input is noisy samples and time step (After sinusoidal positional encoding embedding), the backbone contains 3 downsampling / upsampling blocks, each integrating residual links and a self-attention mechanism, outputting a 128-dimensional noise prediction; the model uses the Adam optimizer (learning rate... (Batch size 256) Train for 200 epochs, minimizing the variational lower bound loss function:

[0078]

[0079] After training is complete, save the model's optimal parameters. ;

[0080] in, Denotes the variational lower bound loss function. Represents the mathematical expectation. Represents the L2 norm. Represents a noise prediction network. This represents the set of trainable parameters of the network. Indicates the time step of diffusion;

[0081] In some embodiments, step S3 specifically includes the following steps:

[0082] S3.1 Define the set of sampling start points ,Require and ;

[0083] in, Indicates the number of sampling start points. Represents the set of sampling start points. Indicates the first One sampling starting point;

[0084] S3.2 for each Calculate the cumulative noise figure At the same time, determine the semantic preservation rate. With diversity coefficient ;

[0085] in, Indicates semantic preservation rate, The larger the value, the stronger the semantic preservation. Represents the diversity coefficient. The higher the value, the higher the sample diversity;

[0086] In some embodiments, step S4 specifically includes the following steps:

[0087] S4.1 on the original sample set Each sample in and each sampling starting point Sampling random noise vector ;

[0088] in, This represents a standard normally distributed random noise vector. This represents a multivariate Gaussian distribution with zero mean and covariance equal to the identity matrix.

[0089] S4.2 Based on cumulative noise figure Calculate the positive noisy samples:

[0090]

[0091] in, This represents a positive, noisy sample;

[0092] S4.3 Simultaneous calculation of negative noisy samples:

[0093]

[0094] Form semantically symmetric noisy sample pairs ;

[0095] in, This represents a negative, noisy sample.

[0096] In some embodiments, step S5 specifically includes the following steps:

[0097] S5.1 Using noisy samples As input, starting from the sampling point Start executing the skip-step reverse diffusion;

[0098] S5.2 adopts a deterministic DDIM sampling strategy (random control parameters) Iterative updates are performed according to the following formula:

[0099]

[0100] in, express The sample after denoising step This represents the output of the noise prediction network after training is complete. express The cumulative noise figure at any given time. Represents the randomness control parameter. Indicates deterministic sampling;

[0101] S5.3 Setting the step size (satisfy ),from Decrease to 0 for a total of The S5.2 iteration finally outputs the enhanced network flow sample. and and retain its original category label. ;

[0102] In some embodiments, step S6 specifically includes the following steps:

[0103] S6.1 Calculate the total enhancement ratio ;

[0104] in, Indicates the number of noise variants at a single starting point. Represents the set of sampling start points The number of elements;

[0105] S6.2 Merge all augmented samples With the original sample set Construct a synthetic training set :

[0106]

[0107] in, This represents the probability that the model determines whether a real-time stream is malicious;

[0108] S6.3 Based on the aforementioned synthetic training set Train an intrusion detection model based on Transformer and the trained model Deployed in network security devices for real-time malicious traffic detection and output. This indicates the probability that the real-time stream is malicious.

[0109] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0110] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for enhancing malicious traffic data based on a multi-starting point diffusion strategy: the selection method includes the following steps: S1: Collect network traffic data packets, aggregate them into a labeled network flow sample set according to 5-tuples, and perform feature vectorization; S2: Train the denoising diffusion implicit model DDIM based on the sample set to learn the latent distribution of network flow; S3: Set multiple diffusion time steps as sampling start points, and configure the cumulative noise figure and semantic preservation rate of each start point; S4: Based on the sampling starting point and the accumulated noise coefficient, Gaussian noise perturbation is applied to the network flow samples, and pairs of noisy samples are generated through symmetrical sampling; S5: Using the trained DDIM model, perform a skip-step backdiffusion on noisy samples to generate enhanced network stream samples; S6: Merge the enhanced network flow samples with the original network flow samples to construct a class-balanced synthetic training set for training the intrusion detection model.

2. The network traffic anomaly detection method based on a dual filtering framework to mitigate label noise and dataset imbalance according to claim 1, characterized in that, Step S1 specifically includes the following steps: S1.1 collects raw network data packets through network probes or traffic mirroring, and aggregates them into network flows based on the five-tuple information (source IP address, destination IP address, source port number, destination port number, and transport layer protocol); S1.2 Extracts the multidimensional feature vector for each network flow, including statistical features such as the number of packets. Total bytes Flow duration Average package interval time Package length variance The temporal characteristic is a sequence of packet arrival time intervals. The hidden vector obtained by encoding through a one-dimensional convolutional neural network The statistical feature vector and the latent vector are concatenated and then mapped through a fully connected layer to... For feature vectors ; S1.3 Assign a category label to each network flow based on the five-tuple information of the network flow. ( This indicates healthy traffic. (Indicating malicious traffic), constructing the original sample set. ; in, This represents the original set of labeled samples. Indicates the first Feature vector of each sample Indicates the first The feature vector of each sample This represents the total number of samples.

3. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that, Step S2 specifically includes the following steps: S2.1 Constructing the forward diffusion process: For any original sample During the diffusion time step The noise samples are represented as follows: ， in, Represents the cumulative noise figure. Indicates the first The noise scheduling coefficient of the step, Represents the current diffusion time step (integer, ... ), This represents the total number of diffusion steps. express Step with noisy samples, Represents a random noise vector; S2.2 Design a noise prediction network based on the U-Net architecture Training is performed by minimizing the variational lower bound: in, Denotes the variational lower bound loss function. Represents the mathematical expectation. Represents the L2 norm. Represents a noise prediction network. This represents the set of trainable parameters of the network. Indicates the time step of diffusion.

4. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that, Step S3 specifically includes the following steps: S3.1 Define the set of sampling start points ,Require and ; in, Indicates the number of sampling start points. Represents the set of sampling start points. Indicates the first One sampling starting point; S3.2 for each Calculate the cumulative noise figure At the same time, determine the semantic preservation rate. With diversity coefficient ; in, Indicates semantic preservation rate, The larger the value, the stronger the semantic preservation. Represents the diversity coefficient. The higher the value, the higher the sample diversity.

5. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that, Step S4 specifically includes the following steps: Step 4.1 For the original sample set Each sample in and each sampling starting point Sampling random noise vector ; in, This represents a standard normally distributed random noise vector. This represents a multivariate Gaussian distribution with zero mean and covariance equal to the identity matrix. Step 4.2 Based on cumulative noise figure Calculate the positive noisy samples: in, This represents a positive, noisy sample; Step 4.3 Simultaneously calculate negative noisy samples: Form semantically symmetric noisy sample pairs ; in, This represents a negative, noisy sample.

6. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that, Step S5 specifically includes the following steps: S5.1 Using noisy samples As input, starting from the sampling point Start executing the skip-step back diffusion; S5.2 adopts a deterministic DDIM sampling strategy (random control parameters) Iterative updates are performed according to the following formula: .in, express The sample after denoising step This represents the output of the noise prediction network after training is complete. express The cumulative noise figure at any given time. Represents the randomness control parameter. Indicates deterministic sampling; S5.3 with preset step size ( Decrease the time step and iterate through S5.2 until... Output enhanced network flow samples and and retain its original category label. ; in, This indicates positively augmented network samples. This represents a negatively boosted network flow sample. This represents the step size (integer).

7. The malicious traffic data enhancement method based on a multi-starting point diffusion strategy according to claim 1, characterized in that, Step S6 specifically includes the following steps: S6.1 Calculate the total enhancement ratio ; in, Indicates the number of noise variants at a single starting point. Represents the set of sampling start points The number of elements; S6.2 Merge all augmented samples With the original sample set Construct a synthetic training set : .in, This represents the probability that the model determines whether a real-time stream is malicious; S6.3 Based on the aforementioned synthetic training set Training an intrusion detection model and the trained model Deployed in network security devices for real-time malicious traffic detection.

Images