A network intrusion detection counter sample defense method and device
By using a denoised diffusion probability model for adversarial detection, this method addresses the problem of insufficient generalization of existing defense methods against high-intensity adversarial attacks, achieving high robustness and high generalization of defense against adversarial samples, and is applicable to various intrusion detection systems.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA STATE SHIPBUILDING CORP LTD RESEARCH INSTITUTE 719
- Filing Date
- 2026-03-16
- Publication Date
- 2026-05-15
AI Technical Summary
Existing deep learning-based intrusion detection systems lack generalization capabilities when facing adversarial attacks, making them unable to withstand high-intensity attacks. Existing methods are either ineffective in addressing or fail to adapt to various types of adversarial attack defense mechanisms, lacking generalization capabilities against different attack methods.
A denoising diffusion probability model is adopted. By extracting features from the input network traffic, a traffic feature vector is obtained. The denoising diffusion probability model is trained based on the traffic feature vector of clean samples. Noise is injected during forward diffusion and backward denoising diffusion, and the features of clean samples are recovered through a noise prediction network. The reconstruction loss is calculated and the adversarial detection threshold is determined to determine whether the sample to be detected is an adversarial sample or a clean sample.
It significantly improves the robustness and generalization of adversarial example defense, effectively identifies various types of adversarial attacks, enhances the flexibility and adaptability of the model, adapts to different and unknown attack methods, and improves defense capabilities.
Smart Images
Figure CN121887533B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for defending against adversarial samples in network intrusion detection. Background Technology
[0002] Cybersecurity threats can lead to data breaches, service disruptions, and even damage to physical infrastructure. As an important cybersecurity technology, Network Intrusion Detection Systems (NIDS) can identify potential abnormal behaviors and attack patterns by monitoring and analyzing network traffic in real time, thereby providing early warnings and support for cybersecurity protection.
[0003] Deep learning-based intrusion detection systems have demonstrated significant advantages in detecting malicious traffic. However, existing research indicates that due to the inherent vulnerabilities of neural networks, deep learning-based intrusion detection systems struggle to defend against threats from adversarial examples (AEs). In the field of traffic intrusion detection, attackers meticulously craft adversarial examples by modifying original traffic data or traffic sample features, aiming to mislead intrusion detection systems and cause them to misclassify network traffic. When launching adversarial attacks, attackers can target any feature in the traffic characteristics, employing various types of attacks with different spatial dimensions (such as feature space or problem space) and varying perturbation strengths to achieve their desired objectives. For example, attackers might use feature space attacks to finely perturb specific feature values to evade detection, or use problem space attacks to construct multiple perturbation operations that alter multidimensional feature values to influence classification results.
[0004] Existing traffic adversarial defense mechanisms lack the ability to generalize defense against high-intensity attacks. Some existing methods rely on training detectors based on known adversarial examples or on detecting whether samples are close to the decision boundary based on fixed settings, but they lack the ability to generalize defense against different attack methods. Other methods rely on randomness to increase the difficulty of attacks, but they cannot reliably achieve robust defense. Summary of the Invention
[0005] This invention provides a method and apparatus for defending against adversarial examples in network intrusion detection, which addresses the shortcomings of existing technologies. It reconstructs sample features through a denoising diffusion probability model, exhibiting high robustness and high generalization against various types of adversarial attacks.
[0006] This invention provides a method for defending against adversarial examples in network intrusion detection, comprising:
[0007] Feature extraction is performed on the input network traffic to obtain a traffic feature vector; the traffic feature vector includes the traffic feature vector of clean samples and the traffic feature vector of samples to be detected;
[0008] The denoising diffusion probability model is trained based on the traffic feature vector of the clean sample to obtain the target denoising diffusion probability model.
[0009] The traffic feature vectors of multiple clean samples are input into the target denoising diffusion probability model for reconstruction, and the reconstruction loss corresponding to each clean sample is output. The adversarial detection threshold is determined based on the statistical distribution of the reconstruction loss corresponding to each clean sample.
[0010] The flow feature vector of the sample to be detected is input into the target denoising diffusion probability model, and the reconstruction loss of the sample to be detected is output.
[0011] Determine whether the reconstruction loss of the sample to be detected is greater than the adversarial detection threshold. If it is, the sample to be detected is determined to be an adversarial sample; otherwise, it is determined to be a clean sample.
[0012] According to the network intrusion detection adversarial sample defense method, the step of extracting features from the input network traffic to obtain a traffic feature vector includes:
[0013] The five-tuple is used as a flow identifier to group the data packets of the incoming network traffic into bidirectional flows. The five-tuple includes the source IP address, destination IP address, source port, destination port, and protocol.
[0014] For each bidirectional flow, statistical features, protocol-related features, directional features, and temporal features are extracted to construct the flow feature vector.
[0015] According to the network intrusion detection adversarial example defense method, the step of training a denoising diffusion probability model based on the traffic feature vector of the clean sample to obtain the target denoising diffusion probability model includes:
[0016] Initialize a noise prediction network, which is used to predict the noise components injected during the diffusion process;
[0017] A sample of a preset size is randomly selected from a clean sample set. The sample of the preset size is used as the model input to perform a forward diffusion process. The forward diffusion process injects Gaussian noise into each sample step by step at T time steps according to a preset diffusion coefficient to obtain a noisy sample.
[0018] The noisy sample and its corresponding time step are input into the noise prediction network to obtain the predicted noise component, and a reverse denoising process is performed to gradually restore the clean sample.
[0019] The difference between the predicted noise component and the actual injected noise is calculated to obtain the training loss;
[0020] The loss gradient is calculated based on the training loss, and the parameters of the noise prediction network are updated using the gradient descent method until the noise prediction network converges, thus obtaining the target denoising diffusion probability model.
[0021] According to the aforementioned network intrusion detection adversarial sample defense method, the forward diffusion specifically refers to:
[0022] ;
[0023] in, For clean sample feature vectors, Let be the feature vector after adding noise at step t. Where is the diffusion coefficient. It is a Gaussian function. This is a clean sample.
[0024] According to the aforementioned network intrusion detection adversarial sample defense method, the reverse denoising specifically includes:
[0025]
[0026] Where ε represents the actual injected noise. The parameter is The noise prediction network, where t is the diffusion step number. Where is the diffusion coefficient. These are the feature vectors of clean samples.
[0027] According to the network intrusion detection adversarial sample defense method, determining the adversarial detection threshold based on the statistical distribution of the reconstruction loss corresponding to each clean sample includes:
[0028] Obtain the arithmetic mean of the reconstruction loss corresponding to each clean sample;
[0029] Based on the arithmetic mean and the reconstruction loss corresponding to each clean sample, the standard deviation of the reconstruction loss is determined;
[0030] Based on the arithmetic mean and standard deviation and a preset scaling factor, an adversarial detection threshold is determined. The specific method for determining the adversarial detection threshold is as follows:
[0031]
[0032] Where μ is the arithmetic mean, σ is the standard deviation of the reconstruction loss, and k is the preset scaling factor. This represents the total number of clean samples. The reconstructed feature vector, To counter detection thresholds.
[0033] According to the aforementioned network intrusion detection adversarial sample defense method, the method for determining the reconstruction loss of the sample to be detected is as follows:
[0034]
[0035] in, Let be the flow feature vector of the sample to be detected. The reconstruction function represents the target denoising diffusion probability model. This is the reconstructed feature vector.
[0036] Secondly, the present invention also provides a network intrusion detection adversarial sample defense device, characterized in that it comprises:
[0037] The traffic feature extraction module is used to extract features from the input network traffic to obtain a traffic feature vector; the traffic feature vector includes the traffic feature vector of the clean sample and the traffic feature vector of the sample to be detected;
[0038] The diffusion model training module is used to train a denoising diffusion probability model based on the flow feature vector of the clean sample to obtain the target denoising diffusion probability model.
[0039] The adversarial detection threshold determination module is used to input the traffic feature vectors of multiple clean samples into the target denoising diffusion probability model for reconstruction, output the reconstruction loss corresponding to each clean sample, and determine the adversarial detection threshold based on the statistical distribution of the reconstruction loss corresponding to each clean sample.
[0040] The reconstruction loss acquisition module is used to input the traffic feature vector of the sample to be detected into the target denoising diffusion probability model and output the reconstruction loss of the sample to be detected.
[0041] The determination module is used to determine whether the reconstruction loss of the sample to be detected is greater than the adversarial detection threshold. If it is, the sample to be detected is determined to be an adversarial sample; otherwise, it is determined to be a clean sample.
[0042] Thirdly, the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the program, implements the steps of any of the network intrusion detection adversarial sample defense methods described above.
[0043] Fourthly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network intrusion detection adversarial sample defense method as described above.
[0044] (1) The network intrusion detection adversarial sample defense method and device provided by this invention introduces the denoising diffusion probability model into the field of network traffic adversarial defense for the first time, proposes an adversarial defense framework based on the diffusion model, and performs adversarial detection based on the denoising diffusion probability model. By learning the generation process of clean data distribution, the denoising diffusion probability model can fit the distribution characteristics of clean samples with higher accuracy and effectively recover the sample features affected by adversarial disturbances, thus solving the problem of insufficient generalization of existing defense methods against high-intensity adversarial attacks. This invention defends by detecting adversarial samples without relying on prior knowledge of specific attack forms or classification models. It can be widely applied to various intrusion detection systems, has high flexibility and adaptability, and can better adapt to different and unknown attack methods and high-intensity adversarial samples, significantly improving the generalization of defense.
[0045] (2) The denoising diffusion probability model of this invention introduces inherent randomness in the forward diffusion and backward denoising processes, which significantly increases the difficulty of adversarial attack methods. Due to the existence of randomness, attackers find it difficult to accurately predict the gradient information of the model or determine the optimal attack direction. This mechanism plays a key role in enhancing the robustness of the model and provides additional security against complex adversarial attacks. Attached Figure Description
[0046] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0047] Figure 1 This is a flowchart illustrating an optional network intrusion detection adversarial sample defense method provided by the present invention;
[0048] Figure 2 This is a schematic diagram of an optional denoising diffusion model training process provided in an embodiment of the present invention;
[0049] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0051] This invention provides an adversarial defense method for intrusion detection data based on a diffusion model, aiming to solve the technical problems of insufficient generalization ability and poor robustness against high-intensity attacks in existing deep learning intrusion detection systems.
[0052] Specifically, this invention is based on the Denoising Diffusion Probabilistic Model (DDP) in the field of intrusion detection. The clean sample feature vector is input into the DDP model to calculate its reconstruction loss. Based on the reconstruction error distribution of clean samples, a threshold for distinguishing clean samples from adversarial samples is determined. For any sample to be detected, if its reconstruction loss exceeds the preset threshold, it is identified as an adversarial sample. Through the high fitting ability of the DDP model to the distribution of clean samples, adversarial samples, which typically deviate from the distribution of clean samples, exhibit significantly increased reconstruction errors, thus enabling effective identification by detection mechanisms.
[0053] The following is combined with Figures 1-3 This invention describes the network intrusion detection adversarial sample defense method and apparatus provided in embodiments of the present invention.
[0054] Figure 1 This is a flowchart illustrating the network intrusion detection adversarial sample defense method provided by the present invention, as shown below. Figure 1 As shown, including but not limited to the following steps:
[0055] Step 102: Extract features from the input network traffic to obtain a traffic feature vector; the traffic feature vector includes the traffic feature vector of the clean sample and the traffic feature vector of the sample to be detected;
[0056] Step 104: Train the denoising diffusion probability model based on the traffic feature vector of the clean sample to obtain the target denoising diffusion probability model;
[0057] Step 106: Input the traffic feature vectors of multiple clean samples into the target denoising diffusion probability model for reconstruction, output the reconstruction loss corresponding to each clean sample, and determine the adversarial detection threshold based on the statistical distribution of the reconstruction loss corresponding to each clean sample.
[0058] Step 108: Input the flow feature vector of the sample to be detected into the target denoising diffusion probability model, and output the reconstruction loss of the sample to be detected;
[0059] Step 110: Determine whether the reconstruction loss of the sample to be detected is greater than the adversarial detection threshold. If so, determine that the sample to be detected is an adversarial sample; otherwise, determine that it is a clean sample.
[0060] In this embodiment, the input network traffic is first subjected to feature extraction to obtain a traffic feature vector. The traffic feature vector includes both the traffic feature vector of the clean samples used for model training and the traffic feature vector of the samples to be detected later.
[0061] Subsequently, a denoising diffusion probability model is trained based on the traffic feature vector of the clean sample. By simulating the Markov chain process of gradually adding and removing noise, the denoising diffusion probability model learns the ability to recover clean samples from the noise distribution, thereby obtaining the target denoising diffusion probability model.
[0062] After model training, the traffic feature vectors of multiple clean samples are input into the target denoising diffusion probability model for reconstruction, obtaining the reconstruction loss corresponding to each clean sample. An adversarial detection threshold is then determined based on the statistical distribution of these reconstruction losses. For any sample to be detected, its traffic feature vector is input into the target denoising diffusion probability model for reconstruction, and the reconstruction loss of the sample is calculated. Finally, the reconstruction loss of the sample is compared with the adversarial detection threshold. If the reconstruction loss of the sample exceeds the adversarial detection threshold, the sample is determined to be an adversarial sample; otherwise, it is determined to be a clean sample.
[0063] This invention uses a diffusion model to detect perturbations in the samples to be tested, without requiring retraining of downstream classifiers. It provides defense in a cascaded, plug-and-play manner, effectively addressing adversarial sample attacks in the feature space and problem space.
[0064] In an optional embodiment, the process of extracting features from the input network traffic to obtain a traffic feature vector further includes: grouping the data packets of the input network traffic into bidirectional flows using a 5-tuple as a flow identifier.
[0065] The 5-tuple specifically includes the source IP address, destination IP address, source port, destination port, and transport layer protocol. After completing bidirectional flow grouping, four types of features are extracted from each bidirectional flow to construct the traffic feature vector. These four types of features may include: statistical features (e.g., statistics on the number of data packets and bytes), protocol-related features (e.g., the frequency of occurrence of specific protocol flags), directional features (e.g., statistical differences between forward and backward flows), and temporal features (e.g., statistics on the time interval between data packet arrivals). This invention, by constructing a bidirectional statistical model, can comprehensively characterize the multidimensional behavioral characteristics of network traffic, providing a standardized input representation for subsequent denoising and diffusion probability models.
[0066] In an optional embodiment, the process of training the denoising diffusion probability model based on the traffic feature vector of clean samples to obtain the target denoising diffusion probability model specifically includes the following steps:
[0067] Figure 2 This is a schematic diagram of an optional denoising diffusion model training process provided in an embodiment of the present invention, as shown below. Figure 2 As shown, a noise prediction network is first initialized to predict the noise component injected during the diffusion process. This network typically uses a U-Net architecture to handle temporal features. Then, a batch of samples of a preset size S is randomly selected from the clean sample set. This batch of samples is used as the model input to perform a forward diffusion process. The forward diffusion process injects Gaussian noise into each sample step by step over T time steps according to a preset diffusion coefficient, resulting in a noisy sample.
[0068] Next, the noisy sample and its corresponding time step t are input into the noise prediction network to obtain the predicted noise component, and a reverse denoising process is performed to gradually restore the clean sample. Then, the difference between the predicted noise component and the actual injected noise ε is calculated to obtain the training loss Loss.
[0069] Finally, the loss gradient is calculated based on the training loss Loss, and the parameters of the noise prediction network are updated using the gradient descent method. The above process is repeated iteratively until the noise prediction network converges, thereby obtaining the target denoising diffusion probability model.
[0070] Specifically, input clean samples ; number of diffusion steps Training rounds ; parameters are Noise prediction network diffusion coefficient Batch size Learning rate .
[0071] Optionally, the forward diffusion specifically refers to:
[0072] ;
[0073] in, For clean sample feature vectors, Let be the feature vector after adding noise at step t. Where is the diffusion coefficient. It is a Gaussian function. This is a clean sample.
[0074] The reverse denoising specifically refers to:
[0075]
[0076] Where ε represents the actual injected noise. The parameter is The noise prediction network, where t is the diffusion step number. Where is the diffusion coefficient. These are the feature vectors of clean samples.
[0077] Then, the parameters of the denoising diffusion model are updated:
[0078]
[0079] Repeated iterative training This yields the denoising diffusion model.
[0080] In an optional embodiment, the process of determining the adversarial detection threshold based on the statistical distribution of the reconstruction loss corresponding to each clean sample is as follows: First, N clean samples are input into the target denoising diffusion probability model for reconstruction to obtain the corresponding set of reconstruction losses. Then, the arithmetic mean μ of the reconstruction loss set is calculated to reflect the central tendency of the reconstruction loss of clean samples.
[0081] Next, the deviation distribution of the reconstruction loss of each clean sample from the arithmetic mean μ is calculated to obtain the standard deviation σ.
[0082] Finally, the adversarial detection threshold φ is determined based on the mean μ and the standard deviation σ. Specifically, a scaling factor k is introduced to control the magnitude of the threshold deviation from the mean μ, where k is a preset constant greater than 0, used to adjust the balance between detection sensitivity and false alarm rate.
[0083] Optionally, the method for determining the adversarial detection threshold is as follows:
[0084]
[0085] Where μ is the arithmetic mean, σ is the standard deviation of the reconstruction loss, and k is the preset scaling factor. This represents the total number of clean samples. The reconstructed feature vector, The scaling factor k is used to control the deviation of the adversarial detection threshold from the mean μ, thereby achieving adaptive adjustment of the anomaly sensitivity.
[0086] It is worth noting that the scaling factor k can be set from 2 to 5. When k is a smaller value (e.g., k=2), the adversarial detection threshold φ is relatively low, and the detection mechanism is more sensitive, making it suitable for scenarios with strict requirements for false negatives, but it may increase the risk of false positives. When k is a larger value (e.g., k=5), the adversarial detection threshold φ is significantly increased, and the detection standard is more stringent, making it suitable for high-confidence detection scenarios with strict requirements for false positives. In practical applications, the value of k can be flexibly adjusted according to the security strategy and performance requirements of the intrusion detection system.
[0087] In an optional embodiment, the reconstruction loss of the sample to be detected is calculated using the following expression:
[0088] The specific method for determining the reconstruction loss of the sample to be detected is as follows:
[0089]
[0090] in, Let be the flow feature vector of the sample to be detected. The reconstruction function represents the target denoising diffusion probability model. This represents the reconstructed feature vector. This invention uses this reconstruction loss quantification model to assess the recovery capability of the sample to be detected. Adversarial samples, due to their deviation from a clean distribution, will exhibit significantly higher reconstruction errors.
[0091] In an optional embodiment, the training process of the target denoising diffusion probability model may further include: setting training hyperparameters, which at least include the number of diffusion steps T (typically ranging from 100 to 1000 steps), the number of training epochs E (usually set to 100 to 500 epochs), the batch size S (generally 32 to 128), and the learning rate η (e.g., 0.0001 to 0.001). A batch of samples of size S is randomly selected from a clean sample set as training input, and the forward diffusion process and the reverse denoising process are performed. The model parameters are updated using gradient descent as follows: ,
[0092] in, This represents the gradient of the loss function with respect to the network parameters θ.
[0093] Repeat the above training process for E rounds, traversing all clean samples until the model converges, to obtain the target denoising diffusion probability model that has the ability to recover the clean sample distribution from the noise distribution.
[0094] On the other hand, the present invention also provides a network intrusion detection adversarial sample defense device, the device comprising: a traffic feature extraction module, used to extract features from input network traffic to obtain a traffic feature vector; the traffic feature vector includes the traffic feature vector of a clean sample and the traffic feature vector of the sample to be detected;
[0095] The diffusion model training module is used to train a denoising diffusion probability model based on the flow feature vector of the clean sample to obtain the target denoising diffusion probability model.
[0096] The adversarial detection threshold determination module is used to input the traffic feature vectors of multiple clean samples into the target denoising diffusion probability model for reconstruction, output the reconstruction loss corresponding to each clean sample, and determine the adversarial detection threshold based on the statistical distribution of the reconstruction loss corresponding to each clean sample.
[0097] The reconstruction loss acquisition module is used to input the traffic feature vector of the sample to be detected into the target denoising diffusion probability model and output the reconstruction loss of the sample to be detected.
[0098] The determination module is used to determine whether the reconstruction loss of the sample to be detected is greater than the adversarial detection threshold. If it is, the sample to be detected is determined to be an adversarial sample; otherwise, it is determined to be a clean sample.
[0099] It should be noted that the network intrusion detection adversarial sample defense device provided in this embodiment of the invention can execute the network intrusion detection adversarial sample defense method of any of the above embodiments during specific operation, which will not be elaborated in this embodiment.
[0100] In an optional embodiment, the target denoising and diffusion probability model, after training, is deployed as an independent adversarial detection module at the data end of the intrusion detection system, i.e., in the processing pipeline between traffic feature extraction and the downstream classifier. Therefore, this invention does not require modification of the network structure, training parameters, or decision logic of the downstream classifier, achieving adversarial defense in a cascaded, plug-and-play manner. When the target denoising and diffusion probability model detects adversarial samples, the intrusion detection system can trigger a preset alarm mechanism to notify the security administrator, or activate a blocking mechanism to directly discard suspicious traffic, thereby significantly improving the system's defense capability against adversarial attacks without changing the existing detection architecture. This plug-and-play characteristic allows this defense method to be widely applied to various deep learning-based intrusion detection systems, exhibiting good versatility and adaptability.
[0101] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 3As shown, the electronic device may include: a processor 310, a communications interface 320, a memory 330, and a communications bus 340, wherein the processor 310, the communications interface 320, and the memory 330 communicate with each other through the communications bus 340. The processor 310 can call logical instructions in the memory 330 to execute a network intrusion detection adversarial example defense method. This method includes: extracting features from input network traffic to obtain traffic feature vectors; the traffic feature vectors include traffic feature vectors of clean samples and traffic feature vectors of samples to be detected; training a denoising diffusion probability model based on the traffic feature vectors of the clean samples to obtain a target denoising diffusion probability model; inputting the traffic feature vectors of multiple clean samples into the target denoising diffusion probability model for reconstruction, outputting the reconstruction loss corresponding to each clean sample, and determining an adversarial detection threshold based on the statistical distribution of the reconstruction losses corresponding to each clean sample; inputting the traffic feature vector of the sample to be detected into the target denoising diffusion probability model, outputting the reconstruction loss of the sample to be detected; determining whether the reconstruction loss of the sample to be detected is greater than the adversarial detection threshold; if so, determining the sample to be detected as an adversarial sample; otherwise, determining it as a clean sample.
[0102] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0103] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the network intrusion detection adversarial sample defense method provided in the above embodiments.
[0104] It should be noted that, in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. Those skilled in the art can understand the specific meaning of the above terms in the present invention according to the specific circumstances.
[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for defending against adversarial examples in network intrusion detection, characterized in that, include: Feature extraction is performed on the input network traffic to obtain a traffic feature vector; the traffic feature vector includes the traffic feature vector of clean samples and the traffic feature vector of samples to be detected; The denoising diffusion probability model is trained based on the traffic feature vector of the clean sample to obtain the target denoising diffusion probability model. The traffic feature vectors of multiple clean samples are input into the target denoising diffusion probability model for reconstruction, and the reconstruction loss corresponding to each clean sample is output. The adversarial detection threshold is determined based on the statistical distribution of the reconstruction loss corresponding to each clean sample. The flow feature vector of the sample to be detected is input into the target denoising diffusion probability model, and the reconstruction loss of the sample to be detected is output. Determine whether the reconstruction loss of the sample to be detected is greater than the adversarial detection threshold. If it is, the sample to be detected is determined to be an adversarial sample; otherwise, it is determined to be a clean sample.
2. The network intrusion detection adversarial sample defense method according to claim 1, characterized in that, The step of extracting features from the input network traffic to obtain a traffic feature vector includes: The five-tuple is used as a flow identifier to group the data packets of the incoming network traffic into bidirectional flows. The five-tuple includes the source IP address, destination IP address, source port, destination port, and protocol. For each bidirectional flow, statistical features, protocol-related features, directional features, and temporal features are extracted to construct the flow feature vector.
3. The network intrusion detection adversarial sample defense method according to claim 1, characterized in that, The process of training a denoising diffusion probability model based on the traffic feature vector of the clean sample to obtain the target denoising diffusion probability model includes: Initialize a noise prediction network, which is used to predict the noise components injected during the diffusion process; A sample of a preset size is randomly selected from a clean sample set. The sample of the preset size is used as the model input to perform a forward diffusion process. The forward diffusion process injects Gaussian noise into each sample step by step at T time steps according to a preset diffusion coefficient to obtain a noisy sample. The noisy sample and its corresponding time step are input into the noise prediction network to obtain the predicted noise component, and a reverse denoising process is performed to gradually restore the clean sample. The difference between the predicted noise component and the actual injected noise is calculated to obtain the training loss; The loss gradient is calculated based on the training loss, and the parameters of the noise prediction network are updated using the gradient descent method until the noise prediction network converges, thus obtaining the target denoising diffusion probability model.
4. The network intrusion detection adversarial sample defense method according to claim 3, characterized in that, The forward diffusion specifically refers to: ； in, For clean sample feature vectors, Let be the feature vector after adding noise at step t. The diffusion coefficient is... It is a Gaussian function. This is a clean sample.
5. The network intrusion detection adversarial sample defense method according to claim 3, characterized in that, The reverse denoising specifically refers to: Where ε represents the actual injected noise, The parameter is The noise prediction network, where t is the diffusion step number. Let be the feature vector after adding noise at step t. The diffusion coefficient is... These are the feature vectors of clean samples.
6. The network intrusion detection adversarial sample defense method according to claim 1, characterized in that, The step of determining the adversarial detection threshold based on the statistical distribution of the reconstruction loss corresponding to each clean sample includes: Obtain the arithmetic mean of the reconstruction loss corresponding to each clean sample; Based on the arithmetic mean and the reconstruction loss corresponding to each clean sample, the standard deviation of the reconstruction loss is determined; Based on the arithmetic mean and standard deviation and a preset scaling factor, an adversarial detection threshold is determined. The specific method for determining the adversarial detection threshold is as follows: Where μ is the arithmetic mean, σ is the standard deviation of the reconstruction loss, and k is the preset scaling factor. This represents the total number of clean samples. The reconstructed feature vector, To counter detection thresholds.
7. The network intrusion detection adversarial sample defense method according to claim 1, characterized in that, The specific method for determining the reconstruction loss of the sample to be detected is as follows: in, Let be the flow feature vector of the sample to be detected. The reconstruction function represents the target denoising diffusion probability model. This is the reconstructed feature vector.
8. A network intrusion detection adversarial sample defense device, characterized in that, include: The traffic feature extraction module is used to extract features from the input network traffic to obtain a traffic feature vector; the traffic feature vector includes the traffic feature vector of the clean sample and the traffic feature vector of the sample to be detected; The diffusion model training module is used to train a denoising diffusion probability model based on the flow feature vector of the clean sample to obtain the target denoising diffusion probability model. The adversarial detection threshold determination module is used to input the traffic feature vectors of multiple clean samples into the target denoising diffusion probability model for reconstruction, output the reconstruction loss corresponding to each clean sample, and determine the adversarial detection threshold based on the statistical distribution of the reconstruction loss corresponding to each clean sample. The reconstruction loss acquisition module is used to input the traffic feature vector of the sample to be detected into the target denoising diffusion probability model and output the reconstruction loss of the sample to be detected. The determination module is used to determine whether the reconstruction loss of the sample to be detected is greater than the adversarial detection threshold. If it is, the sample to be detected is determined to be an adversarial sample; otherwise, it is determined to be a clean sample.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the network intrusion detection adversarial sample defense method as described in any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the network intrusion detection adversarial sample defense method as described in any one of claims 1 to 7.