Network traffic data enhancement method and system based on time sequence generative adversarial network
By evaluating BiLSTM networks and multi-task discriminators, and combining density and boundary weight optimization, protocol-compliant minority class network traffic samples are generated. This solves the problems of insufficient temporal consistency and protocol compliance in existing technologies, and improves the generation quality and model stability of network traffic datasets.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING UNIV OF POSTS & TELECOMM
- Filing Date
- 2026-01-27
- Publication Date
- 2026-04-24
AI Technical Summary
Existing technologies struggle to generate high-quality minority class time-series traffic samples that combine temporal consistency, protocol compliance, and representativeness of minority class characteristics, thus failing to effectively alleviate the class imbalance problem in network traffic datasets.
BiLSTM network is used to enhance the temporal modeling capability. A multi-task discriminator is used to evaluate authenticity, temporality and categoricality. The density weight and boundary weight are dynamically optimized to construct a weighted supervised loss. A protocol compliance repair mechanism and a generator protocol constraint layer are used to train the generator and discriminator in stages to generate minority class network traffic samples that meet the requirements of the feature space.
The generated minority class traffic samples combine temporal consistency, feature authenticity, and minority class representativeness, effectively alleviating the problem of class imbalance in the dataset, improving the stability and reliability of the model generation process, and ensuring that the protocol fields of the generated samples are legal and valid.
Smart Images
Figure CN121923911A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of deep learning, specifically to a method and system for enhancing network traffic data based on temporal generative adversarial networks. Background Technology
[0002] With the increasingly severe cybersecurity situation, anomaly traffic detection has become a core component of ensuring network security, and the performance of detection models highly depends on high-quality network traffic datasets. In real networks, normal traffic accounts for a very high proportion, while a minority of anomaly traffic samples, such as ICMP flood packets and malicious DNS resolution requests, typically account for less than 5%. This leads to a widespread class imbalance problem in network traffic datasets, severely impacting the accuracy of anomaly detection models in identifying these minority anomaly traffic types. Generative Adversarial Networks (GANs) have significant advantages in the field of time series data generation. Among them, TimeGAN, as a dedicated GAN framework for time series data, works collaboratively through four components: an embedding network, a recovery network, a generator, and a discriminator. It combines supervised and unsupervised adversarial losses to characterize the temporal dependencies and dynamic feature distribution of time series data, becoming a key technological direction for augmenting network traffic time series data.
[0003] In existing technologies, network traffic generation schemes based on traditional TimeGAN are used to alleviate the problem of class imbalance in datasets. These schemes primarily involve capturing packets using tcpdump and filtering redundant packets with Wireshark, then extracting packet features. Some schemes simply divide static features into temporal features or directly input discrete data packets. Feature encoding often uses 1D vectors without adaptation or optimization for subsequent feature extraction networks. They adhere to the traditional four-component TimeGAN framework. The generator uses a unidirectional recurrent neural network (RNN) to generate temporal samples based on random noise, capturing only unidirectional temporal dependencies. The discriminator only performs binary classification of real / synthetic samples, outputting a single realism feedback. A uniform training strategy is used, applying a uniformly weighted supervised loss without designing differentiated optimization mechanisms for minority class sample distributions. Furthermore, the generated samples are not specifically verified or repaired according to RFC standards, relying instead on the model itself to learn protocol constraints.
[0004] It is easy to see that the traditional TimeGAN and the network traffic generation technology based on it used in the existing technology are difficult to generate high-quality minority class time-series traffic samples that have both time sequence consistency, protocol compliance and representativeness of minority class characteristics. Summary of the Invention
[0005] The present invention aims to at least partially solve the technical problems in the above-mentioned technologies.
[0006] To this end, the present invention discloses a method for enhancing network traffic data based on temporal generative adversarial networks, comprising the following steps:
[0007] S1: Collect data packets from a minority of abnormal network traffic types and map them to an input matrix. and the input matrix Correct the illegal protocol fields in the document;
[0008] S2: Construct static noise and timing noise After network mapping and protocol constraint processing, a representation sequence that meets the requirements of the feature space is generated;
[0009] S3: Receive the real sample latent sequence and synthetic sample latent sequence Extract feature association information and temporal features, output multi-dimensional discriminant labels, and optimize the discriminator through a multi-task loss function;
[0010] S4: Calculate the density weights and boundary weights of minority class samples and perform linear fusion, then construct a weighted supervision loss based on the fused weights;
[0011] S5: Pre-train the embedding network and the recovery network, optimize the reconstruction loss to the preset convergence threshold; jointly train the generator and discriminator, and alternately update the discriminator and generator until the preset training termination condition is met;
[0012] S6: Input dual-source random noise into the trained generator and output minority class network traffic samples after protocol constraints.
[0013] In addition, the network traffic data enhancement method based on temporal generative adversarial networks disclosed in this invention may also have the following additional technical features:
[0014] Further, step 1 specifically includes:
[0015] Collect data packets of a few types of abnormal network traffic;
[0016] The characteristics of data packets are divided into static characteristics. And temporal characteristics, with a fixed time window Data packets are intercepted, and the uniform sequence length is... To obtain the basic input unit ,in, This is the original time series matrix. For feature dimensions;
[0017] The time sequence characteristics of data packets are sorted according to preset field priority, and the original time sequence matrix is then processed. Mapped to matrix Static features As the first Row merge matrix To generate the input matrix ;
[0018] Based on the preset protocol standard, the checksums of IP, TCP and UDP are calculated through the non-checksum field, and the violating protocol field is corrected with the most recent valid value.
[0019] Further, step 2 specifically includes:
[0020] Constructing static noise and timing noise Timing noise Maintain continuous correlation between adjacent time steps;
[0021] static noise Static latent representations are generated through a multi-layer mapping network containing nonlinear activation and regularization mechanisms.
[0022] Construct a BiLSTM network, with the static latent representation, the latent representation of the previous time step, and the current temporal noise as inputs at each time step. To generate potential representation time series;
[0023] The latent representation temporal sequence is upsampled and mapped to the feature space through deconvolution and local receptive field structure. Violating fields are corrected by protocol constraint layer to generate representation sequence.
[0024] Further, step 3 specifically involves:
[0025] Receive the latent sequence of real samples from the embedded network output. And the latent sequence of the synthesized sample output by the generator ;
[0026] A multi-layer 2D-CNN is used as a local feature extraction layer to extract local correlation features between fields;
[0027] Construct a BiLSTM temporal discriminant layer, inputting the flattened local correlation feature sequence and outputting a temporal bisection vector. ;
[0028] Fully connected layer outputs realism labels Matching labels with minority classes The discriminator is optimized using a multi-task loss function, specifically as follows:
[0029] ,in, For cross-entropy loss, For mean square error loss, These are the predicted values for the corresponding labels. This is the preset balance coefficient.
[0030] Further, step 4 specifically involves:
[0031] The density weights of minority class samples are calculated using kernel density estimation (KDE), specifically as follows:
[0032] ,in, For the sample Local density, The maximum local density for all samples. These are preset parameters;
[0033] Support vector machines are used to divide the samples into boundary samples and non-boundary samples, and preset boundary weights are assigned to the boundary samples and non-boundary samples respectively. ;
[0034] The fusion weights are obtained by combining linear fusion density weights and boundary weights. ,in, The preset fusion coefficient;
[0035] The weighted supervision loss is constructed by embedding the fusion weights into the supervision loss, as follows:
[0036] ,in, For the first The minority class sample number The true latent vector at each time step. The latent vector simulated by the generator. For expectation operator, This represents the actual data distribution.
[0037] Another aspect of the present invention discloses a network traffic data enhancement system based on a temporal generative adversarial network, comprising:
[0038] Memory, used to store computer programs;
[0039] A processor is configured to implement the network traffic data enhancement method based on a time-series generative adversarial network when executing the computer program.
[0040] The network traffic data enhancement method and system based on temporal generative adversarial networks disclosed in this invention have at least the following beneficial effects:
[0041] (1) Enhance the time series modeling capability through BiLSTM and realize the triple evaluation of authenticity, time series and categoricality through multi-task discriminator to ensure that the generated minority class traffic samples have both time series consistency, feature authenticity and minority class representativeness, and avoid problems such as time series breakage and feature deviation.
[0042] (2) The adaptive weighting module dynamically optimizes density weights and boundary weights, focusing on sparse regions and boundary regions of minority classes, which greatly improves the generation priority and coverage of such key samples and effectively alleviates the problem of class imbalance in the dataset.
[0043] (3) Through the protocol compliance repair mechanism and the generator protocol constraint layer, ensure that the protocol fields of the generated samples are legal and valid, and avoid data packets from becoming invalid due to verification failure or field violations;
[0044] (4) Standardized structured and temporal processing, 2D matrix encoding and static-temporal feature fusion scheme, adapt to the joint feature extraction requirements of CNN and LSTM, and at the same time reduce the impact of byte-level error through error tolerance mechanism, improve the model input quality and feature extraction efficiency;
[0045] (5) The phased training strategy effectively suppresses the pattern collapse problem in GAN training. By combining weighted supervision loss and multi-task loss function, the convergence of the model is guaranteed and the stability and reliability of the generation process are improved.
[0046] Additional features and advantages of this invention will be set forth in the description which follows, or may be learned by practicing the invention. Attached Figure Description
[0047] The technical solution and beneficial effects of the present invention will become apparent and readily understood from the following description in conjunction with the accompanying drawings, wherein:
[0048] Figure 1 This is an architectural diagram of the present invention;
[0049] Figure 2 This is another architectural diagram of the present invention. Detailed Implementation
[0050] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.
[0051] The network traffic data enhancement method and system based on temporal generative adversarial networks disclosed in this invention will now be described with reference to the accompanying drawings.
[0052] like Figure 1 and Figure 2 As shown, a method for enhancing network traffic data based on temporal generative adversarial networks is characterized by the following steps:
[0053] S1: Collect data packets from a minority of abnormal network traffic types and map them to an input matrix. and the input matrix Correct the illegal protocol fields in the document;
[0054] S2: Construct static noise and timing noise After network mapping and protocol constraint processing, a representation sequence that meets the requirements of the feature space is generated;
[0055] S3: Receive the real sample latent sequence and synthetic sample latent sequence Extract feature association information and temporal features, output multi-dimensional discriminant labels, and optimize the discriminator through a multi-task loss function;
[0056] S4: Calculate the density weights and boundary weights of minority class samples and perform linear fusion, then construct a weighted supervision loss based on the fused weights;
[0057] S5: Pre-train the embedding network and the recovery network, and optimize the reconstruction loss to a preset convergence threshold;
[0058] It should be noted that the goal of pre-training is to enable the embedding network to accurately extract the static and temporal features of the samples, and the recovery network to reconstruct the original samples based on latent features.
[0059] The generator and discriminator are trained together, and the discriminator and generator are updated alternately until the preset training termination condition is met.
[0060] It should be noted that the preset training termination conditions are: the mean temporal consistency score of the generated samples is ≥0.9, the mean minority class matching score is ≥0.85, and the loss function converges stably.
[0061] S6: Input dual-source random noise into the trained generator and output minority class network traffic samples after protocol constraints.
[0062] In one embodiment of the present invention, step 1 specifically comprises:
[0063] Collect data packets of a few types of abnormal network traffic;
[0064] Specifically, after collecting data packets of a few types of abnormal network traffic, redundant data packets are filtered out using preset tools, and data packets containing complete fields of the link layer, network layer, transport layer, and application layer are retained.
[0065] It should be noted that a few types of abnormal network traffic packets include ICMP flood packets, malicious DNS resolution requests, and HTTP malformed packets. The collection tool is tcpdump, and the filtering tool is Wireshark. Redundant packets include redundant broadcast packets and time-series retransmission packets.
[0066] The characteristics of data packets are divided into static characteristics. And temporal characteristics, with a fixed time window Data packets are intercepted, and the uniform sequence length is... To obtain the basic input unit ,in, This is the original time series matrix. For feature dimensions;
[0067] Specifically, static features These are session-level invariant attributes, while time-series features are dynamically changing attributes, and static features... This includes communication roles and protocol types, and timing characteristics such as TTL, window size, and flags.
[0068] The time sequence characteristics of data packets are sorted according to preset field priority, and the original time sequence matrix is then processed. Mapped to matrix Static features As the first Row merge matrix To generate the input matrix ;
[0069] Specifically, the default field priority sorting rule is: IP-related fields > TCP / UDP-related fields > payload fields.
[0070] Based on the preset protocol standards, checksums for IP, TCP, and UDP are calculated using non-checksum fields, and the most recent valid value is used to correct non-compliant protocol fields.
[0071] Specifically, the default protocol standard is the RFC standard protocol, and the default correction strategy is the most recent valid value correction; the valid field ranges defined by the RFC standard protocol include: IP version 4 or 6, TCP port range 0-65535, and TTL value range 1-255.
[0072] In one embodiment of the present invention, step 2 specifically comprises:
[0073] Constructing static noise and timing noise Timing noise Maintain continuous correlation between adjacent time steps;
[0074] Specifically, static noise It follows a Gaussian distribution and is used to control the diversity and controllability of session-level invariant properties; temporal noise. Used to simulate smooth changes in dynamic characteristics of real network traffic.
[0075] static noise Static latent representations are generated through a multi-layer mapping network containing nonlinear activation and regularization mechanisms.
[0076] Construct a BiLSTM network, with the static latent representation, the latent representation of the previous time step, and the current temporal noise as inputs at each time step. To generate potential representation time series;
[0077] The latent representation temporal sequence is upsampled and mapped to the feature space through deconvolution and local receptive field structure. Violating fields are corrected by protocol constraint layer to generate representation sequence.
[0078] In one embodiment of the present invention, step 3 specifically comprises:
[0079] Receive the latent sequence of real samples from the embedded network output. And the latent sequence of the synthesized sample output by the generator ;
[0080] A multi-layer 2D-CNN is used as a local feature extraction layer to extract local correlation features between fields;
[0081] Specifically, the multi-layer 2D-CNN has 2 layers, and the kernel size is [size missing]. The step size is 1, and the number of output channels is 64 and 128 respectively; the local feature extraction layer also includes the LeakyReLU activation function and max-pooling operation.
[0082] Construct a BiLSTM temporal discriminant layer, inputting the flattened local correlation feature sequence and outputting a temporal bisection vector. ;
[0083] The hidden layer dimension of the BiLSTM temporal discriminant layer is 128, and the dimension of the input flattened local feature sequence is... The output time-series score vector Each element has a value range of [0,1], which is used to characterize the timing rationality of the corresponding time step.
[0084] Fully connected layer outputs realism labels Matching labels with minority classes The discriminator is optimized using a multi-task loss function, specifically as follows:
[0085] ,in, For cross-entropy loss, For mean square error loss, These are the predicted values for the corresponding labels. The preset balance coefficient;
[0086] Specifically, authenticity labels Matching labels with minority classes The sigmoid activation function is used, where, Indicates a synthetic sample. Represents a real sample. Indicates non-minority class features, This indicates that the characteristics conform to the minority class, and a preset balance coefficient is used. .
[0087] In one embodiment of the present invention, step 4 specifically includes:
[0088] The density weights of minority class samples are calculated using kernel density estimation (KDE), specifically as follows:
[0089] ,in, For the sample Local density, The maximum local density for all samples. These are preset parameters;
[0090] Specifically, the sample Local density For the sample The inverse of the average distance to the nearest neighbor samples (preset number 10), and preset parameters. density weight The value range is [1.0, 5.0].
[0091] Support vector machines are used to divide the samples into boundary samples and non-boundary samples, and preset boundary weights are assigned to the boundary samples and non-boundary samples respectively. ;
[0092] Specifically, the boundary samples are the preset proportion (20%) of samples that are closest to the SVM classification hyperplane; the preset boundary weights are 2.0 for boundary samples and 1.0 for non-boundary samples.
[0093] The fusion weights are obtained by combining linear fusion density weights and boundary weights. ,in, The preset fusion coefficient;
[0094] Specifically, the preset fusion coefficient The method was determined through 5-fold cross-validation to achieve a balance between the priority of generating samples in sparse and boundary regions.
[0095] The weighted supervision loss is constructed by embedding the fusion weights into the supervision loss, as follows:
[0096] ,in, For the first The minority class sample number The true latent vector at each time step. The latent vector simulated by the generator. For expectation operator, This represents the actual data distribution.
[0097] In addition, this invention discloses a network traffic data enhancement system based on temporal generative adversarial networks, comprising:
[0098] Memory, used to store computer programs;
[0099] A processor is used to implement this network traffic data augmentation method based on a time-series generative adversarial network when executing a computer program.
[0100] In summary, the network traffic data enhancement method and system based on temporal generative adversarial networks disclosed in this invention have at least the following beneficial effects:
[0101] (1) Enhance the time series modeling capability through BiLSTM and realize the triple evaluation of authenticity, time series and categoricality through multi-task discriminator to ensure that the generated minority class traffic samples have both time series consistency, feature authenticity and minority class representativeness, and avoid problems such as time series breakage and feature deviation.
[0102] (2) The adaptive weighting module dynamically optimizes density weights and boundary weights, focusing on sparse regions and boundary regions of minority classes, which greatly improves the generation priority and coverage of such key samples and effectively alleviates the problem of class imbalance in the dataset.
[0103] (3) Through the protocol compliance repair mechanism and the generator protocol constraint layer, ensure that the protocol fields of the generated samples are legal and valid, and avoid data packets from becoming invalid due to verification failure or field violations;
[0104] (4) Standardized structured and temporal processing, 2D matrix encoding and static-temporal feature fusion scheme, adapt to the joint feature extraction requirements of CNN and LSTM, and at the same time reduce the impact of byte-level error through error tolerance mechanism, improve the model input quality and feature extraction efficiency;
[0105] (5) The phased training strategy effectively suppresses the pattern collapse problem in GAN training. By combining weighted supervision loss and multi-task loss function, the convergence of the model is guaranteed and the stability and reliability of the generation process are improved.
[0106] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.
Claims
1. A method for enhancing network traffic data based on temporal generative adversarial networks, characterized in that, Includes the following steps: S1: Collect data packets from a minority of abnormal network traffic types and map them to an input matrix. and the input matrix Correct the non-compliant protocol fields in the document; S2: Construct static noise and timing noise After network mapping and protocol constraint processing, a representation sequence that meets the requirements of the feature space is generated; S3: Receive the real sample latent sequence and synthetic sample latent sequence Extract feature association information and temporal features, output multi-dimensional discriminant labels, and optimize the discriminator through a multi-task loss function; S4: Calculate the density weights and boundary weights of minority class samples and perform linear fusion, then construct a weighted supervision loss based on the fused weights; S5: Pre-train the embedding network and the recovery network, and optimize the reconstruction loss to a preset convergence threshold; The generator and discriminator are trained together, and the discriminator and generator are updated alternately until the preset training termination condition is met. S6: Input dual-source random noise into the trained generator and output minority class network traffic samples after protocol constraints.
2. The network traffic data enhancement method based on temporal generative adversarial networks as described in claim 1, characterized in that, Step 1, specifically: Collect data packets of a few types of abnormal network traffic; The characteristics of data packets are divided into static characteristics. And temporal characteristics, with a fixed time window Data packets are intercepted, and the uniform sequence length is... To obtain the basic input unit ,in, This is the original time series matrix. For feature dimensions; The time sequence characteristics of data packets are sorted according to preset field priority, and the original time sequence matrix is then processed. Mapped to matrix static features As the first Row merge matrix To generate the input matrix ; Based on the preset protocol standard, the checksums of IP, TCP and UDP are calculated through the non-checksum field, and the violating protocol field is corrected with the most recent valid value.
3. The network traffic data enhancement method based on temporal generative adversarial networks as described in claim 2, characterized in that, Step 2, specifically: Constructing static noise and timing noise Timing noise Maintain continuous correlation between adjacent time steps; static noise Static latent representations are generated through a multi-layer mapping network containing nonlinear activation and regularization mechanisms. Construct a BiLSTM network, with the static latent representation, the latent representation of the previous time step, and the current temporal noise as inputs at each time step. To generate potential representation time series; The latent representation temporal sequence is upsampled and mapped to the feature space through deconvolution and local receptive field structure. Violating fields are corrected by protocol constraint layer to generate representation sequence.
4. The network traffic data enhancement method based on temporal generative adversarial networks as described in claim 3, characterized in that, Step 3, specifically: Receive the latent sequence of real samples from the embedded network output. And the latent sequence of the synthesized sample output by the generator ; A multi-layer 2D-CNN is used as a local feature extraction layer to extract local correlation features between fields; Construct a BiLSTM temporal discriminant layer, inputting the flattened local correlation feature sequence and outputting a temporal bisection vector. ; Fully connected layer outputs realism labels Matching tags with minority classes The discriminator is optimized using a multi-task loss function, specifically as follows: ,in, For cross-entropy loss, For mean square error loss, These are the predicted values for the corresponding labels. This is the preset balance coefficient.
5. The network traffic data enhancement method based on temporal generative adversarial networks as described in claim 4, characterized in that, Step 4, specifically: The density weights of minority class samples are calculated using kernel density estimation (KDE), specifically as follows: ,in, For the sample Local density, The maximum local density for all samples. These are preset parameters; Support vector machines are used to divide the samples into boundary samples and non-boundary samples, and preset boundary weights are assigned to the boundary samples and non-boundary samples respectively. ; The fusion weights are obtained by combining linear fusion density weights and boundary weights. ,in, The preset fusion coefficient; The weighted supervision loss is constructed by embedding the fusion weights into the supervision loss, as follows: ,in, For the first The minority class sample number The true latent vector at each time step. The latent vector simulated by the generator. For expectation operator, This represents the actual data distribution.
6. A network traffic data enhancement system based on temporal generative adversarial networks, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement, when executing the computer program, the network traffic data enhancement method based on any one of claims 1 to 5.