Balanced network intrusion detection data generation method based on optimized diffusion model
By optimizing the diffusion model to screen key features and introducing a self-attention mechanism, the class-disequilibrium and privacy issues of network traffic data are resolved, generating logically rigorous and diverse synthetic data, thereby improving the detection capabilities and privacy compliance of NIDS.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NO 30 INST OF CHINA ELECTRONIC TECH GRP CORP
- Filing Date
- 2026-01-12
- Publication Date
- 2026-04-28
AI Technical Summary
Existing Network Intrusion Detection Systems (NIDS) face issues of class-disequilibrium, data privacy, and scarcity when processing complex network traffic data. Generative Adversarial Networks (GANs) suffer from pattern collapse in tabular data processing, and the original TabDPM model struggles to capture nonlinear interactions, resulting in limited fidelity and practicality of the generated data.
We employ an optimization diffusion model approach, which uses a discriminant model to select key features, constructs an attention-enhanced diffusion model, utilizes the self-attention mechanism of the Transformer architecture to capture nonlinear dependencies between features, and generates balanced data through training with a hybrid loss function.
It significantly improves the fidelity and logical consistency of generated data, enhances the diversity of minority attack samples, reduces computational resource consumption, achieves data privacy protection, and improves the detection performance of intrusion detection systems.
Smart Images
Figure CN121940174A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network intrusion detection data generation technology, specifically relating to a balanced network intrusion detection data generation method based on an optimized diffusion model. Background Technology
[0002] With the increasing sophistication of network attack methods, Network Intrusion Detection Systems (NIDS) have become a core component of network security defense. Existing machine learning-based NIDS rely heavily on large-scale, high-quality training data. However, in practical applications, obtaining ideal training data faces significant challenges: (1) Class Imbalance: In real network traffic, malicious attack (especially novel attacks) samples are extremely rare, while normal background traffic accounts for the vast majority. This extreme data skew makes it difficult for classifiers to learn the characteristics of minority class attacks, thus affecting detection accuracy. (2) Data Privacy and Scarcity: Due to privacy regulations such as GDPR, publicly available high-quality network traffic datasets are very scarce.
[0003] Existing data augmentation methods mainly include Generative Adversarial Networks (GANs) and early tabular diffusion models (such as TabDDPM). While GANs perform exceptionally well in the image domain, they often face problems such as pattern collapse and training instability when processing tabular data. Although the original TabDDPM model outperforms GANs in distribution fitting, its core denoising network typically employs a simple Multilayer Perceptron (MLP) structure. When dealing with data with complex feature relationships, such as network traffic (e.g., conditional dependencies between protocol type and payload size), MLPs often struggle to capture deep nonlinear interactions, limiting the fidelity and practicality of the generated data. Summary of the Invention
[0004] To address the aforementioned shortcomings in existing technologies, the balanced network intrusion detection data generation method based on an optimized diffusion model provided by this invention solves the problems of insufficient feature dependency capture and severe noise interference when existing generation models process complex and heterogeneous network traffic data.
[0005] To achieve the aforementioned objectives, the technical solution adopted by this invention is: a method for generating balanced network intrusion detection data based on an optimized diffusion model, comprising the following steps: S1. Obtain the raw network intrusion detection data, preprocess it, and generate a network intrusion detection dataset; S2. Construct an attention-enhanced diffusion model; S3. Input the network intrusion detection dataset into the diffusion model, train the diffusion model according to the hybrid loss function, and obtain the optimal diffusion model; S4. Generate balanced network intrusion detection data through the optimal diffusion model.
[0006] Furthermore, in S1, the preprocessing methods include: S11. Feature selection based on the discriminant model: Remove low-variance features and highly correlated redundant features from the original network intrusion detection data. Train the CatBoost classifier on the original network intrusion detection data, calculate the importance score of each feature in the original network intrusion detection data for distinguishing between "normal" and "attack" traffic, sort the features according to the importance score, and select the top K features as the selected features. S12. Data Transformation: Perform data transformation on the filtered features to generate a network intrusion detection dataset. For numerical features, use quantile transformation to map their non-normal distribution to a Gaussian distribution to adapt to the assumptions of the diffusion model. For categorical features, retain their original string form for subsequent internal encoding in the model.
[0007] Furthermore: In S2, the workflow of the attention-enhanced diffusion model is as follows: S21. Project the input feature vector through a linear layer to generate a feature token sequence; S22. Map the diffusion time step and conditional category label to a context vector, broadcast the context vector and superimpose it onto each token of the feature token sequence to generate a sequence with fused context. S23. Input the sequence after context fusion into the self-attention module, calculate the weight relationship between different features in the sequence through the multi-head self-attention mechanism, and obtain the output features of the self-attention module; S24. Input the output features of the self-attention module into the multilayer perceptron, and generate a prediction result with the same dimension as the input feature vector through the multilayer perceptron.
[0008] Furthermore: S3 specifically refers to: The network intrusion detection dataset is divided into training, validation, and test sets according to a preset ratio. The training set is input into the diffusion model, and the diffusion model is trained according to the hybrid loss function. During the training process, the hyperparameters of the diffusion model are tuned according to the validation set, and the diffusion model is tested according to the test set to obtain the optimal diffusion model.
[0009] Furthermore: In S3, the hybrid loss function The specific expression is: In the formula, For numerical feature loss, mean square error is used to calculate the difference between the predicted noise and the actual added Gaussian noise. For categorical feature loss, KL divergence is used to calculate the distance between the true posterior distribution and the model's predicted distribution. These are the weight parameters.
[0010] Furthermore: S4 specifically refers to: S41. Sample pure noise vectors from the standard Gaussian distribution based on the initial network intrusion detection data to generate noisy network intrusion detection data, and specify the generated target label; S42. Input the noisy network intrusion detection data and target labels into the optimal diffusion model, and perform a reverse diffusion process through the optimal diffusion model to gradually remove noise and obtain clear samples. S43. The samples are restored to the initial network intrusion detection data scale through inverse quantile transformation, and then merged with the initial network intrusion detection data to generate balanced network intrusion detection data, which is used to improve the detection performance of the intrusion detection system.
[0011] The beneficial effects of this invention are as follows: (1) This invention significantly improves the fidelity and logical consistency of the generated data. Existing table diffusion models (such as the original TabDDPM) mostly rely on simple multilayer perceptrons as the core denoising network. Their static weight structure is difficult to capture the complex nonlinear conditional dependencies in network traffic (for example, when the "protocol type" is TCP, the distribution patterns of its "source port" and "payload size" often differ fundamentally from other protocols). To address this deficiency, this invention innovatively constructs an attention-enhanced diffusion model, which uses the self-attention mechanism in the Transformer architecture to dynamically calculate the correlation weights between features, thereby accurately simulating the implicit logic between features based on specific numerical values in the context. Experimental results show that this improvement significantly increases the F1-Score of the downstream classification task from 0.647 to 0.697 and the ROC AUC from 0.768 to 0.780, demonstrating its superiority in capturing complex data distributions.
[0012] (2) This invention effectively solves the "pattern collapse" problem under imbalanced data, greatly enhancing the diversity of minority class attack samples. Traditional Generative Adversarial Networks (GANs) are prone to "pattern collapse" when processing extremely imbalanced network intrusion data, tending to generate only the majority class (normal traffic) while ignoring rare attack types, resulting in single and ineffective attack samples. The diffusion model framework adopted in this invention is based on a variant of maximum likelihood estimation, with a more stable training objective. Combined with a targeted class condition guidance mechanism, it can stably generate high-quality attack samples with wide distribution and rich diversity. This effectively compensates for the shortcomings in the training dataset and significantly improves the detection capability of intrusion detection systems (NIDS) for various rare attacks.
[0013] (3) This invention significantly reduces computational resource consumption and enhances model robustness through dimensionality reduction and noise reduction. Original network traffic data is usually extremely high in dimensionality and contains a large number of noisy features that do not contribute to classification. Directly inputting all features not only wastes computational resources but also interferes with the generative model's learning of key patterns. This invention implements a feature selection strategy based on a discriminative model, pre-screening the most discriminative key features. While removing data noise and redundancy, it enables the model to focus on learning core attack features, greatly improving generation efficiency and quality.
[0014] (4) This invention achieves strict data privacy protection and compliant sharing. Because the data generated by this invention is entirely new synthetic data, it highly replicates real traffic in terms of statistical characteristics, but has no direct correspondence with real user data at the sample level. This allows the data to replace sensitive real traffic data for cross-institutional research and system development, while complying with strict privacy regulations such as GDPR, effectively solving the problem of high-quality data scarcity caused by privacy concerns in the field of cybersecurity. Attached Figure Description
[0015] Figure 1 This is a flowchart of the balanced network intrusion detection data generation method based on an optimized diffusion model according to the present invention. Detailed Implementation
[0016] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.
[0017] like Figure 1 As shown, in one embodiment of the present invention, the method for generating balanced network intrusion detection data based on an optimized diffusion model includes the following steps: S1. Obtain the raw network intrusion detection data, preprocess it, and generate a network intrusion detection dataset; S2. Construct an attention-enhanced diffusion model; S3. Input the network intrusion detection dataset into the diffusion model, train the diffusion model according to the hybrid loss function, and obtain the optimal diffusion model; S4. Generate balanced network intrusion detection data through the optimal diffusion model.
[0018] The core idea of this invention includes optimizations on two levels: (1) At the data level, a feature selection strategy based on a discriminative model is introduced to select the most distinctive key features from the high-dimensional raw data, thereby reducing the interference of noise and redundancy on the generation process.
[0019] (2) At the model architecture level, an attention-enhanced diffusion model was innovatively designed to replace the traditional multilayer perceptron. By transforming features into token sequences and introducing a Transformer-style self-attention mechanism, the model can dynamically capture the complex nonlinear dependencies between features such as protocol, port, and traffic size, thereby generating logically rigorous, high-fidelity, and class-balanced synthetic data.
[0020] Based on the optimizations at the two levels mentioned above, this invention has significant advantages over existing technologies (such as Generative Adversarial Network CTGAN and TabDDPM) in terms of data fidelity, sample diversity, computational efficiency, and privacy compliance.
[0021] In S1, the preprocessing methods include: S11. Feature selection based on the discriminant model: Remove low-variance features and highly correlated redundant features from the original network intrusion detection data. Train the CatBoost classifier on the original network intrusion detection data and calculate the importance score of each feature in the original network intrusion detection data for distinguishing between "normal" and "attack" traffic. Sort the features according to the importance score and select the top K features as the selected features. For example, select the top 25 features as the model input. In this embodiment, the original data has high dimensionality and contains a large number of noisy or redundant features that do not contribute to the classification task. Directly using all features to train the model not only increases the computational cost but also introduces interference information, making it difficult for the model to focus on learning key attack patterns. Therefore, this invention does not directly use all features but uses the CatBoost classifier as the discriminant model and employs a feature selection method to process the original network intrusion detection data, thus solving the problems of high dimensionality and noise in the original data.
[0022] S12. Data Transformation: Perform data transformation on the filtered features to generate a network intrusion detection dataset. For numerical features, use quantile transformation to map their non-normal distribution to a Gaussian distribution to adapt to the assumptions of the diffusion model. For categorical features, retain their original string form for subsequent internal encoding in the model.
[0023] In S2, the workflow of the attention-enhanced diffusion model is as follows: S21. Project the input feature vector through a linear layer to generate a feature token sequence; Each token represents an independent feature embedding, transforming the input from a single vector into a sequence form suitable for attention mechanisms.
[0024] S22. Map the diffusion time step and conditional category label to a context vector, broadcast the context vector and superimpose it onto each token of the feature token sequence to ensure that each feature can perceive the current generation progress and target category information, and generate a sequence after fusing context. S23. Input the sequence after context fusion into the self-attention module, calculate the weight relationship between different features in the sequence through the multi-head self-attention mechanism, and obtain the output feature of the self-attention module; for example, the diffusion model can learn the importance of the "source byte count" feature when the "protocol" is TCP. In this embodiment, this step realizes the dynamic modeling of complex dependencies between features.
[0025] S24. Input the output features of the self-attention module into the multilayer perceptron. The multilayer perceptron generates a prediction result with the same dimension as the input feature vector. The prediction result includes the prediction noise of numerical features and the Logits distribution of categorical features.
[0026] S3 specifically refers to: The network intrusion detection dataset is divided into training, validation, and test sets according to a preset ratio. The training set is input into the diffusion model, and the diffusion model is trained according to the hybrid loss function. During the training process, the hyperparameters of the diffusion model are tuned according to the validation set, and the diffusion model is tested according to the test set to obtain the optimal diffusion model.
[0027] In S3, by minimizing the mixture loss function Update the network parameters until the model converges, using the mixture loss function. The specific expression is: In the formula, For numerical feature loss, mean squared error (MSE) is used to calculate the difference between the predicted noise and the actual added Gaussian noise. For categorical feature loss, KL divergence (KL divergence) is used to calculate the distance between the true posterior distribution and the model-predicted distribution. These are the weight parameters.
[0028] S4 specifically refers to: S41. Sample pure noise vectors from the standard Gaussian distribution based on the initial network intrusion detection data to generate noisy network intrusion detection data, and specify the target labels to be generated, such as specifying scarce attack type labels. S42. Input the noisy network intrusion detection data and target labels into the optimal diffusion model, and perform a reverse diffusion process through the optimal diffusion model to gradually remove noise and obtain clear samples. S43. The samples are restored to the initial network intrusion detection data scale through inverse quantile transformation, and then merged with the initial network intrusion detection data to generate balanced network intrusion detection data, which is used to improve the detection performance of the intrusion detection system.
[0029] In the description of this invention, it should be understood that the terms "center," "thickness," "upper," "lower," "horizontal," "top," "bottom," "inner," "outer," and "radial," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying the relative importance or the number of technical features implicitly specified. Therefore, a feature defined by "first," "second," and "third" may explicitly or implicitly include one or more of that feature.
Claims
1. A method for generating balanced network intrusion detection data based on an optimized diffusion model, characterized in that, Includes the following steps: S1. Obtain the raw network intrusion detection data, preprocess it, and generate a network intrusion detection dataset; S2. Construct an attention-enhanced diffusion model; S3. Input the network intrusion detection dataset into the diffusion model, train the diffusion model according to the hybrid loss function, and obtain the optimal diffusion model; S4. Generate balanced network intrusion detection data through the optimal diffusion model.
2. The method for generating balanced network intrusion detection data based on an optimized diffusion model according to claim 1, characterized in that, In S1, the preprocessing methods include: S11. Feature selection based on the discriminant model: Remove low-variance features and highly correlated redundant features from the original network intrusion detection data. Train the CatBoost classifier on the original network intrusion detection data, calculate the importance score of each feature in the original network intrusion detection data for distinguishing between "normal" and "attack" traffic, sort the features according to the importance score, and select the top K features as the selected features. S12. Data Transformation: Perform data transformation on the filtered features to generate a network intrusion detection dataset. For numerical features, use quantile transformation to map their non-normal distribution to a Gaussian distribution to adapt to the assumptions of the diffusion model. For categorical features, retain their original string form for subsequent internal encoding in the model.
3. The method for generating balanced network intrusion detection data based on an optimized diffusion model according to claim 1, characterized in that, In S2, the workflow of the attention-enhanced diffusion model is as follows: S21. Project the input feature vector through a linear layer to generate a feature token sequence; S22. Map the diffusion time step and conditional category label to a context vector, broadcast the context vector and superimpose it onto each token of the feature token sequence to generate a sequence with fused context. S23. Input the sequence after context fusion into the self-attention module, calculate the weight relationship between different features in the sequence through the multi-head self-attention mechanism, and obtain the output features of the self-attention module; S24. Input the output features of the self-attention module into the multilayer perceptron, and generate a prediction result with the same dimension as the input feature vector through the multilayer perceptron.
4. The method for generating balanced network intrusion detection data based on an optimized diffusion model according to claim 1, characterized in that, S3 specifically refers to: The network intrusion detection dataset is divided into training, validation, and test sets according to a preset ratio. The training set is input into the diffusion model, and the diffusion model is trained according to the hybrid loss function. During the training process, the hyperparameters of the diffusion model are tuned according to the validation set, and the diffusion model is tested according to the test set to obtain the optimal diffusion model.
5. The method for generating balanced network intrusion detection data based on an optimized diffusion model according to claim 4, characterized in that, In S3, the hybrid loss function The specific expression is: In the formula, For numerical feature loss, mean square error is used to calculate the difference between the predicted noise and the actual added Gaussian noise. For categorical feature loss, KL divergence is used to calculate the distance between the true posterior distribution and the model's predicted distribution. These are the weight parameters.
6. The method for generating balanced network intrusion detection data based on an optimized diffusion model according to claim 1, characterized in that, S4 specifically refers to: S41. Sample pure noise vectors from the standard Gaussian distribution based on the initial network intrusion detection data to generate noisy network intrusion detection data, and specify the generated target label; S42. Input the noisy network intrusion detection data and target labels into the optimal diffusion model, and perform a reverse diffusion process through the optimal diffusion model to gradually remove noise and obtain clear samples. S43. The samples are restored to the initial network intrusion detection data scale through inverse quantile transformation, and then merged with the initial network intrusion detection data to generate balanced network intrusion detection data, which is used to improve the detection performance of the intrusion detection system.