DoH traffic data enhancement method based on diffusion model and TTP analysis

Abstract

The invention discloses a DoH traffic data enhancement method based on a diffusion model and TTP analysis, and belongs to the technical field of crossing of network security and artificial intelligence. The method comprises the following steps: based on ATTamp; the CK matrix analyzes DoH network attacks, and TTP features including plaintext features, statistical features and process features are extracted; performing joint probability modeling on the DoH flow features and the TTP features by using a diffusion model; known real DoH traffic data is used to learn joint distribution of traffic features and TTP features in a training stage, and a diffusion model can be driven to generate high-quality enhanced traffic data conforming to the feature distribution only by inputting TTP features extracted from a small amount of new malicious traffic in a generation stage. According to the method, the problems of data scarcity, sample imbalance and insufficient model generalization ability in DoH malicious traffic detection are solved, and the identification ability of the detection model on small samples and novel malicious traffic is improved.

Description

Technical Field

[0001] This invention relates to the fields of network security and artificial intelligence technology, and more particularly, to a DoH traffic data enhancement method based on diffusion models and TTP analysis. Background Technology

[0002] The Domain Name System (DNS) is a hierarchical, distributed database system responsible for translating human-readable domain names into machine-friendly IP addresses. It is one of the most crucial infrastructure components of the internet, and almost all network activities rely on DNS. However, the DNS protocol encodes data transmitted between users and servers in plaintext, allowing any third party to directly access user data through DNS messages. This creates opportunities for network attacks based on the DNS protocol, such as man-in-the-middle attacks, privacy data breaches, and DNS hijacking attacks.

[0003] Data augmentation techniques generate new data samples from existing data or alter the distribution characteristics of existing data in some way. Data augmentation can address the data scale problem faced by machine learning models; when data drift occurs, data augmentation can change the data distribution of the training set to conform to the true distribution; when new types of malicious traffic emerge, data augmentation can generate large amounts of data that match the characteristics of the new malicious traffic with relatively low time and manpower costs, providing data support for traffic classification and detection tasks.

[0004] TTP (Tactics, Techniques, and Procedures) analysis is an important methodology in the field of cybersecurity. Tactics are a high-level description of an attacker's behavior and strategies; they include a series of actions and behaviors through which the attacker achieves specific objectives. Techniques refer to the non-specific guidelines and intermediate methods for implementing tactical actions; they describe how to utilize various means to achieve the attack objective. Procedures refer to a series of operations using specific techniques to execute attack tactics; they involve a detailed description of the activities an attacker performs to successfully achieve their objective. As cyberattacks continue to evolve and become more complex, traditional security defense methods are finding it increasingly difficult to cope with cyber threats. Relying solely on security solutions such as firewalls and antivirus software is no longer sufficient to comprehensively defend against ever-evolving cyberattacks. In this context, the cybersecurity field first systematically proposed the TTP analysis method around 2014, emphasizing defense based on attacker behavioral patterns (tactics, techniques) rather than single attack traces (procedures).

[0005] The ATT&CK matrix is ​​a knowledge base of adversarial tactics and techniques compiled by MITRE Corporation based on actual cyberattacks and observation data. It aims to describe and classify the tactics, techniques, and sub-techniques used by attackers in cyberattacks. In recent years, with the increasing importance of cybersecurity, the ATT&CK framework has become widely known in the cybersecurity industry. The ATT&CK matrix database is constantly updated with contributions from the research community, making it a cornerstone of APT threat intelligence. Today, MITRE ATT&CK has become a complex cybersecurity framework, introducing 14 tactics, over 190 techniques, and over 380 sub-techniques used by attackers in the attack process (MITRE.ATT&CK[EB / OL].(2025).https: / / attack.mitre.org). For each technique that a cyberattack might employ, the ATT&CK matrix includes malware using the attack technique, the hacker groups developing the malware, and corresponding real-world cyberattack cases, and proposes mitigation measures to reduce the harm of attack techniques and key indicators for detecting the implementation of attack techniques.

[0006] DoH (DNS over HTTPS), as an advanced DNS encryption technology, has been widely used in mainstream browsers, operating systems, and public DNS service providers, and is gradually becoming an important means of improving network communication security and privacy protection. However, the plaintext encryption nature of DoH may render detection methods against DNS tunneling attacks ineffective. While DoH encrypts DNS queries through HTTPS, improving user privacy and security, its encryption features have also been used by malware to build covert tunnels and conduct command-and-control (C&C) communications based on DoH. Existing machine learning-based DoH malicious traffic detection methods face challenges such as difficulty in data acquisition, sample imbalance, data drift, and insufficient model generalization ability. Traditional data augmentation methods such as SMOTE and CGAN have limited quality in small sample and novel malicious traffic scenarios, making it difficult to effectively improve detection performance. Summary of the Invention

[0007] This invention aims to solve the above problems and provides a DoH traffic data enhancement method based on diffusion model and TTP analysis. By introducing TTP features extracted from the ATT&CK matrix and combining them with the diffusion model for probabilistic modeling, high-quality traffic data can be generated under the condition of a small number of real samples, thereby improving the quality of the DoH traffic dataset.

[0008] The present invention provides a DoH traffic data enhancement method based on diffusion model and TTP analysis, which specifically includes the following steps:

[0009] Step 1: DoH session feature extraction based on TTP analysis;

[0010] Based on the ATT&CK framework, this study analyzes the tactics, techniques, and procedures of DoH network attacks, extracting the following three types of TTP characteristics:

[0011] Plaintext characteristics: including TCP timestamp information and TLS cipher suites;

[0012] Statistical characteristics include data packet length, communication duration, and information entropy.

[0013] Process characteristics: The location encoding of data packets within a session.

[0014] Among them, the TTP features extracted include:

[0015] Based on the attack principles of the DoH protocol, select technical and tactical items related to DoH network attacks from the ATT&CK matrix;

[0016] By utilizing security meetings and publicly available attack analysis reports, the selected techniques and tactics were further refined and verified.

[0017] Based on the revised tactics and techniques, the corresponding observable data sources are identified from the ATT&CK framework;

[0018] Based on the DoH protocol communication mechanism and network attack process, TTP characteristics are filtered and defined from the data source;

[0019] Based on relevant research papers and actual DoH attack traffic data, the validity of the defined TTP characteristics is verified and finally determined.

[0020] Step 2: DoH traffic capture and processing;

[0021] The DoHLyzer tool was used to extract DoH traffic features, including 29 dimensions such as duration, number of bytes sent, and packet length statistics. A sliding window was used to segment the variable-length session into fixed-length feature slices for easier model processing.

[0022] Step 3: Data augmentation training based on TTP feature probability modeling;

[0023] A diffusion model is employed to jointly model the probabilistic distribution of traffic features and TTP features. During the training phase, the CIRA-CIC-DoHBrw-2020 dataset is used to learn the traffic distribution of known malware. A weighted loss function is used to balance the influence of large and small sample data.

[0024] The training process of the diffusion model includes:

[0025] Sample traffic feature fragments and their corresponding session TTP features from known real DoH traffic datasets;

[0026] TTP features and random noise are input into the diffusion model as conditions, and training samples are constructed through the forward diffusion process.

[0027] The training model learns the reverse diffusion process to predict and remove noise, with the optimization objective being to make the generated data distribution approximate the true conditional distribution.

[0028] We employ a weighted loss function that combines a large dataset with a small validation set for training, and utilize an early stopping strategy to prevent overfitting.

[0029] Step 4: Generation of diffusion model data based on TTP features;

[0030] During the data augmentation phase, the TTP features of the target small sample DoH malicious traffic are extracted and input into the trained diffusion model to generate augmented traffic data that conforms to the distribution of the TTP features.

[0031] The data generation process includes:

[0032] Extract TTP features from the target small sample of DoH malicious traffic to be enhanced;

[0033] The extracted TTP features are input into the pre-trained diffusion model along with random noise sampled from a standard normal distribution.

[0034] The model performs a reverse diffusion process to gradually denoise and outputs high-quality DoH flow characteristic data that matches the input TTP characteristics.

[0035] This invention discloses a DoH traffic data enhancement system based on diffusion model and TTP analysis, comprising:

[0036] The TTP feature analysis and extraction module is used to execute the TTP feature extraction process and output the TTP feature set;

[0037] The traffic feature processing module is used to extract and normalize traffic features from raw traffic data;

[0038] The Conditional Diffusion Model Training Module is used to build and train generative models conditioned on TTP features.

[0039] The small sample traffic enhancement generation module is used to receive the TTP features of the target traffic and generate enhanced data.

[0040] The technical advantages of the DoH flow data enhancement method based on diffusion model and TTP analysis in this invention are as follows:

[0041] 1. Conduct TTP analysis on the communication principles of the DoH protocol and the mechanisms by which malicious software uses the DoH protocol to launch network attacks from multiple levels (such as technology and procedures), and summarize and generalize the relevant TTP characteristics of DoH network attacks.

[0042] 2. To address the issues of imbalanced sample size, insufficient sample size for new label types, and the potential emergence of malware and its traffic in DoH network attack traffic datasets, this paper studies a DoH traffic data augmentation method based on machine learning and TTP feature probability modeling.

[0043] 3. Based on this data augmentation method, a traffic generation model is developed, trained on a publicly available DoH dataset. During training, the model learns the traffic feature distribution from a large amount of known DoH traffic data. When using the model for data augmentation, it only needs to extract TTP features from a small number of real samples as reference information to generate small-sample malicious DoH traffic data. After the model is trained, an augmented dataset conforming to the format of the publicly available dataset is created, and the properties of the augmented dataset are analyzed. This includes: analyzing the similarity between real and generated data from a visualization perspective; analyzing the similarity between real and generated data from the marginal distribution function; and analyzing the impact of the augmented dataset on downstream DoH traffic data classification and detection tasks. Attached Figure Description

[0044] Figure 1 This is a block diagram of a DoH traffic data enhancement system based on diffusion model and TTP analysis according to the present invention.

[0045] Figure 2 This is a schematic diagram illustrating the impact of the box-cox transformation on the distribution of feature data.

[0046] Figure 3 It is a t-SNE visualization of generated traffic and actual traffic.

[0047] Figure 4 It is the distribution function of various characteristics of the actual traffic (blue) and generated traffic (yellow) of the dnstt software.

[0048] Figure 5 It is the probability density function of each feature of the actual traffic (blue) and generated traffic (yellow) of the DNSTT software.

[0049] Figure 6 It is the distribution function of various characteristics of the actual traffic (blue) and generated traffic (yellow) of the TCP-over-DNS software.

[0050] Figure 7It is the probability density function of each characteristic of the actual traffic (blue) and generated traffic (yellow) of the TCP-over-DNS software.

[0051] Figure 8 It is the distribution function of various characteristics of the actual traffic (blue) and generated traffic (yellow) of the TINS ​​software.

[0052] Figure 9 It is the probability density function of each feature of the actual traffic (blue) and generated traffic (yellow) of the TINS ​​software.

[0053] Figure 10 This relates to the impact of data augmentation methods on the accuracy of the model in detecting malicious DoH traffic in small samples.

[0054] Figure 11 This relates to the impact of data augmentation methods on the accuracy of the model in detecting overall DoH flow.

[0055] Figure 12 This relates to the impact of data augmentation methods on the accuracy of the model in detecting the overall flow of the DoH.

[0056] Figure 13 This relates to the impact of data augmentation methods on the overall recall rate of DoH traffic detected by the model.

[0057] Figure 14 This relates to the impact of data augmentation methods on the F1 score of the model's detection of the overall flow of the DoH.

[0058] Figure 15 This is a comparison of the performance results of normal experiments and ablation experiments in detecting malicious DoH traffic on a small sample.

[0059] Figure 16 This is a comparison of the overall flow detection performance of DoH under normal and ablation experiments. Detailed Implementation

[0061] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. The examples of the parameters listed are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

[0062] See Figure 1 As shown, the present invention provides a DoH flow data enhancement method based on diffusion model and TTP analysis, comprising the following steps:

[0063] Step 1: DoH session feature extraction based on TTP analysis;

[0064] Based on the ATT&CK matrix, this study analyzes the tactics, techniques, and procedures of DoH network attacks, extracting the following three types of TTP features:

[0065] Plaintext characteristics: including TCP timestamp information and TLS cipher suites;

[0066] Statistical characteristics include data packet length, communication duration, and information entropy.

[0067] Process characteristics: The location encoding of data packets within a session.

[0068] According to TTP analysis theory, any network attack leaves behind characteristics at three levels: tactics, technology, and program. DoH network attacks are no exception. Currently, most research on detecting DoH network traffic only uses program characteristics, while research on generating DoH network traffic still uses unsupervised learning algorithms or supervised learning algorithms that use data labels for conditional generation.

[0069] Program characteristics, also known as sample traffic characteristics, are features obtained through statistical analysis of existing samples in a DoH attack dataset. These features include, for example, the average packet size, median size, and variance. Numerous studies have shown that program characteristics of DoH traffic alone are sufficient to detect related network attack traffic.

[0070] However, unsupervised learning algorithms or supervised learning algorithms that use data labels for conditional generation cannot meet the needs of DoH traffic generation. Different DoH malware programs have different internal implementations, resulting in DoH attack traffic with different program characteristics. Therefore, when new DoH malware emerges, existing datasets often do not contain or contain only a small amount of malicious traffic from that software, making the dataset insufficient to support the generation of that software's traffic.

[0071] Therefore, to enable a data augmentation model to generate malicious traffic with specified labels even with little or no data, additional reference information needs to be provided to the model during both the training and generation phases. This invention introduces TTP features related to DoH malicious traffic and proposes the hypothesis that, by using TTP features sampled from known real traffic as additional reference input information, the DoH traffic generation model can generate novel DoH malicious traffic not encountered during the training phase, and that the generated traffic and real traffic exhibit a high degree of similarity in program feature distribution. Based on this, this invention proposes a data augmentation method for small-sample DoH encrypted traffic based on TTP features, the overall process framework of which is as follows: Figure 1As shown, this data augmentation method consists of two parts: a "DoH session feature extraction method based on TTP analysis" and a "data augmentation method based on TTP feature probabilistic modeling." The former is responsible for conducting TTP analysis against DoH attacks, extracting TTP features that can be used for data augmentation, and providing theoretical guidance for the latter's traffic data sampling process. The analyzed data comes from the ATT&CK matrix, attack reports, security conferences, and related papers, and the analysis process follows the "tactics-technology-data source-feature" approach. The latter is responsible for sampling TTP features and traffic features from DoH traffic, modeling the feature data distribution based on a probabilistic model, and training a probabilistic model that can generate traffic features based on TTP features. During the training phase, the model learns the probability distribution relationship between TTP features and DoH traffic features from known traffic data. During the traffic generation phase, the model only needs to collect a small number of TTP features from the traffic of novel DoH malware to generate traffic fragment data that conforms to its true probability distribution.

[0072] Step 11, TTP method analysis;

[0073] This invention utilizes the TTP method, based on the original dataset and the principles of DoH attacks, to study and analyze attacker behavior patterns, gaining a deeper understanding of attackers' tactics, techniques, and procedures, including their goals, strategies, and attack methods. This allows for the analysis of the essential differences between malicious DoH traffic and other traffic, and the determination of features used to train the DoH model.

[0074] This invention uses the ATT&CK matrix (referencing MITRE.ATT&CK[EB / OL].(2025).https: / / attack.mitre.org) as its foundation, and expands upon DoH network attack reports and security conferences to conduct technical and tactical analysis related to DoH network attacks. It extracts technical and tactical data sources from the ATT&CK matrix; based on the principles of DoH network attacks, it filters TTP features from these data sources and supplements the extracted TTP features with reference to attack reports and traffic detection papers; it verifies the extracted TTP features based on actual captured DoH attack traffic, excluding features that are theoretically useful but practically useless; and finally, it develops TTP feature sampling tools and traffic feature sampling tools based on the theoretical analysis results. In the theoretical analysis process, this invention uses four data sources: the ATT&CK matrix, network attack reports, network security conferences, and DoH traffic detection papers. The characteristics of each of the four data sources are shown in Table 1.

[0075] Table 1. Data sources for TTP analysis

[0076]

[0077] The process of analyzing and screening DoH network attack techniques from the ATT&CK matrix requires a multi-faceted approach, drawing upon DoH network attack theoretical processes, real-world network attack case reports, attack technique reports, and malware analysis reports collected in the ATT&CK database to comprehensively and accurately describe the attack lifecycle. It should be noted that while the ATT&CK matrix lists hundreds of tactics and techniques that network attacks may employ, not all of them can be combined with DoH network attacks. In C&C communication attacks and tunneling attacks, the DoH protocol is neither the primary attacker nor the target of the attack; rather, it is a network tool for covert data transmission. Tactics such as persistence, defense evasion, and lateral movement are performed by other functional modules of the malware and do not require the use of the DoH protocol; therefore, they should be excluded from the scope of TTP analysis. The specific types of tactics and techniques obtained through the analysis of the ATT&CK matrix in this invention are shown in Table 2. The analysis reveals that the ATT&CK matrix breaks down DoH network attacks into a combination of five tactics: resource establishment (TA0042), discovery (TA0007), collection (TA0009), command and control (TA0011), and data theft (TA0010). From these five tactics, 21 techniques / sub-techniques can be derived, constituting the complete lifecycle of a DoH network attack.

[0078] Table 2. Tactics, techniques, and sub-techniques involved in DoH network attacks

[0079]

[0080] After obtaining the list of DoH network attack tactics / techniques (as shown in Table 2), it is necessary to extract data sources that meet the requirements of the DoH traffic data augmentation task. Data source is a term from the ATT&CK matrix, representing key information that can be collected from sensors or logs. This information can be used to extract specific features to detect attack techniques. The ATT&CK matrix includes the detection data sources corresponding to each tactic / technique; however, due to the nature of the DoH traffic data augmentation task, not all tactics / techniques can extract suitable data sources from it, requiring further screening. The specific reasons can be divided into three categories:

[0081] 1. The attack techniques lack corresponding detection data sources, such as the "DNS server" sub-technique (T1583.002) and the "botnet" sub-technique (T1584.005). The process of hackers registering DNS servers and building third-party botnets does not involve contact with the target network. The entire attack activity occurs outside the defender's visibility, making it particularly difficult for the defender to detect such attacks.

[0082] 2. The data source of an attack technique can affect DoH traffic, but it cannot serve as a signature source for malware. For example, the malware PsiXBot, discovered by the Proofpoint team in 2019, uses "network sniffing" technology (T1040) to collect user data and maintains a listening dictionary internally. PsiXBot remains dormant, continuously monitoring user activity. It is only activated and collects user data when user network data matches keywords in the dictionary, subsequently executing a data leakage attack via the DoH protocol. From PsiXBot's attack method, it can be seen that this malware's use of "network sniffing" technology affects the generation of DoH traffic, but the impact largely depends on user activity and does not reflect the malware's own influence on DoH traffic.

[0083] 3. The data source for attack techniques cannot be extracted from the traffic. For example, the Godlua malware discovered by the Qihoo 360 team in China in 2019. Godlua uses "DNS calculation" technology (T1568.003) to resolve data received from the hacker's server. Godlua treats data received via the DoH protocol as Lua bytecode files, loading them into the victim's host memory and executing them to obtain the C&C instructions needed for the next step. Detection measures from the ATT&CK matrix show that detecting Lua script execution requires the defender to monitor the victim's host processes, analyze the execution status of processes related to abnormal traffic, and examine command-line parameters. The "DNS calculation" technique represents an abuse of system functionality by malware; the purpose of the data received by the malware cannot be determined from the encrypted DoH traffic.

[0084] Based on the above analysis and screening, the attack data sources selected by this invention are shown in Table 3.

[0085] Table 3 Data sources related to DoH network attacks

[0086]

[0087] Data sources are tools or channels for collecting key information about traffic. TTP features need to be extracted from these data sources before they can be directly used for data augmentation tasks. Due to the special nature of data augmentation tasks, certain selection rules should be observed when analyzing and selecting TTP features. These TTP features should meet the following rules:

[0088] 1. The selected TTP features must theoretically conform to the attack flow of a DoH network attack and must be corroborated by actual network attack traffic. Otherwise, the correctness of the TTP feature selection needs to be reconsidered. The correctness of the selected TTP features will greatly affect the effect of data augmentation and ultimately the performance of subsequent traffic detection tasks.

[0089] 2. The selected TTP features should be extractable from a single real DoH communication traffic stream, without requiring large-scale data collection or analysis. The issues of data size, data drift, and general applicability in DoH malicious traffic datasets are common problems in the field of DoH traffic research. Using TTP features that require collecting large amounts of traffic data when real traffic data is scarce is inconsistent with the current state of existing datasets and contradicts the research goal of this invention: "data augmentation can be completed with only a small amount of real data."

[0090] 3. The selected TTP features should be diverse. TTP features should have a certain range of variation, rather than a fixed value; otherwise, the model will not be able to learn useful information from the TTP features. From the perspective of traffic sampling, TTP features should follow a certain probability distribution, and different malware should have different probability distributions. This requires that DoH traffic generated by different software should have different TTP features; secondly, DoH traffic belonging to the same software should also have a certain range of variation.

[0091] 4. The selected TTP features should have generalization ability. Data augmentation models are trained based on TTP features and existing datasets. When this model is used to generate traffic data for malware with insufficient data size, or to generate traffic data for new types of malware not used for model training, the model needs to obtain reference information from traffic data of other malware with sufficient and representative data size due to insufficient known information. This requires the model to be able to generalize and use divergent thinking to combine the TTP features of new malware with the traffic feature distribution of old malware, so that the augmented traffic data both conforms to the TTP features of the new malware and maintains an appropriate traffic feature distribution. This process requires the TTP features to have generalization ability, providing the model with sufficient extended information.

[0092] 5. The selected TTP features must not overlap with the program features in the traffic dataset. If they overlap, the model can skip feature analysis and directly obtain the traffic characteristics based on the TTP feature values, thereby weakening the model's generalization ability.

[0093] After analysis and summarization, the TTP characteristics exhibited in DoH network attack traffic can be divided into three categories: plaintext characteristics, statistical characteristics, and flow characteristics. The selected characteristics are shown in Table 4. In addition, this invention also summarizes a category of deprecated characteristics; these characteristics can be used for traffic detection but are not suitable for traffic data augmentation. This invention provides a detailed analysis process for the reasons for the selection / deprecation of each characteristic.

[0094] Table 4. TTP features extracted from the DoH communication protocol

[0095]

[0096] Step 12, plaintext feature extraction;

[0097] In the DoH protocol communication process, the two communicating parties perform a TLS (Transport Layer Security) handshake before transmitting actual data. Although the DoH protocol is an encrypted protocol, encrypting the information payload based on the HTTPS protocol, the TLS handshake phase before transmitting information is conducted in plaintext. For normal DoH communication and malicious DoH network attacks, due to different objectives, the handshake messages of the two parties will inevitably carry plaintext data with different patterns during the TLS handshake phase, thus allowing the extraction of different handshake characteristics. Furthermore, although the TLS protocol encrypts the data content of the upper-layer protocol, the TCP protocol is located below the TLS protocol, and during DoH communication, the TCP header is encoded in plaintext. Description information of the communication process can also be obtained from the TCP header.

[0098] The timestamp field of the TCP protocol can be used to extract relevant TTP features of DoH network attacks. The TCP protocol fields Tsval (Timestamp value) and Tsecr (Timestamp Echo Reply) represent the current timestamp of the system and the timestamp when the previous packet was received, respectively. The difference between Tsecr and Tsval of the same packet represents the time spent by the host from receiving data to sending back data. The larger the difference, the longer the time spent processing data, and the maximum value of the difference represents the most time-consuming behavior. For C&C attacks, since it is necessary to wait for C&C instructions, C&C traffic usually manifests as the controlled host periodically sending heartbeat signals or receiving instructions to the server. The communication frequency is low but has time regularity

[35] . The maximum value of the timestamp extracted from C&C packets may be larger than that of other traffic, but the variance is small

[13] . The timestamp is an optional field of the TCP protocol. In other words, DoH malware may not carry the timestamp field in the communication traffic in order to avoid being detected. If this field is not present in the actual traffic, the time information recorded by a network packet capture tool when capturing data packets can be used as a substitute for the TCP packet timestamp. When both timestamps exist, the TCP packet timestamp should be used, because network packet capture software is deployed between the two communicating parties, and the time of the traffic it records may have errors. In contrast, the TCP packet timestamp is recorded locally by both communicating parties, and its value is more accurate.

[0099] TLS cipher suites can serve as a TTP (Transmission Tolerance) signature for identifying DoH (DoH) network attacks. A TLS cipher suite refers to a combination of encryption algorithms, including authentication algorithms, encryption algorithms, message authentication code algorithms, key exchange algorithms, and key derivation algorithms. Cipher suites are used to establish a secure communication channel within the TLS protocol, ensuring the confidentiality and integrity of data transmission between the client and server. Their core function is to complete tasks such as key exchange, authentication, data encryption, and message verification through a negotiated combination of algorithms. During the TLS handshake, the client first provides a list of supported cipher suites, and the server selects a suite that both parties support and consider secure, thus completing the cipher suite negotiation. Different client software provides different combinations of cipher suites, and different DoH servers tend to choose their preferred cipher suites. Cipher suites can alter the encryption / decryption speed, length, and other aspects of ciphertext, thereby changing global static characteristics. Compared to regular software, malware is also more likely to use older versions of the TLS protocol and cipher suites, accounting for as much as 30.28%.

[0100] Step 13, Statistical Characteristics;

[0101] Statistical features refer to the characteristics extracted from data packets collected from network traffic through comprehensive statistical analysis. These features mostly originate from fields within the data packets, derived by calculating between fields of individual packets or by comparing fields across multiple packets. Sometimes, network packet capture software and the devices of both communicating parties also record useful data; combining this data with the packet content can yield even more results.

[0102] In DoH (DoH) network attacks, malicious traffic exhibits significant statistical differences from benign traffic due to varying objectives. For example, in C&C (Content and Communication) attacks, malware maintains prolonged connections to the hacker's terminal, while in tunneling attacks, malware attempts to leak large amounts of user data. These two attacks differ significantly from regular communication in terms of data volume and duration. Malware may be aware of this and employ traffic shaping techniques (such as adjusting packet size and limiting rate) to simulate normal DoH traffic, deliberately concealing its true purpose. However, they often sacrifice efficiency in this process and expose data anomalies in other dimensions. Therefore, when extracting features from real traffic, it is crucial to comprehensively consider the tactics and techniques that malware might employ. The ATT&CK (Action, To, and Catch) matrix should be used to search for concealment measures that malware might take during network communication, identifying TTP (Transmission, To, and To) features that align with the DoH traffic detection and data augmentation tasks based on the malware's attack objectives.

[0103] Communication duration can be used to extract relevant TTP characteristics. When a normal user accesses internet resources via a browser and a domain name, they typically only access one domain at a time, and the application stops communicating after obtaining an IP address from the DoH server. In C&C network attacks, botnets periodically communicate with the master server to update instructions and status, resulting in a large number of queries at fixed time intervals. In tunneling attacks, the infected host needs to leak user data through a large number of data packets. Therefore, under normal circumstances, malicious DoH traffic has a longer communication duration or more frequent communication frequency than normal traffic. Furthermore, the DoH protocol can be configured with a keep-alive option, allowing long-lived connections between the client and server, allowing subsequent domain name queries to reuse TCP connections and avoid additional time overhead. In some cases, such as when a webpage redirects to multiple websites consecutively, or when a user opens multiple websites at once, the user's host may access multiple domains simultaneously, triggering the keep-alive option's reuse mechanism, causing a sudden change in communication duration characteristics. In such cases, relying solely on communication duration to identify network traffic may lead to misjudgment of the existence of a network attack; a comprehensive analysis combining other traffic characteristics is necessary.

[0104] The Domain Name System's (DNS) caching mechanism also affects the duration of communication. User browsers, operating systems, and DNS servers at various levels all have their own caches. When a user accesses internet data, there's a certain probability of hitting the domain cache, retrieving results, and ending the communication prematurely. To ensure data reaches the hacker's host, DoH (DoH) attacks use the DGA (Domain-Avoidance-Ghosting) algorithm to continuously generate unique domain names, thus avoiding cache hits. Therefore, the DNS caching mechanism causes some legitimate domain query traffic to end communication prematurely due to cache hits, resulting in shorter response times and creating a difference in timing characteristics between benign and malicious traffic.

[0105] The length of the data packet payload can also be used to extract TTP characteristics. According to DNS rules, the maximum length of each subdomain is 63 characters, and the total domain name length cannot exceed 253 characters. DNS response messages have 11 types and no length limit, but in most cases, their content queries the IP address corresponding to the domain name. Under normal circumstances, the domain name queried in regular DoH communication is not very long. In C&C communication attacks, malware may send a large number of meaningless keep-alive messages to ensure the survival of the communication connection. These messages are numerous and usually have a fixed length, causing changes in message length characteristics. The purpose of a tunneling attack is to send data outwards; the response messages sent by the hacker host are only used to confirm the receipt of data, and their information payload has no actual meaning. Therefore, the amount of data sent in a tunneling attack may be significantly higher than the amount of data received, and the ratio of their byte counts will be in a high range.

[0106] The DNS protocol's padding mechanism can cause TTP (Transactions Per Transaction) characteristics related to packet payload length to become invalid. DNS padding is a mechanism designed to prevent network traffic eavesdroppers from inferring user behavior based on packet statistical characteristics. Some studies have shown that it is feasible to infer user behavior by eavesdropping on encrypted DNS traffic and analyzing its static characteristics, with a success rate of up to 99.5% in inferring user website access success. The DNS padding mechanism can mask the actual query or response size by increasing the length of DNS messages, thus preventing attackers from inferring query content through traffic analysis. However, the DNS padding mechanism is not perfect; it can obfuscate the traffic characteristics of normal domain name query traffic, increasing the difficulty of detecting DoH (DoS) network attacks using traditional traffic analysis techniques. Therefore, it is necessary to combine other dimensions of traffic characteristics to improve the analytical capabilities for network attack detection.

[0107] The data packet transmission rate can also be used to extract TTP (Time to Teleport) characteristics. When the length of data packets and the duration of communication change at both the tactical and technical levels due to a cyberattack, the data packet transmission rate will also change accordingly, and its characteristics are directly related to the cyberattack's TTP. For example, the transmission rate of normal DoH (Domain of Hidden) traffic is affected by factors such as user browsing habits and browser software design; the transmission rate of malware is affected by hacker instructions, software structure design, and covert transmission methods, and its characteristics differ from normal traffic.

[0108] The information entropy of data packet payloads can also be used to extract TTP features. Encryption algorithms (such as TLS) obfuscate and randomize the original data, resulting in a more uniform byte distribution in the encrypted data and a significant increase in information entropy. Related research shows that although the content of the encrypted data is invisible, differences in the format and information content of the original data affect the byte distribution of encrypted traffic, and its randomness (quantified by entropy) can reflect the application protocols or behavioral patterns behind the traffic.

[0109] Step 14, Traffic Feature Extraction;

[0110] DoH data communication can be divided into several stages, including TCP handshake, TLS handshake, data transmission, domain name iteration / recursive lookup, and disconnection. Since the purposes of each stage differ, the characteristics exhibited in each stage should also differ. From the changes in DoH traffic characteristics, it can be seen that the values ​​of features such as packet length and interval time show phased and software-type variations in a single DoH communication process, and exhibit a certain degree of autocorrelation in the time-series dimension. Therefore, features can be extracted from the DoH communication process, using numbers between 0 and 1 to represent all packets in a complete DoH communication. 0 represents the first packet, and 1 represents the last packet. The larger the number, the later the packet is in the communication process. By encoding the position of each packet in the DoH communication process, sequence awareness is acquired during packet feature analysis, facilitating the focus on the characteristics of adjacent packets and learning the relationship between packet characteristics and communication stages.

[0111] Step 15, Unselected features;

[0112] TLS fingerprint: A TLS fingerprint is a unique identifier generated based on characteristic parameters of the client and server during the TLS handshake process. Its core principle is to extract plaintext information (such as supported cipher suites, TLS version, extension fields, elliptic curve cryptography algorithms, etc.) from the TLS handshake phase (especially the ClientHello message), generate a hash value according to a specific algorithm (such as JA3 / JA3S), and use this hash value as the TLS fingerprint. Traffic generated by many public DNS tunneling tools (such as dns2tcp, DNSCat2, Iodine) may carry fixed TLS fingerprints. Therefore, TLS fingerprints can be used to establish whitelist mechanisms to protect the network environment by prohibiting, restricting, or monitoring traffic not on the whitelist. However, TLS fingerprints themselves are based on hash algorithms, and the hash value of a TLS fingerprint alone cannot be used to deduce software traffic characteristics. TLS fingerprints cannot help data augmentation models improve their divergent thinking capabilities and cannot be selected as the TTP feature to guide the model in generating DoH traffic data.

[0113] TLS compression algorithms: Similar to cipher suite principles, the compression algorithm used for data transmission is determined during the TLS handshake. Different types of compression algorithms affect the ciphertext compression speed and the length of the compressed data, thus influencing the general characteristics of network traffic exposure. However, compression algorithms can introduce security risks, inducing CRIME and BREACH attacks and leaking user data. Starting with TLS 1.2, compression algorithms are no longer recommended and were completely disabled in TLS 1.3. It is no longer possible to extract TLS compression algorithm-related characteristics from TLS 1.3 encrypted traffic.

[0114] IP Addresses: IP addresses are used to establish a traffic detection mechanism that pays special attention to the IP addresses of public DoH service providers such as Google (8.8.8.8) and Cloudflare (1.1.1.1). If a large amount of traffic is sent to public DoH servers in a short period of time, it can be considered that there is an anomaly within the network segment. However, similar to TLS fingerprints, the IP addresses of public DoH servers are determined by the ISP, the number is limited, and the values ​​of the IP addresses are not necessarily related. Therefore, they cannot be selected as the TTP features to guide the generation of DoH traffic data in the model.

[0115] Client-side data transmission volume: Tunneling attacks attempt to leak user data, generating large amounts of traffic transmitting private data. Therefore, the size of the traffic sent by the client can be used to extract tunneling attack characteristics. When an excessively large and unreasonable amount of data transmission is detected on the network, the possibility of data leakage can be suspected. However, the data transmission volume mainly depends on the amount of data collected from the user's host by the malware. It can only describe the process of a specific tunneling attack and cannot be universally applied to describe other tunneling attacks. Therefore, it does not help the model generate malicious traffic. Furthermore, with average packet size, average timestamp interval, and packet location encoding already included as TTP features, the model can infer the amount of data sent by the client based on existing features. Therefore, the client-side data transmission volume is logically overridden by other features, not only failing to provide more information to the model but also increasing the risk of model overfitting.

[0116] Step 16, repeat feature processing;

[0117] The DoH traffic public dataset contains statistical features such as packet length, transmission rate, and timestamps. However, these features are also the TTP features extracted in this invention. The overlap between TTP statistical features and dataset features is detrimental to model training. Directly using these TTP statistical features to train the model may cause it to become overly reliant on TTP features and lose its ability to generalize to traffic characteristics.

[0118] To address the issue of repetitive features affecting model training, this invention proposes a traffic sharding and data representation method based on sliding windows and traffic clusters. This method uses TTP features to describe the complete DoH session process and statistical features to describe the local processes of the DoH session, thereby distinguishing repetitive features at both the micro and macro levels. This allows the model to maintain generalization ability while learning TTP statistical features.

[0119] Step 2: DoH traffic capture and processing;

[0120] A PCAP file containing DoH traffic data can be obtained by running a DoH traffic generation tool (such as browsers like Chrome and Firefox, or tunneling tools like dns2tcp and iodine). This invention divides the process of processing the PCAP file and converting it into training set data (i.e., the DoH traffic capture algorithm) into three steps: Step 21 is to filter the traffic in the PCAP file and extract the raw DoH traffic data; Step 22 is to extract DoH traffic features, converting the raw DoH traffic into DoH feature vectors; Step 23 is to slice the DoH feature vectors, further processing them to convert them into a data format that meets the requirements of model training. Specifically, DoH traffic feature extraction needs to comprehensively consider factors such as packet type, network transmission direction, TLS handshake information, and packet interval time; while DoH feature vector slicing needs to consider factors such as sliding window size, traffic feature length, and DoH session length.

[0121] Step 21: Filter the PCAP file for traffic.

[0122] Capturing and filtering DoH traffic from a complex internet environment requires consideration of multiple factors. On one hand, DoH traffic is mixed with regular traffic, necessitating differentiation. On the other hand, multiple DoH services may coexist on a network segment, and closed session connections may be reopened. Due to the characteristics of network signal transmission, traffic data from different services are transmitted alternately at the data link layer, increasing the difficulty of classifying and filtering corresponding data packets. Therefore, this invention uses data packets as the smallest unit of data analysis, combining known network information and network data context to extract DoH traffic characteristics from the network.

[0123] The separation between regular network traffic and DoH traffic can be analyzed using several conditions. First, since DoH data is encapsulated by TLS, checking for TLS protocol layer data in the data packets can exclude non-TLS data. Second, DoH protocol content is exposed as HTTPS protocol data; checking for the SNI code during the TLS handshake can further exclude non-HTTPS traffic data. Finally, regular HTTPS traffic and DoH traffic, due to their different functions, are sent to their respective servers. Whether a data packet belongs to DoH traffic can be determined by checking whether the IP address of the data packet belongs to a specific DoH server.

[0124] This invention uses a single complete DoH session as the smallest unit for TTP feature extraction. When extracting TTP features, it is essential to ensure that the complete DoH session traffic is captured from the network. Since DoH sessions are built on top of the TCP protocol, the IP addresses, port numbers, and handshake times of both communicating parties can be used as unique identifiers to distinguish DoH session communications that occur sequentially or simultaneously on the network, thus differentiating their network traffic. When a data packet is captured from the network, the DoH session to which the packet belongs can be determined through the packet header data and context information. Extracting DoH session traffic features is less restrictive than extracting TTP features; it only requires ensuring that the data packet belongs to the TLS protocol and that the length of the collected session traffic is sufficient for feature extraction.

[0125] Step 22, Extraction of flow features from DoH;

[0126] Let the notation for a TLS protocol data packet be packet, and let i be any sequence number of the packet in the session. Using the transmission direction and transmission time as identifiers, the i-th TLS protocol data packet is denoted as . ,and In this invention, if the total number of TLS protocol data packets collected is ,but TLS protocol data set , This is the first TLS protocol packet. For any TLS protocol packet, This is the last TLS protocol packet.

[0127] For the i-th TLS protocol data packet The sending time.

[0128] For the i-th TLS protocol data packet The data payload.

[0129] To use IP address and port number together to describe TLS protocol packets The direction of transmission, and , TLS protocol data packets The source IP address TLS protocol data packets Destination IP address TLS protocol data packets The source port number, TLS protocol data packets The destination port number.

[0130] Due to the complexity of the network environment, network protocol mechanisms such as data fragmentation, data padding, ACK confirmation, and keep-alive can interfere with the transmission of DoH protocol data, causing changes in the characteristics of DoH traffic. On the other hand, influenced by TCP flow control mechanisms, TLS chunking mechanisms, and application layer services, data transmitted by both parties is in batches, with short intervals between data packets within a batch and longer intervals between batches. This invention utilizes this characteristic to aggregate temporally adjacent data packets into a traffic cluster, extracting traffic features from the cluster to reduce the impact of the network environment on feature extraction.

[0131] Let the notation for a traffic cluster be chump, and let j represent any index of chump in a session, i.e., any traffic cluster. It contains n ( If there are 10 TLS protocol packets, then the relationship between traffic clusters and packets can be represented as follows: If If a TLS protocol data packet is divided into M traffic clusters, then there is a set of traffic clusters. , For the first traffic cluster, For any traffic cluster, This is the last traffic cluster.

[0132] For traffic clusters The first TLS protocol packet in the data, The sending time is .

[0133] For traffic clusters The second TLS protocol data packet in the middle, the The sending time is .

[0134] For traffic clusters The i-th TLS protocol data packet in the data, The sending time is For ease of explanation, the above... Also known as flow cluster Any TLS protocol data packet in the.

[0135] For traffic clusters Central A previous TLS protocol packet, the The sending time is .

[0136] For traffic clusters Central A subsequent TLS protocol packet, the The sending time is .

[0137] For traffic clusters The last TLS protocol packet in, the The sending time is .

[0138] In this invention, the threshold for the timestamp difference between adjacent TLS protocol data packets is denoted as... If the time interval between sending a pair of adjacent data packets is too long ( If a data transmission interruption occurs and the traffic is no longer continuous, then it is considered that the data transmission process has been interrupted. In this case, it is necessary to separate the traffic, dividing adjacent data packets with excessively large time intervals into different traffic clusters. For example... or .

[0139] In this invention, the maximum duration of the flow cluster is denoted as . The This is to prevent excessively large flow clusters from affecting feature extraction. For example... , or .

[0140] This invention uses traffic clusters as the smallest unit for extracting traffic features, and a complete DoH session communication consists of several traffic clusters, which are the smallest unit for extracting TTP features. Let the notation for a complete DoH session be session, and let k be the session number. If the kth complete DoH session is denoted as... The It contains m ( If there are ) traffic clusters, then the relationship between DoH sessions and traffic clusters can be represented as follows: , Let m be the m-th flow cluster.

[0141] In this invention, traffic clusters are sequentially selected from the traffic cluster set. Extract traffic features from the DoH session, and use the TTP features as the collectively shared features of the traffic cluster. This represents the traffic feature vector extracted from the traffic cluster; This represents the TTP features extracted from the session; This indicates the combination of traffic clusters with TTP features; This represents the combination of traffic flow characteristics and TTP characteristics; the symbol " The "" operator represents the concatenation operator for feature vectors. Therefore, the relationship between traffic cluster features and session features can be expressed as follows: .

[0142] Step 23, Slicing of DoH feature vectors;

[0143] The quality of generated traffic directly impacts the performance of downstream detection tasks. To ensure that the generated traffic can effectively support downstream traffic detection tasks, the generated traffic needs to meet the requirements of actual network traffic detection methods, with the selection of traffic length being particularly critical. For traffic detection tasks, fixed-length traffic segments can be extracted from network traffic and detected. Excessively long traffic segments increase the performance load on detection equipment, while excessively short traffic segments increase the difficulty of traffic detection and reduce the performance of the detection model. For traffic generation models, appropriately selected generated traffic length can balance the difficulty of model training while ensuring the quality of the generated traffic.

[0144] From DoH session The number of traffic clusters included in the feature representation is related to the number of traffic clusters, and is not a fixed value. For traffic detection and generation models, random and variable input data lengths can severely limit the design of the model architecture and have little positive impact on the final model training results. Therefore, it is necessary to format traffic of varying lengths to keep the length of the feature vectors extracted from the traffic constant. This invention uses sliding window sampling to solve the above problem. Traffic feature slices are sampled from the DoH session, and a sliding window is used to fix the feature length of the traffic slices, avoiding the potential negative impact of variable traffic feature dimensions; the size of the sliding window is denoted as . By appropriately selecting the sliding window size, we can find the optimal balance between the training difficulty and performance of the traffic detection model and the traffic generation model.

[0145] Traffic fragments are subsets of DoH sessions, and the traffic clusters they contain all belong to the same DoH session. Therefore, traffic fragments can be regarded as sharing TTP characteristics with DoH sessions.

[0146] When capturing traffic, you may encounter situations where the length is too short, resulting in an insufficient total number of traffic clusters. In a DoH session, sliding window extraction of traffic fragments is not possible. In this case, blank traffic clusters must be used. Data is populated at the end of the session content until at least one traffic fragment can be extracted from the session.

[0147] After processing traffic data using a sliding window, the dimensionality of DoH traffic slice features becomes related to the number of traffic clusters contained in the DoH session. This is irrelevant. In this case, using traffic slice features instead of DoH session features for model training can effectively avoid potential problems such as difficulty in model architecture design and training caused by varying traffic lengths.

[0148] Step 3: Data augmentation training based on TTP feature probability modeling;

[0149] A diffusion model is employed to jointly model the probabilistic distribution of traffic features and TTP features. During the training phase, the CIRA-CIC-DoHBrw-2020 dataset is used to learn the traffic distribution of known malware. A weighted loss function is used to balance the influence of large and small sample data.

[0150] This invention proposes a data augmentation method based on TTP features. First, DoH traffic is captured and processed from the network. This process uses traffic clusters to simplify the dimensionality of traffic features and a sliding window to fix the size of the traffic feature vector. Second, a DoH traffic probability model is proposed, using probability theory concepts such as variational lower bounds, Markov chains, and Bayes' theorem to describe the sampling and generation process of DoH traffic. Furthermore, the concept of contextual factors is introduced to discuss the relationship between DoH traffic data and TTP features, combining TTP features with the DoH traffic probability distribution. Finally, a weighted loss of large-sample DoH traffic and small-sample malicious DoH traffic is used to train the neural network to prevent overfitting.

[0151] Step 31, DoH traffic probability modeling;

[0152] From the perspective of model classification, diffusion models belong to probabilistic models. Probabilistic models are mathematical models that use probability theory to describe the relationship between variables. Their core idea is to model the data generation process, the dependence between variables, or the uncertainty through probability distributions, and to use probability theory for inference and prediction, establishing a mapping relationship between simple continuous probability distributions (such as standard normal distribution, uniform distribution, etc.) and complex continuous probability distributions.

[0153] This invention assumes that all DoH traffic data follows an unknown continuous probability distribution and possesses its own probability density function. The process of collecting DoH traffic data from the network environment can be viewed as a sampling process of this distribution, and the collected samples conform to its probability distribution. (Using notation...) This represents the total amount of malicious traffic from DoH. This represents the probability distribution that DoH malicious traffic data follows. This represents any DoH malicious traffic data. This represents the total dataset of DoH malicious traffic samples. For any DoH malicious traffic sample dataset, their relationship can be represented as follows: .

[0154] The diffusion model divides the data change process into several stages and assumes that the data change between adjacent stages follows a Markov chain. In the forward diffusion stage, the diffusion model adds noise to the original samples, resulting in noisy data; subsequently, it trains a neural network to predict the noise within the noisy data. In the reverse reconstruction stage, the diffusion model starts with pure noisy data, continuously predicting and removing some of the noise, ultimately recovering the original data. From a probabilistic perspective, both the forward and reverse processes can be viewed as discrete processes in which the probability distribution of data changes under the Markov chain assumption. Indicates the stage of change in the sampled data. Indicates the sampling time. Indicates the first Noisy data at time t. As t gradually increases, The proportion of noise also increases accordingly; when At this time, the hyperparameters approach 0, while the sample noise ratio approaches 1. The distribution can be approximated as a standard normal distribution. Indicates from The positive process is obtained at all times. The probability at any given moment; This indicates that the neural network passes through Time Prediction The probability at any given moment.

[0155] in addition, Since the distribution of traffic data exists only in theory and cannot be accurately known, the diffusion model employs maximum likelihood estimation to guide the training of the neural network. During training, the neural network can only predict the true distribution using collected traffic samples and optimize its parameters to make the generated traffic data conform as closely as possible to the true sample distribution. Therefore, the diffusion model utilizes variational distributions to transform the maximum likelihood problem into an optimization problem of variational lower bounds.

[0156] KL represents the Kullback-Leibler divergence between two probability distributions, a statistical indicator used to measure the degree of difference between them. The value of the KL divergence is positively correlated with the degree of difference between the two distributions; if the distributions are completely identical, the KL divergence equals 0. The value of the KL divergence is always non-negative. By optimizing the variational lower bound to maximize its expected value, neural networks can push the maximum likelihood probability closer to a larger value. During the optimization of the variational lower bound, only the neural network predicts the conditional probability. With neural network parameters The rest are related to Irrelevant terms can be treated as constants during neural network training. To maximize the variational lower bound, we need to minimize the expected value of the KL divergence, which means minimizing the distribution. and model predicted distribution Get as close as possible. Because Following a normal distribution with known variance but unknown mean, when the optimization objective changes from maximum likelihood estimation to maximizing the variational lower bound, the training objective of the neural network changes from predicting the probability density of the samples to predicting... The mean. The neural network is optimized using the L2 loss function. Let the mean of the neural network prediction be represented, then the final optimization objective can be expressed as: .

[0157] Represents the optimized neural network parameters .

[0158] express Obtaining the mean is related to time. The relevant function represents the mean of the normal distribution.

[0159] Representation and neural network parameters Related It always follows the mean.

[0160] Indicates from The positive process is obtained at all times. The probability at any given moment.

[0161] Step 32, TTP feature probability modeling;

[0162] Research on DoH traffic detection shows that DoH malicious traffic is influenced by contextual factors such as network environment, user behavior, DoH server, and DoH malware type, resulting in different traffic characteristics. Contextual factors of network traffic refer to various dynamic or static environmental conditions that affect the generation, transmission, distribution, and characteristics of network traffic, such as geographical location, user behavior, network quality, and hardware / software performance. From a probabilistic perspective, it can be assumed that the characteristics of DoH malicious traffic and contextual factors are a pair of related random variables. DoH malicious traffic sampled from the network environment does not represent its overall distribution, but only the posterior probability distribution generated after dynamically correcting the overall distribution based on contextual factors as evidence events.

[0163] use This represents real sample data of DoH traffic captured from the network, using... If we consider the contextual factors related to DoH traffic, then the relationship between the two can be expressed as follows: Assume the diffusion model is based on the dataset. Model training is then conducted. Under the influence of contextual factors, the sample distribution learned by the diffusion model during training will approach a specific distribution. deviation If the diffusion model is unaware of the contextual factors during training and learns the conditional probability distribution as the overall distribution, then the maximum likelihood estimation of the neural network parameters becomes the optimization objective. Similarly, the calculation results of the variational lower bound are also affected by contextual factors. Incorporating contextual factors into the calculation and reasoning process of the variational lower bound, the variational lower bound optimization function for the neural network parameters is denoted as... .because It approximately follows a standard normal distribution and can be directly sampled from the standard normal distribution. They are independent of each other, therefore and Irrelevant. Because The effect on the variational lower bound is only reflected in On this item, and This indicates that the neural network performs well given the contextual factors of the training set. Time Prediction The probability at any given time. In other words, without taking additional measures to interfere with the neural network training, the diffusion model can only learn a biased conditional distribution, not the overall distribution of DoH traffic. Therefore, the diffusion model cannot generate traffic data that conforms to other distributions (such as DoH traffic from other malware), lacking controllability and generalization ability. This indicates the use of newly generated malware and real sample data of DoH traffic captured from the network. Let represent the corresponding contextual factors. Then, the impact of these contextual factors on model training can be expressed as: .

[0164] Indicates belonging to The probability distribution that DoH malicious traffic data follows.

[0165] This indicates the contextual factors of a neural network given a training set. Time through Time Prediction The probability at any given moment.

[0166] This indicates the contextual factors of a neural network given a training set. Time through Time Prediction The probability at any given moment.

[0167] and The only difference lies in the type of DoH malware used. Different malware employs different tactics, techniques, and procedures to carry out malicious activities during the network attack lifecycle, resulting in DoH traffic exhibiting different characteristics and following different probability distributions. Apart from this, it can be considered that... and There is no difference between them; contextual factors unrelated to malware, such as network environment, user behavior, and hardware devices, follow the same distribution.

[0168] Based on the attack behavior analysis framework constructed using the ATT&CK matrix, this invention proposes the conditional independence assumption regarding TTP features: When analyzing DoH network attack traffic, the TTP features extracted through structured analysis of ATT&CK tactics, techniques, and processes can accurately describe the contextual factors directly related to malware in malicious traffic, and are independent of contextual factors unrelated to the software; with TTP features as additional reference information, the diffusion model can learn the probability distribution between DoH traffic and irrelevant contextual factors during the forward diffusion process, denoted as... ,use Indicates the distribution of irrelevant contextual factors, Indicates traffic from DoH The malware TTP signatures extracted at any given time have Based on this assumption, TTP features are introduced as an additional generation condition for DoH traffic during the diffusion model training process. Using Bayes' theorem and Markov conditional formulas for transformation, we obtain that, with TTP features as additional reference information, the model can determine the conditional probability distribution deviation caused by changes in malware type and generate DoH traffic that conforms to the TTP feature description. The optimization objective of the neural network at this point is... Convert to .

[0169] Step 33, weighted loss calculation;

[0170] In implementing the data augmentation method of this invention, it is particularly important to avoid the overfitting problem of neural networks. Neural network overfitting refers to the phenomenon where a model performs exceptionally well on training data but its performance significantly declines on new data. Since the model of this invention is trained using a large sample of DoH traffic data, while the target of data augmentation is a small sample of malicious DoH traffic, the data distributions of the two are not the same. During model training, the neural network may overfit to the training set, attempting to make the generated data perfectly match the training set data, while ignoring the relationship between TTP features and traffic features. Ultimately, the overfitting problem manifests as the diffusion model lacking sufficient generalization ability. Even with TTP features as additional reference information, the generated samples may conform to the training set sample distribution but cannot well conform to the sample distribution of newly added malicious traffic. This undoubtedly affects the performance of data augmentation.

[0171] During model usage, the issue of insufficient representativeness of small sample data may arise. According to Grievko's theorem, there is an error between the sample distribution and the true distribution of a random variable; the more samples, the smaller the error. Conversely, the fewer samples, the larger the error. In the DoH traffic generation task, the diffusion model needs to sample TTP features from a small dataset of newly added malware, and then feed these TTP features into a neural network for traffic generation. Due to the limited sample size, there will be an error between the sample distribution of TTP features and the true distribution of TTP features. This error will also affect the performance of data augmentation.

[0172] The overfitting problem in neural networks indicates that diffusion models consistently exhibit errors in their ability to fit both training and validation sets. This error is determined by the nature of neural networks and can only be mitigated, not avoided. Similarly, the insufficient representativeness of small sample data indicates an error between the sample distribution and the true distribution of TTP features. This error is determined by the law of large numbers and can also only be mitigated, not avoided.

[0173] To address the aforementioned shortcomings, this invention employs early stopping to mitigate these issues. Early stopping is a regularization technique that continuously evaluates the model's performance on the validation set during training. When the validation error (or loss) stops decreasing or even begins to increase, training is terminated early to prevent overfitting of the training data. Due to the specific nature of the task, this invention simultaneously sets up a large-sample validation set during model training. and small sample validation set During training, we simultaneously focus on the validation loss coefficients of both. The importance of each factor is adjusted by a weighted sum. The weighted loss can be expressed as... During model training, if the weighted loss stops decreasing, the model is considered to have reached its optimal state. In this case, a large training set can be used to further refine the model without overfitting. Rich TTP features for small sample data To supplement the model, it is necessary to enable the model to infer the overall distribution of TTP signatures for new malware.

[0174] Step 4: Generation of diffusion-type model data based on TTP features;

[0175] During the data augmentation phase, the TTP features of the target small sample DoH malicious traffic are extracted and input into the trained diffusion model to generate augmented traffic data that conforms to the distribution of the TTP features.

[0176] During the generation phase, the model can generate enhanced data that matches the traffic distribution of the target malware (such as dnstt, tcp-over-dns, etc.) by inputting its TTP characteristics.

[0177] In this invention, the proposed data augmentation method will be evaluated based on the DoH public dataset. The proposed DoH traffic data augmentation method aims to augment small-sample DoH malicious traffic data using a known large-sample DoH traffic dataset. Therefore, in the related experiments, it is assumed that there exists a DoH traffic dataset generated by known software, which has sufficient data size and diversity to reflect the relationship between TTP features and traffic features. In addition, the experiments also assume the existence of another DoH malicious traffic dataset composed of newly added samples. This dataset's samples come from newly added malware, are smaller in scale, and follow a different feature distribution than the known dataset, requiring data augmentation. The experiments mainly verify the data augmentation method from two perspectives: First, it is necessary to verify the similarity between the generated data and the real data, which can be verified by examining the statistical properties of relevant features; second, it is necessary to verify whether the generated data can achieve the purpose of data augmentation, which requires training a classification model using the generated data and comparing it horizontally with other data augmentation methods.

[0178] The basic environment for the relevant experiments is given in Table 5. The CentOS system is responsible for performing model training and traffic generation tasks, while the Windows system is responsible for performing data preprocessing and performance evaluation tasks.

[0179] Table 5 Basic Experimental Environment

[0180]

[0181] In the process of generating diffusion-type model data based on TTP features, this invention first presents the dataset used in the experiment and the results of preprocessing the dataset. On this basis, the model is trained and DoH traffic data is generated through the proposed data augmentation method, and the similarity between the generated dataset and the real data is evaluated. Data augmentation is performed on the minority class using the generated dataset to verify whether the generated data can improve the detection performance of the traffic detection model, and it is compared with the random oversampling algorithm and the SMOTE algorithm. Example

[0182] The DoH traffic data enhancement method and system based on diffusion model and TTP analysis proposed in this invention can be manufactured as an electronic device. This electronic device generally includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor. This electronic device is used to complete the DoH traffic data enhancement method based on diffusion model and TTP analysis.

[0183] The DoH traffic data enhancement method and system based on diffusion model and TTP analysis proposed in this invention can be manufactured as a computer-readable storage medium storing a computer program that, when executed by a processor, implements the DoH traffic data enhancement method based on diffusion model and TTP analysis of this invention.

[0184] The datasets selected for this test are the CIRA-CIC-DoHBrw-2020 dataset and the DoH-Tunnel-Traffic-HKD dataset. Data in these datasets was obtained by transmitting data between four public DoH servers using two benign software programs (Chrome and Firefox) and three malicious tools (iodine, dnscat2, and dns2tcp). Based on traffic type, the samples are categorized into three types: non-DoH traffic (normal HTTPS traffic), benign DoH traffic (such as legitimate DoH requests generated by browsers), and malicious DoH traffic (covert tunnel traffic generated by malicious tools).

[0185] DoH-Tunnel-Traffic-HKD is a supplementary dataset to CIRA-CIC-DoHBrw-2020, adding traffic data for three malicious tools (dnstt, tcp-over-dns, and tuns). The DoH-Tunnel-Traffic-HKD dataset was initially designed to study the ability of traffic detection models to detect new types of DoH malicious traffic, and its data size is relatively small.

[0186] This invention uses the CIRA-CIC-DoHBrw-2020 dataset as a large-sample dataset for model training during testing; and the DoH-Tunnel-Traffic-HKD dataset as a small-sample dataset to simulate emerging malware DoH traffic during testing. During model training, the model samples traffic features and TTP features from the large-sample dataset to gain the ability to generate traffic features using TTP features. During data augmentation, the model samples TTP features from the small-sample dataset and generates DoH traffic that conforms to the distribution of the small-sample data.

[0187] This invention selects 29 commonly used traffic features from DoH traffic detection-related works as the generated features for the model, and their detailed composition is shown in Table 6. During the traffic feature extraction process, this invention uses the DoHLyzer open-source tool and modifies its source code to ensure that its feature extraction process satisfies the relationship between traffic cluster features and session features, allowing simultaneous extraction of regular features from traffic slices and TTP features from complete sessions. For large sample datasets, considering the differences in data scale between different types of software, this invention uses random subsampling to limit the maximum number of traffic slices for each type of software. For small sample datasets, to simulate the emergence of new types of malware, the training set will not contain small sample data; only a small number of TTP features from small sample data will be sampled during the data generation stage to guide the model in generating traffic data, with the remaining samples used as the test set. The data sources ultimately used for model training and traffic generation in this invention are shown in Table 7.

[0188] Table 6 DoH Flow Characteristics List

[0189]

[0190] Table 7. Composition of the experimental dataset for this invention

[0191]

[0192] (a) Data preprocessing of DoH traffic

[0193] Observing the extracted 29-dimensional features reveals that the data range and distribution patterns of different features vary considerably, such as... Figure 2 As shown. For example, the data range of the feature "number of bytes received" is between 55B and 8MB, and the distribution is long-tailed; the data range of the feature "data packet length variation coefficient" is between 0 and 3.2, and the distribution is relatively uniform; the data range of the feature "median skewness of data packet length" is between -10 and 3.0, and the distribution is closer to a normal distribution; the data range of the feature "data packet length variance" is between 0 and... The distribution of these features is rather irregular. The diffusion model assumes that both the forward and reverse processes of the data follow a normal distribution. The differences in the range of features across different dimensions and the irregularity of their distribution inevitably affect model training. Therefore, this invention uses a box-cox transformation to process the features of each dimension separately, making each dimension's features closer to a standard normal distribution.

[0194] (ii) Data similarity verification

[0195] This invention verifies the similarity between generated DoH traffic and real DoH traffic from two perspectives. First, it uses the t-SNE algorithm to reduce the dimensionality of both generated and real data and visualizes the results. By directly observing the dimensionality reduction visualization effect, the similarity between the generated and real data can be determined. Second, it quantitatively analyzes the marginal distribution function of each traffic feature in both real and generated data, using Wasserstein distance as a metric to compare the ability of different data augmentation algorithms to restore the marginal distribution function of traffic features, thereby verifying the similarity between the generated and real data.

[0196] Visual verification

[0197] t-SNE (t-Distributed Stochastic Neighbor Embedding) is a non-linear dimensionality reduction algorithm primarily used for visualizing high-dimensional data. The t-SNE algorithm maps each high-dimensional data point to a low-dimensional data point with variable coordinates, thus mapping the high-dimensional distribution to a low-dimensional distribution. It uses KL divergence as a loss function to measure the difference between the high-dimensional and low-dimensional data distributions, and aims to minimize this loss by using gradient descent to change the coordinates of the low-dimensional data points, gradually bringing the low-dimensional and high-dimensional distributions closer together. In this way, it preserves the local similarity between data points, mapping high-dimensional data to a low-dimensional space. The more similar the data in the high-dimensional space, the closer their coordinates will be in the low-dimensional space.

[0198] This experiment sampled a small number of TTP features from three malicious traffic software programs in a small dataset, with 50 features sampled from each program. Thirty traffic slices were generated using each TTP feature, resulting in 4500 generated traffic slices. The generated traffic was then merged with real traffic, and the t-SNE algorithm was used to visualize and verify the mixed dataset, observing the distance between the generated and real data in low-dimensional space. The experimental results are as follows: Figure 3As shown in the figure, "Generate tuns" represents DoH traffic generated using the algorithm of this invention combined with the real TTP characteristics of the tuns tunneling tool; "Generate tcp-over-dns" represents DoH traffic generated using the algorithm of this invention combined with the real TTP characteristics of the tcp-over-dns tunneling tool; "Generate dnstt" represents DoH traffic generated using the algorithm of this invention combined with the real TTP characteristics of the dnstt tunneling tool; "tuns" represents real DoH malicious traffic sampled from the tuns tunneling tool; "tcp-over-dns" represents real DoH malicious traffic sampled from the tcp-over-dns tunneling tool; "dnstt" represents real DoH malicious traffic sampled from the dnstt tunneling tool; "iodine" represents real DoH malicious traffic sampled from the iodine tunneling tool; "dnscat2" represents real DoH malicious traffic sampled from the dnscat2 tunneling tool; "dns2tcp" represents real DoH malicious traffic sampled from the dns2tcp tunneling tool; "Firefox" represents real DoH benign traffic sampled from the Firefox browser; and "Chrome" represents real DoH benign traffic sampled from the Chrome browser.

[0199] The experimental results used color to distinguish DoH traffic data from different software (5 large-sample real data sets + 3 small-sample real data sets + 3 small-sample generated data sets). The results show that the t-SNE algorithm successfully distinguishes DoH traffic data generated by different software in low-dimensional space. First, observing the distribution of the 8 real data sets in low-dimensional space reveals that the t-SNE algorithm clusters traffic data from the same software together, indicating a high similarity between these data sets, demonstrating its clustering effect. Traffic data from different software sets, however, are more dispersed. Second, observing the distribution of the 3 small-sample real data sets and the 3 small-sample generated data sets in low-dimensional space reveals that there is still some distance between the generated and real data sets, indicating that their traffic data are not entirely identical. However, compared to other categories of data, each generated data set is closer to its corresponding real data set. This demonstrates that when the model uses TTP features as input, it can generate data that is closer to the small-sample real traffic data than the training set, proving the effectiveness of TTP features in describing real traffic characteristics and changing the distribution of generated data.

[0200] Marginal distribution verification

[0201] DoH traffic tabular data has 29 feature dimensions. Directly performing global similarity testing through multidimensional joint distribution faces the curse of dimensionality—the sparsity of samples in high-dimensional space leads to an exponential increase in distribution estimation error, while the computational complexity also far exceeds the feasible range. To overcome this analytical bottleneck, this invention uses marginal distribution to verify data similarity, comparing the distribution similarity between generated traffic and real traffic at the level of a single feature dimension. Similar to the previous section, this experiment samples a small number of TTP features from three malicious traffic software programs in a small sample dataset, with 50 features sampled from each software program. Thirty traffic slices are generated using each TTP feature, resulting in 4500 generated traffic slices.

[0202] Figure 4 , Figure 5 , Figure 6 The marginal distribution functions of 29 features from three types of few-sample malware—dnstt, tcp-over-dns, and tuns—are presented respectively. Figure 7 , Figure 8 , Figure 9 The corresponding probability density functions are shown. The blue portion represents the actual traffic characteristics, and the yellow portion represents the generated traffic characteristics. The name of each feature dimension is located above the curve. Comparing the upward trend of the curves reveals that, when only a small number of TTP features are collected from the small sample dataset, the marginal distribution of the generated traffic data and the marginal distribution of the small sample actual traffic show correlation across most feature dimensions. Although the two distribution function curves do not completely overlap, their trends exhibit dynamic consistency—as the marginal distribution function of the actual traffic increases with the horizontal axis value, the corresponding distribution function of the generated traffic also shows a synchronous growth trend. This strong correlation indicates that the generative model captures the distribution pattern of actual traffic based on TTP features. The part where the curves do not completely overlap can be interpreted as the model predicting the potential distribution pattern of actual traffic, thus achieving the ability to generalize to untouched traffic features while maintaining TTP features.

[0203] This invention introduces Wasserstein distance to quantitatively analyze the marginal distribution functions of generated and actual traffic. Wasserstein distance (also known as Earth Mover's Distance, EMD) is a metric for measuring the difference between two probability distributions. Its core idea originates from optimal transport theory. It quantifies the minimum "work" required to transform one distribution into another, where "work" is defined as the average distance a data point in the distribution moves along a certain feature dimension. The smaller the Wasserstein distance, the higher the similarity between the two distributions.

[0204] Wasserstein distance depends on the data range and distribution characteristics; it is a relative indicator and cannot determine the similarity of two distributions based on a single value. Therefore, this invention uses random oversampling and SMOTE data augmentation algorithms as control groups, comparing the Wasserstein distances of the augmented data from the three algorithms. Since the random oversampling and SMOTE algorithms rely on traffic data rather than TTP features when performing data augmentation, to ensure fairness, all three algorithms sampled the same traffic data from a small sample dataset during the experiment. However, the method proposed in this invention uses the TTP features of traffic sessions, while the other two algorithms use traffic features. The experimental comparison results are shown in Tables 8, 9, and 10, with bold text indicating the minimum Wasserstein distance for each feature dimension of the three data augmentation methods.

[0205] Table 8. Wasserstein distances between DNSTT software traffic generated by the three data augmentation methods and real traffic at various features.

[0206]

[0207] Table 9. Wasserstein distances of TCP-over-DNS software traffic generated by the three data augmentation methods compared to real traffic for various features.

[0208]

[0209] Table 10. Wasserstein distance between the TUS software traffic generated by the three data augmentation methods and the real traffic at various features.

[0210]

[0211] By analyzing and comparing the Wasserstein distance between the DoH traffic generated by the three algorithms and the actual DoH traffic, it can be seen that the three algorithms have different strengths and weaknesses when enhancing traffic data of different software and dealing with different dimensional features. When using Wasserstein distance as a metric for measuring the marginal distribution of generated traffic, it is difficult to determine which algorithm is the best.

[0212] The principle behind random oversampling is to simply replicate minority class samples to make their number close to that of the majority class, thus balancing the dataset and generating augmented data that is virtually authentic. However, when the sample size is insufficient, random oversampling repeatedly generates a large amount of identical data, leading to a lack of data diversity and representativeness. This is why random oversampling performs worse than other algorithms in terms of Wasserstein distance for some software / features.

[0213] The SMOTE algorithm uses the K-nearest neighbor algorithm to find the neighboring data points of each data point and generates new samples between these two data points through linear interpolation. Since it employs the K-nearest neighbor algorithm and the interpolation endpoints are all real data, the data generated by the SMOTE algorithm can be considered relatively realistic. Compared to random oversampling algorithms, SMOTE sacrifices some data realism for data diversity. However, in some cases, SMOTE uses linear interpolation to predict the true distribution of traffic features. This data diversity actually makes the generated data fit the true data distribution better, resulting in SMOTE performing better than random oversampling algorithms on the Wasserstein distance metric for some features.

[0214] For the data augmentation method proposed in this invention, since the model uses a known large-sample dataset as the training set, and this dataset contains a large amount of real traffic data and corresponding TTP features, the traffic data generated by the model can be considered to have rich diversity. Considering that when using Wasserstein distance as a metric, this method has its own advantages and disadvantages compared with the random oversampling algorithm and the SMOTE algorithm, and has no obvious shortcomings, this invention concludes that the data augmentation method proposed in this invention can simultaneously take into account the diversity and similarity of the data when augmenting DoH traffic data.

[0215] (III) Verification of Data Augmentation Effect Based on TTP Features

[0216] In anomaly detection scenarios based on DoH encrypted traffic, poor performance in small sample class identification and imbalanced data distribution are key factors restricting the generalization ability of the model. To verify the practical application value of the method proposed in this invention, the experiment designed in this invention includes two core verification contents: First, by comparing the performance index differences of the detection model before and after data augmentation on the real traffic test set, the improvement effect of the proposed method on the model's discrimination ability is evaluated. Second, during the experiment, the data augmentation method proposed in this invention is compared horizontally with existing methods to verify its performance advantages in generating small sample DoH malicious traffic.

[0217] In the field of DoH (Domain of Hazard) traffic detection, researchers have used various models. However, different models exhibit varying sensitivities to data size, distribution, noise, and outliers. Furthermore, the randomness in the real data sampling and data augmentation processes can have unpredictable impacts on the model's classification performance. This invention employs a voting ensemble learning model to reduce randomness. This model integrates five widely recognized and accepted machine learning models: Random Forest (RF), Support Vector Machine (SVM), Feedforward Neural Networks (FNN), Convolutional Neural Networks (CNN), and eXtreme Gradient Boosting (XGBoost). These five models have been demonstrated in previous work to exhibit good performance in DoH encrypted traffic detection.

[0218] The training set used in the experiment consisted of three parts: a large sample of real data, a small sample of real malicious traffic, and a small sample of generated malicious traffic. The small sample of real malicious traffic was randomly sampled from the small sample dataset to simulate the process of capturing novel malicious traffic from the network environment. The small sample of generated malicious traffic was obtained by data augmentation of the sampled small sample of real malicious traffic. The experiment used a controlled variable method to adjust the sample size of the small sample of real malicious traffic. For each type of malware, 10, 20, 50, and 100 complete session traffic data points were collected to explore the advantage range of the method under different sample sizes.

[0219] The experiment used four metrics to evaluate the classification quality of the model: accuracy, precision, recall, and F1 score.

[0220] in TP represents the number of malicious traffic samples correctly predicted by the model, TN represents the number of benign traffic samples correctly predicted by the model, FP represents the number of malicious traffic samples incorrectly predicted by the model, and FN represents the number of benign traffic samples incorrectly predicted by the model.

[0221] in .

[0222] in .

[0223] in .

[0224] There are two test sets related to the experiment, corresponding to two sets of experiments. The first test set consists of a small sample of DoH malicious traffic, aiming to verify the model's ability to detect small sample data before and after data augmentation. The second test set is a mixed dataset of large sample of benign DoH traffic, large sample of malicious DoH traffic, and small sample of malicious DoH traffic, aiming to verify the model's ability to detect overall DoH traffic before and after data augmentation. To ensure the objectivity of the model evaluation results, the proportion of traffic software in both test sets is controlled to ensure that the data scale of each DoH traffic software is the same. Since the first test set does not contain negative samples ( In this case, recall equals precision, while precision and F1 score become meaningless, so only precision is used to evaluate the experimental results of the first test set.

[0225] The experiment used random oversampling and the SMOTE algorithm as comparative algorithms to illustrate the research content of this invention. To ensure fairness, all three algorithms used the same data. To reduce the randomness of the experimental results, the comparative experiment was repeated five times, with each group of experiments resampling real traffic and performing data augmentation. The final experimental results were the average value.

[0226] Small sample DoH malicious traffic detection

[0227] First, the model was used to detect small-sample DoH malicious traffic on the first test set to verify the impact of augmented data on the detection performance of small-sample DoH malicious traffic. Experimental results are as follows: Figure 10 As shown, the horizontal axis represents the number of complete session traffic data samples taken from the real traffic of each software during the data augmentation phase, which are 0, 10, 20, 50, and 100 respectively. The vertical axis represents the accuracy of the model in identifying small samples of DoH malicious traffic.

[0228] When the number of traffic samples for each software is 0, meaning no data augmentation is applied to the real data, the model's accuracy in identifying malicious DoH traffic in a small sample is 20.1%, representing the model's detection performance without any data augmentation. Therefore, the three data augmentation methods perform identically when the sampled data is 0, and this 20.1% detection accuracy can be used as a benchmark for evaluating data augmentation methods.

[0229] When the number of traffic samples for each software is 10, comparisons show that regardless of the data augmentation algorithm used, the model's detection performance for small-sample DoH malicious traffic is significantly improved compared to when no data augmentation is performed. Using the random oversampling algorithm increases the model accuracy from 20.1% to 61.7%, the SMOTE algorithm increases it to 77.6%, while the method of this invention increases it to 87.2%, ranking first in performance and nearly 10% higher than the second-ranked SMOTE algorithm.

[0230] By further increasing the number of real traffic samples, it was observed that the accuracy of the model in detecting small sample traffic increases with the increase in the number of real traffic samples, showing a positive correlation. This indicates that the similarity between the augmented data and the real data becomes increasingly higher. Although the method of this invention consistently maintains a performance lead over the random oversampling algorithm and the SMOTE algorithm, the lead gradually narrows as the number of real traffic samples increases. When the number of each type of sampled traffic reaches 100, the three data augmentation algorithms have almost the same impact on the model's detection performance, all of which can enable the model to achieve an accuracy of 98%.

[0231] The above analysis leads to the conclusion that when the amount of real traffic data is sufficient, the data augmentation method proposed in this invention can enable the model to achieve an accuracy of 98%; when the amount of real traffic data is less than 50 records per software, the data augmentation method proposed in this invention can help the DoH traffic detection model achieve better performance.

[0232] DoH Total Flow Detection

[0233] The model was used to perform overall DoH traffic detection on the second test set to verify the impact of augmented data on the performance of overall DoH traffic detection. The experimental method was consistent with that for small-sample DoH malicious traffic detection, and the experimental results are as follows. Figure 11 , Figure 12 , Figure 13 , Figure 14 As shown, the data augmentation methods affect the accuracy, precision, recall, and F1 score of the model in identifying the overall DoH traffic.

[0234] When the sample traffic count for each software is 0, the model achieves an accuracy of 69.8%, a precision of 98.4%, a recall of 60.7%, and an F1 score of 81.7% for detecting overall DoH traffic. Compared to the experimental results of this invention's small-sample DoH malicious traffic detection, the model's performance in detecting DoH traffic has been significantly improved. This is because the test set no longer contains only small-sample DoH malicious traffic but also large-sample DoH traffic data that the model can accurately classify. As the proportion of small-sample DoH malicious traffic decreases, the model's classification performance improves.

[0235] Observing the accuracy results of the model in detecting the overall DoH traffic, we can find that: without data augmentation, the model can achieve an accuracy of 98.4% in detecting the overall DoH traffic. Accuracy is the proportion of samples predicted as positive that are actually positive. A high accuracy indicates that the model rarely mispredicts benign traffic as malicious traffic. When training the model with augmented data, the model still maintains a high accuracy, indicating that there is a certain difference between the malicious DoH traffic generated by the method of this invention and the real benign DoH traffic, preventing the model from misclassifying benign traffic as malicious traffic after training with augmented data.

[0236] Observing the impact of the number of sampled real traffic flows and different data augmentation methods on the model's performance in detecting overall DoH traffic, we can find that the model's accuracy in detecting small sample traffic increases with the increase in the number of real traffic samples, showing a positive correlation. Furthermore, the method of this invention can better improve the model's detection performance when the number of samples is small. This relationship is consistent with the conclusion of this invention regarding the detection of malicious DoH traffic in small samples. This indicates that after data augmentation of malicious DoH traffic in small samples, the model improves its detection performance for malicious DoH traffic in small samples, thereby improving its detection performance for overall DoH traffic.

[0237] The above analysis concludes that the data augmentation method proposed in this invention can augment small samples of malicious DoH traffic, thereby improving the DoH traffic detection model's ability to detect overall DoH traffic. The advantages of this method are particularly evident when there are few real traffic samples. Although the traffic generation model of this invention uses a large sample of DoH traffic as its training set, with the help of TTP features, the generated malicious DoH traffic is distinguished from the large sample of benign DoH traffic, preventing the traffic detection model from misclassifying benign traffic as malicious.

[0238] (iv) TTP Characteristic Ablation Experiment

[0239] In the data augmentation method of this invention, TTP features serve as a condition for generating DoH traffic data, constraining the data range and guiding the diffusion model in generating data. With the help of TTP features, the diffusion model can learn the relationship between the TTP feature distribution and the DoH traffic data distribution based on a large sample dataset, and then expand its associations using the TTP features of a small sample dataset to achieve data augmentation for that small sample dataset. Theoretically, if TTP features are removed during data augmentation, the diffusion model will lose its generalization ability, and the generated traffic will only conform to the data distribution of the training set.

[0240] To analyze the impact of TTP features on data augmentation, this invention designs an ablation experiment targeting TTP features. In the ablation experiment, TTP features are no longer used; instead, traffic labeling is used as a control condition to influence model training and data augmentation. Benign traffic is labeled with the number "0," while malicious traffic is labeled with the number "1." By performing data augmentation after replacing TTP features, the change in the traffic detection model's detection performance on a small sample of DoH malicious traffic is observed to verify the effectiveness of TTP features for data augmentation. The ablation experiment method is consistent with the data augmentation effect verification. Both the traffic generation model and the traffic detection model are retrained according to the requirements of the ablation experiment. After training, the detection performance of the DoH traffic detection model is verified, and the ablation experiment results are compared with the data augmentation experiment results.

[0241] The performance comparison results for detecting small samples of DoH malicious traffic in the ablation experiment and the original experiment are as follows: Figure 15 As shown, the experimental results of the original experiment are cited from the small-sample DoH malicious traffic detection of this invention. The comparison shows that in the ablation experiment, the detection accuracy for small-sample DoH malicious traffic can reach 29.6%, higher than 20.1% without data augmentation, but far lower than the accuracy of 87.2%~98.3% in the original experiment. This indicates that in the data augmentation method proposed in this invention, TTP features are the main factor in improving the quality of augmented data. Compared with benign / malicious traffic labels, TTP features can provide the model with more reference information.

[0242] The performance comparison results of detecting the total flow rate of DoH in the ablation experiment and the original experiment are as follows: Figure 16 As shown, the experimental results of the original experiment are cited from the DoH overall traffic detection of this invention. The comparison reveals that the model's performance in DoH overall traffic detection improved slightly in the ablation experiment compared to the data augmentation method, but the increase was small and far less than the performance improvement in the original experiment. This performance trend is consistent with the trend in the previous ablation experiment regarding the detection performance of malicious DoH traffic on a small sample, further demonstrating that TTP features play a major role in enhancing data quality during data augmentation.

Claims

1. A DoH flow data enhancement method based on diffusion model and TTP analysis, characterized in that, Includes the following steps: Step 1: Based on the ATT&CK matrix, perform TTP analysis on network attack behavior of the DoH protocol and extract a set of TTP features; Step 2: Extract traffic features from the known DoH traffic data and associate the traffic features with the TTP features extracted in Step 1; Step 3: Construct and train a diffusion model conditioned on TTP features. Using known DoH traffic data and their corresponding TTP features, learn the conditional probability distribution of traffic features. Step four, in the data augmentation stage, extract the TTP features of the target small sample DoH malicious traffic and input them into the trained diffusion model to generate augmented traffic data that conforms to the distribution of the TTP features.

2. The DoH flow data enhancement method based on diffusion model and TTP analysis according to claim 1, characterized in that: The extraction of TTP features in step one includes: Based on the attack principles of the DoH protocol, select technical and tactical items related to DoH network attacks from the ATT&CK matrix; By utilizing security meetings and publicly available attack analysis reports, the selected techniques and tactics were further refined and verified. Based on the revised tactics and techniques, the corresponding observable data sources are identified from the ATT&CK framework; Based on the DoH protocol communication mechanism and network attack process, TTP characteristics are filtered and defined from the data source; Based on relevant research papers and actual DoH attack traffic data, the validity of the defined TTP characteristics is verified and finally determined.

3. The DoH flow data enhancement method based on diffusion model and TTP analysis according to claim 1 or 2, characterized in that: The TTP features include at least one of the following categories; Plaintext features, including response time statistics and cipher suite information extracted from TLS handshakes or TCP headers; Statistical characteristics, including packet length, traffic volume, duration, frequency, and entropy values ​​obtained from overall traffic session statistics; Process characteristics include relative encoding that characterizes the temporal position of data packets within a session.

4. The DoH flow data enhancement method based on diffusion model and TTP analysis according to claim 1, characterized in that: The extraction and processing of flow characteristics in step two includes: A complete DoH session is divided into multiple consecutive traffic clusters based on a packet time interval threshold; A fixed-size sliding window is used to slice the feature vector composed of the flow cluster sequence to obtain flow feature fragments with fixed dimensions.

5. The DoH flow data enhancement method based on diffusion model and TTP analysis according to claim 1, characterized in that: The training process of the diffusion model in step three includes: Sample traffic feature fragments and their corresponding session TTP features from known real DoH traffic datasets; TTP features and random noise are input into the diffusion model as conditions, and training samples are constructed through the forward diffusion process. The training model learns the reverse diffusion process to predict and remove noise, with the optimization objective being to make the generated data distribution approximate the true conditional distribution. We employ a weighted loss function that combines a large dataset with a small validation set for training, and utilize an early stopping strategy to prevent overfitting.

6. The DoH flow data enhancement method based on diffusion model and TTP analysis according to claim 1, characterized in that: The data generation process in step four includes: Extract TTP features from the target small sample of DoH malicious traffic to be enhanced; The extracted TTP features are input into the pre-trained diffusion model along with random noise sampled from a standard normal distribution. The model performs a reverse diffusion process to gradually denoise and outputs high-quality DoH flow characteristic data that matches the input TTP characteristics.

7. A DoH flow data enhancement system based on diffusion model and TTP analysis, characterized in that... include: The TTP feature analysis and extraction module is used to execute the TTP feature extraction process as described in claim 1 or 2, and output the TTP feature set; The traffic feature processing module is used to extract and standardize traffic features from the raw traffic data, specifically executing the method described in claim 4; The conditional diffusion model training module is used to construct and train a generative model conditioned on TTP features, specifically implementing the method described in claim 5; The small sample traffic enhancement generation module is used to receive the TTP characteristics of the target traffic and generate enhanced data, specifically executing the method described in claim 6.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.

Images