A Method and System for Generating IPv6 Network Traffic Based on a Denoising Diffusion Probability Model

Abstract

This invention relates to the field of network traffic generation and network security technology, and is a method and system for generating IPv6 network traffic based on a denoising diffusion probability model. The method includes: collecting raw IPv6 network traffic data and performing deep packet inspection on the raw IPv6 network traffic data; constructing a denoising diffusion probability model based on the U-Net neural network architecture, which is used to generate IPv6 traffic; training the denoising diffusion probability model; generating an IPv6 traffic image using the trained denoising diffusion probability model; and reconstructing, verifying, and outputting standard traffic data from the generated IPv6 traffic image. This invention designs a traffic-image bidirectional mapping mechanism that preserves protocol semantics, utilizes DDPM's superior image generation capabilities to learn the deep feature distribution of IPv6 traffic, and ultimately generates protocol-compliant and feature-accurate IPv6 traffic data.

Description

Technical Field

[0001] This invention relates to the fields of network traffic generation and network security technology, and in particular to a method and system for generating IPv6 network traffic based on a denoising diffusion probability model. Background Technology

[0002] With the large-scale migration of global internet infrastructure to Internet Protocol version 6 (IPv6), network infrastructure is undergoing profound changes. According to statistics from the China Academy of Information and Communications Technology (CAICT), IPv6 traffic accounts for over 50% of mobile network traffic in my country, and the support rate of major websites has reached over 90%. The IPv6 protocol completely solved the IPv4 address exhaustion problem by introducing a 128-bit address space. Furthermore, its simplified basic header, flexible extended header chaining mechanisms (such as hop-by-hop options, routing, fragmentation, and destination options), and stateless address autoconfiguration (SLAAC) significantly improve network scalability and configuration efficiency.

[0003] However, while the widespread deployment of IPv6 brings performance and convenience, it also introduces new and complex dimensions of security threats. Traditional IPv4 security knowledge bases, detection rules, and analysis methods often fail or become significantly less effective when facing the IPv6 protocol stack. This is mainly due to the following fundamental challenges: First, the severe scarcity of IPv6 traffic data. The current cybersecurity research community generally faces an "IPv6 data desert," with an extreme lack of publicly available, high-quality, and well-annotated IPv6 attack traffic datasets, especially samples containing advanced threats such as complex extended header abuse and new routing attacks (such as SRv6 tampering). This makes it difficult to establish the necessary data foundation for training data-driven security detection models, protocol fuzzing, and security device evaluation. Second, the fundamental differences in IPv6 protocol characteristics. The chained structure of IPv6 extended headers, the semantics of flow label fields, and the massive sparsity of addresses render traditional traffic representation and clustering analysis methods based on the IPv4 five-tuple (source IP, destination IP, source port, destination port, protocol) ineffective. Attackers can exploit the complex nesting of extended headers to launch attacks that evade detection. For example, the Citrix NetScaler memory overflow vulnerability (CVE-2025-7775) disclosed in the second half of 2025 was found to be more easily exploited when IPv6 functionality was enabled; advanced threat groups even successfully hijacked the software update processes of several well-known companies by forging IPv6 router advertisement messages.

[0004] To address the problem of data scarcity, researchers are attempting to apply generative artificial intelligence techniques to network traffic synthesis. Existing methods mainly include: (1) Methods based on traditional models and tools: such as using script tools like Scapy to manually or semi-automatically construct specific data packets. This method is flexible but inefficient, difficult to generate background traffic that conforms to complex statistical distributions on a large scale or to simulate new and unknown attack patterns, and highly dependent on the protocol knowledge of experts.

[0005] (2) Generative Adversarial Network (GAN) based methods: GANs and their variants have been attempted to generate network traffic. However, when applied to highly structured, discrete network protocol data with strict semantic rules, GANs generally face problems such as training instability and pattern collapse. For IPv6 extended headers with more complex structures and strong constraints between fields, GANs struggle to learn their effective distribution, and the generated traffic often has defects in protocol compliance and cannot be parsed by the strict protocol stack.

[0006] (3) Methods based on other generative models: including variational autoencoders (VAEs) and normalized streams. These methods perform well in generating continuous data (such as images), but their fidelity and diversity are often unsatisfactory when dealing with network protocol data with complex discrete structures and long-range dependencies.

[0007] (4) Precise generation methods based on programmable hardware: such as using programmable switching chips such as P4 / Tofino to achieve nanosecond-level precision in traffic generation. Although these methods have significant advantages in fidelity and performance, they are costly and inflexible. They are mainly used for performance testing of specific protocols (such as TSN) rather than for large-scale generation of diverse threat traffic for security research.

[0008] In summary, existing traffic generation technologies have significant limitations. They either cannot efficiently produce large-scale, high-quality data, struggle to model and reproduce the complex protocol structures unique to IPv6 (especially extended headers), or produce results that are unusable at the protocol semantic level. This leads to a critical technological gap: the lack of a method that can automatically and faithfully generate traffic data that conforms to IPv6 protocol specifications and simulates real-world threat behaviors (including exploiting extended header vulnerabilities).

[0009] Meanwhile, the Denoising Diffusion Probabilistic Model (DDPM), representing the next generation of generative AI, has made groundbreaking progress in fields such as image and audio synthesis. It learns data distribution through a progressive noise addition and denoising process, offering advantages such as stable training, high-quality generation, and diverse coverage patterns. However, applying DDPM, a technique originating from continuous data (such as image pixels), to structured discrete network data with strict grammatical and semantic rules faces significant challenges. The core issue lies in establishing a semantically preserving and reversible mapping between network protocol features and continuous image representations, ensuring that the generated results can be reconstructed into valid network data packets without loss and in compliance with regulations.

[0010] Therefore, there is an urgent need to invent a new method for generating IPv6 traffic that can combine the powerful generation capabilities of DDPM with the structured knowledge of network protocols, thereby fundamentally solving the data bottleneck problem in IPv6 security research. Summary of the Invention

[0011] To address the aforementioned technical problems, this invention provides a method and system for generating IPv6 network traffic based on a denoising diffusion probability model. This invention creatively transforms the IPv6 network traffic generation problem into a structured image generation and reconstruction problem. By designing a traffic-image bidirectional mapping mechanism that preserves protocol semantics, and leveraging DDPM's superior image generation capabilities to learn the deep feature distribution of IPv6 traffic, it ultimately generates protocol-compliant and feature-accurate IPv6 traffic data.

[0012] The technical means employed in this invention are as follows: A method for generating IPv6 network traffic based on a denoising diffusion probability model includes: collecting raw IPv6 network traffic data and performing deep packet inspection on the raw IPv6 network traffic data; constructing a denoising diffusion probability model based on a U-Net neural network architecture, wherein the denoising diffusion probability model is used to generate IPv6 traffic, and training the denoising diffusion probability model; generating an IPv6 traffic image using the trained denoising diffusion probability model; and reconstructing, verifying, and outputting standard traffic data from the generated IPv6 traffic image.

[0013] Furthermore, the deep packet inspection (DIP) process extracts the protocol structure features of the raw IPv6 network traffic data. These protocol structure features include at least the field values ​​of the IPv6 basic header, the type and sequence information of the extended header chain, and some byte content of the transport layer payload. The extracted protocol structure features are then encoded into an image format to form a training dataset.

[0014] Furthermore, the step of encoding the extracted protocol structure features into an image format specifically includes: Extract the following fields sequentially from the IPv6 basic header: version, traffic type, flow label, payload length, next header, hop limit, and the first N bytes of the source IPv6 address and destination IPv6 address; If extended headers exist, parse the extended header chain sequentially, extract the next header type field and its key option data for each extended header; extract the first M bytes of the transport layer payload data; All extracted byte data are linearly normalized sequentially to map their numerical range to an integer interval, resulting in a corresponding pixel value sequence; the pixel value sequence is then filled into the grayscale image matrix in row-major order.

[0015] Furthermore, when extracting the next header type field and its key option data for each extended header, the extraction strategy for the key option data is different for different types of extended headers; for routing headers, the routing type and number of remaining segments are extracted; for fragmentation headers, the fragmentation offset and more fragmentation flags are extracted; for destination option headers, the option type and length are extracted.

[0016] Furthermore, the construction of the denoising diffusion probability model based on the U-Net neural network architecture specifically includes: An asymmetric encoder-decoder network structure is constructed. The encoder part contains multiple downsampling stages, each of which extracts features and reduces spatial resolution through convolutional layers and activation functions. The decoder part contains multiple upsampling stages, each of which restores spatial resolution through transposed convolution or interpolation operations. Skip connections are introduced between corresponding levels of the encoder and decoder to perform channel stitching of shallow features extracted by the encoder and deep features of the decoder to assist in the reconstruction of image details. In the feature map space in the middle of the network, a self-attention mechanism module is introduced, which enables the model to capture the global dependencies between distant pixels in the image. Within each residual convolutional block in the network, an embedding vector representing the diffusion time step is injected into the feature map through a learnable linear layer, thereby adjusting the network's behavior according to different noise levels during the reverse denoising process.

[0017] Furthermore, training the denoising diffusion probability model specifically includes: Using a simplified mean squared error loss function The denoising diffusion probability model is trained using the following expression:

[0018] in, Refers to random variables , and Find the expected value of the joint distribution. For random sampling time steps, The original flow image, Standard Gaussian noise, For the noise prediction network to be trained, The coefficients are determined by the noise scheduling table.

[0019] Furthermore, the step of generating IPv6 traffic images using the trained denoising diffusion probability model specifically includes: An initial noise vector is input into the trained denoising diffusion probability model, and the noise is gradually removed by performing the reverse denoising process of the model to generate a synthetic traffic image that conforms to the characteristics of the IPv6 protocol.

[0020] Furthermore, the process of reconstructing, verifying, and outputting standard traffic data from the generated IPv6 traffic image specifically includes: The synthesized traffic image is decoded, and the image pixel matrix is ​​restored to the protocol field values ​​of each layer of the network data packet according to the mapping rules. The restored protocol fields are subjected to multi-level compliance verification and semantic correction. The compliance verification includes at least protocol hierarchy structure logic verification, key field semantic range verification, header verification, and recalculation. The data packets that have passed the verification and correction and conform to the IPv6 protocol specification are encapsulated into a standard format network traffic data file for output.

[0021] This invention also provides an IPv6 network traffic generation system based on a denoising diffusion probability model, implemented using an IPv6 network traffic generation method based on a denoising diffusion probability model. The system includes: a traffic feature extraction and encoding module, a DDPM model training and generation module, a traffic image decoding and reconstruction module, and a system control and interface module, wherein: The traffic feature extraction and encoding module is used to parse the original IPv6 traffic data packets and convert their protocol features into a dataset in image format according to predefined rules; The DDPM model training and generation module includes a denoising diffusion probability model built on the U-Net architecture, which is used to learn the data distribution of the traffic image and can generate new synthetic traffic images based on the input. The traffic image decoding and reconstruction module is used to reverse decode the generated traffic image into a network data packet structure, and to perform protocol compliance verification and correction on the data packets. The system control and interface module is used to coordinate the workflow of each module and provide a user configuration interface, task scheduling, and management and output interface for generated results.

[0022] Compared with the prior art, the present invention has the following advantages: This invention provides a method and system for generating IPv6 network traffic based on a denoising diffusion probability model. By employing this model, it achieves high-quality, high-fidelity IPv6 traffic generation, significantly outperforming traditional methods in reproducing complex structures such as extended headers. The structured feature visualization encoding scheme effectively transforms discrete, structured IPv6 extended header information into a format suitable for continuous generation model processing, overcoming the long-standing bottleneck of protocol complexity in this field. Simultaneously, by introducing a multi-level protocol compliance verification and correction engine, it fundamentally solves the common problem of invalid output in generated data, ensuring that the generated traffic is not only realistic in form but also fully compliant with protocol specifications, possessing parsability and processability in real-world network environments. Overall, this invention achieves significant progress in generation quality, technological breakthroughs, and practical compliance, providing reliable and efficient data support for IPv6 traffic simulation, network testing, and security research. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the IPv6 network traffic generation system based on the denoising diffusion probability model in this invention.

[0025] Figure 2 This is a schematic diagram illustrating the encoding of the extracted protocol structure features into an image format in this invention.

[0026] Figure 3 This is a schematic diagram of the U-Net neural network architecture in this invention.

[0027] Figure 4 This is a schematic diagram of the internal structure of ResBlock in this invention.

[0028] Figure 5 This is a schematic diagram illustrating the implementation steps of the attention mechanism in this invention.

[0029] Figure 6 This is an example of a parsing error caused by a minor error in an embodiment of the present invention.

[0030] Figure 7 This is the loss curve of the model during the experimental attack traffic process in this embodiment of the invention.

[0031] Figure 8 This is a schematic diagram of a traffic sample generated in an embodiment of the present invention. Detailed Implementation

[0032] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0033] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the present invention or its application or use. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0035] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale. Techniques, methods, and devices known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and devices should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0036] like Figure 1 As shown, this invention provides a method for generating IPv6 network traffic based on a denoising diffusion probability model, comprising: Raw IPv6 network traffic data is collected, and deep packet inspection (DIP) is performed on this data. Specifically, in a preferred embodiment of this invention, DIP extracts the protocol structure features of the raw IPv6 network traffic data. These features include at least the values ​​of each field in the IPv6 basic header, the type and sequence information of the extended header chain, and partial bytes of the transport layer payload. The extracted protocol structure features are then encoded into an image format to form a training dataset. The encoding process includes normalizing the values ​​of different protocol fields to a preset pixel value range and filling them into a fixed-size two-dimensional grayscale image matrix according to a preset spatial arrangement rule. In practice, DIP is performed using the Scapy tool library.

[0037] In a specific implementation, as a preferred embodiment of the present invention, the extracted protocol structure features are encoded into an image format, specifically including: The following fields are extracted sequentially from the IPv6 basic header: version, traffic class, flow label, payload length, next header, hop count limit, and the first N bytes of the source and destination IPv6 addresses. Basic header features include the key parts of the version, traffic class, flow label, payload length, next header, hop count limit, and source and destination IPv6 addresses. Extended header chain features are a core characteristic of IPv6 and also a challenging aspect to generate. The extended header sequence (such as hop-by-hop options header, routing header, fragmentation header, destination options header, etc.) is systematically parsed, extracting the "next header" type of each header and its internal key option fields (such as routing type, remaining segments, fragmentation identifier, etc.). Payload features represent the extraction of the initial bytes of the transport layer (such as TCP, UDP, ICMPv6) payload.

[0038] If extended headers exist, parse the extended header chain sequentially, extracting the next header type field and its key option data for each extended header. Extract the first M bytes of the transport layer payload data.

[0039] All extracted byte data are sequentially linearly normalized, mapping their numerical range to an integer range of 0 to 255, resulting in a corresponding pixel value sequence. This pixel value sequence is then filled into a 32x32 grayscale image matrix in row-major order. If the sequence length is less than 1024, the remaining positions are filled with zero values; if the sequence length exceeds 1024, the excess portion is truncated. In practice, N is set to 8, and M is set to 64.

[0040] In specific implementation, as a preferred embodiment of the present invention, when extracting the next header type field and its key option data for each extended header, the extraction strategy for key option data differs for different types of extended headers. For routing headers, the routing type and remaining segment count are extracted. For fragmentation headers, the fragmentation offset and more fragmentation flags are extracted. For destination option headers, the option type and length are extracted.

[0041] A denoising diffusion probability model is constructed based on the U-Net neural network architecture to generate IPv6 traffic. In a preferred embodiment, an asymmetric encoder-decoder network structure is constructed. The encoder part includes multiple downsampling stages, each extracting features and reducing spatial resolution through convolutional layers and activation functions. The decoder part includes multiple upsampling stages, each restoring spatial resolution through transposed convolution or interpolation operations.

[0042] Skip connections are introduced between corresponding levels of the encoder and decoder to perform channel stitching of shallow features extracted by the encoder and deep features of the decoder, thereby assisting in the reconstruction of image details.

[0043] At a layer with a feature map space size of 16×16 in the middle of the network, a self-attention mechanism module is introduced, enabling the model to capture the global dependencies between distant pixels in the image.

[0044] Within each residual convolutional block in the network, an embedding vector representing the diffusion time step is injected into the feature map through a learnable linear layer, thereby adjusting the network's behavior according to different noise levels during the reverse denoising process.

[0045] In implementation, the denoising diffusion probability model constructs the training target through the forward denoising process and uses the reverse denoising process as the generation method. The DDPM model is trained using the training dataset. By optimizing the error between the noise predicted by the model and the actual added noise, the model learns and models the data distribution characteristics of IPv6 traffic.

[0046] The denoising diffusion probability model is trained. Specifically, as a preferred embodiment of the present invention, the training includes: Using a simplified mean squared error loss function The denoising diffusion probability model is trained using the following expression:

[0047] in, Refers to random variables , and Find the expected value of the joint distribution. For random sampling time steps, The original flow image, Standard Gaussian noise, For the noise prediction network to be trained, The coefficients are determined by the noise scheduling table.

[0048] An IPv6 traffic image is generated using a trained denoising and diffusion probability model. Specifically, in a preferred embodiment of this invention, the method includes: inputting an initial noise vector into the trained denoising and diffusion probability model; iteratively sampling by executing the model's reverse denoising process to gradually remove noise and generate a synthetic traffic image that conforms to the characteristics of the IPv6 protocol.

[0049] The generated IPv6 traffic image is reconstructed, verified, and output as standard traffic data. In a preferred embodiment of this invention, the synthesized traffic image is decoded, and the image pixel matrix is ​​restored to the protocol field values ​​of each layer of the network data packet according to mapping rules. The restored protocol fields undergo multi-level compliance verification and semantic correction. Compliance verification includes at least protocol hierarchy structure logic verification, key field semantic range verification, header verification, and recalculation. Data packets that have passed verification and correction and conform to the IPv6 protocol specification are encapsulated into a standard format network traffic data file and output.

[0050] During implementation, multi-layered compliance verification and semantic correction specifically include: Protocol stack logic verification: verifying whether the packet structure conforms to the standard hierarchy of Ethernet frames carrying IP datagrams and IP datagrams carrying TCP / UDP / ICMPv6 messages; Field semantic verification: checking whether the values ​​of key fields conform to the valid range defined by the RFC standard, including but not limited to: whether the value of the next header field in IPv6 is a valid assigned protocol number, whether the ICMPv6 type / code combination is valid, and whether the TCP flag combination is valid; Checksum repair: recalculating and filling the checksum for the IPv6 pseudo-header, TCP or UDP header based on the corrected field values; Extended header structure verification: checking whether the order of the extended header chain conforms to the recommended order specified in RFC 8200, and verifying whether the internal structure of each extended header is complete and consistent.

[0051] This invention also provides an IPv6 network traffic generation system based on a denoising diffusion probability model, implemented using an IPv6 network traffic generation method based on a denoising diffusion probability model. The system includes: a traffic feature extraction and encoding module, a DDPM model training and generation module, a traffic image decoding and reconstruction module, and a system control and interface module, wherein: The traffic feature extraction and encoding module is used to parse raw IPv6 traffic packets and convert their protocol features into a dataset in image format according to predefined rules.

[0052] The DDPM model training and generation module includes a denoising diffusion probability model built on the U-Net architecture, which is used to learn the data distribution of traffic images and can generate new synthetic traffic images based on the input.

[0053] The traffic image decoding and reconstruction module is used to reverse decode the generated traffic image into a network data packet structure, and to perform protocol compliance verification and correction on the data packets.

[0054] The system control and interface module is used to coordinate the workflow of each module, and provides a user configuration interface, task scheduling, and management and output interface for generated results.

[0055] Example With the rapid global deployment of the IPv6 protocol, new network attack methods are emerging in an endless stream, such as SLAAC spoofing, ICMPv6 DDoS, and SRv6 tampering. Traditional IPv4-based detection methods are difficult to effectively identify these new threats due to protocol structure differences and a lack of samples. This invention introduces diffusion model technology, a recent breakthrough in image generation, into the field of network traffic analysis, constructing a complete technology chain from raw traffic data to image representation and then to generated traffic. It transforms the network traffic generation problem into an image generation problem.

[0056] To build an IPv6 traffic generation system based on DDPM, the project consists of three main parts: a traffic visualization unit, DDPM network design and implementation, and a traffic reconstruction unit.

[0057] a) Traffic visualization unit The unique structure of IPv6 traffic packets introduces new security vulnerabilities, allowing attackers to remotely execute code on devices with specific IPv6 capabilities enabled. An attack launched by the hacker group "TheWizards" exploited IPv6's stateless address autoconfiguration mechanism to forge router advertisements and implant backdoors for persistent control, exposing configuration risks in the initial deployment of IPv6. Therefore, when generating IPv6 traffic, the most crucial aspect to focus on are these flexible and powerful extension headers.

[0058] This invention performs deep parsing of the different structures of IPv6 traffic packets, decomposing them into different units and representing them separately in an image. Visual segmentation is designed for key areas, strengthening the important role of the extension header in the traffic generation process at the data processing level. Deep packet inspection (DIP) technology is used to extract IPv6 protocol header information, extension header features, and payload content, encoding these multi-dimensional network features into a pixel matrix of a grayscale image. For different types of IPv6 attack traffic, such as APN6 spoofing attacks, ICMPv6 routing request DDoS attacks, and SRv6 header tampering, specialized feature extraction algorithms are designed to ensure that attack features are fully preserved in the image space. The conversion methods employed are as follows: Figure 2 As shown.

[0059] In the analysis of IPv6 traffic packets, setting the target image size to 32×32 pixels achieves the optimal solution between preserving key information and meeting model processing efficiency. The IPv6 extension header carries the core control information and service characteristics of the protocol, and these data segments exhibit significant spatial locality when converted to image format. The 32×32 size can fully accommodate the most important extension header fields in a single packet, ensuring that key metadata (such as routing headers and segmentation options) remains spatially continuous, avoiding semantic integrity loss due to forced truncation caused by excessively small sizes. From a computational efficiency perspective, this size perfectly suits the architectural characteristics of modern convolutional neural networks. 32×32 is a friendly size for downsampling operations in standard convolutional networks (such as U-Net), yielding a 4×4 feature map after four 2x downsampling operations while maintaining effective spatial resolution. Simultaneously, this size provides more reasonable memory requirements during batch training, supporting deeper network structures and more complex attention mechanism deployments.

[0060] To realize the above concept, several key steps need to be designed: field extraction and segmentation, visual segmentation block processing, data normalization, padding or overflow handling, and PNG format selection and conversion. Through meticulous parsing of the IPv6 extension header and data payload, padding and overflow data are processed, key fields are extracted, and the final result is rendered as a PNG image.

[0061] A multi-granularity feature encoding strategy is designed to map the basic fields of the IPv6 header, the type sequence of the extended header, and key option parameters to different regions of the image. By arranging the spatial positions reasonably, information confusion is avoided, laying a solid foundation for the subsequent generation of corresponding images using the diffusion model.

[0062] b) DDPM model training and generation module for IPv6 traffic images Using the DDPM model as the main training and generation unit, utilizing, for example Figure 3The U-net network structure shown in the diagram performs temporal injection at each network stage and then uses an attention mechanism in certain convolutional blocks to improve the network's generative capabilities.

[0063] To address the scarcity of IPv6 attack samples, this patent introduces a diffusion model, leveraging its powerful generative capabilities to simulate IPv6 traffic characteristics, particularly the complex structure of the extended header. The core idea of ​​the diffusion model is to gradually transform simple Gaussian noise into a complex data distribution through a carefully designed noise addition process and a learnable inverse process. DDPM, as a landmark work in this model, has had a profound impact on the field of image generation with its elegant mathematical framework and stable training process. DDPM comprises two key processes: a forward process and a backward process.

[0064] The forward process is a fixed Markov chain, which will... Gaussian noise is progressively added to the original data over several time steps. The degree of noise addition at each step is controlled by a variance scheduling table, ultimately transforming any input image into almost pure Gaussian noise. This process is entirely governed by a set of predefined variance scheduling parameters. Control, among which ,and This indicates that the noise level changes with time step. It increases with the increase of.

[0065] The conditional probability distribution of each forward step is defined as follows: A Gaussian distribution with mean:

[0066] We can sample from this distribution using the reparameterization technique:

[0067] A key advantage is that, because this process is a Markov chain and follows a Gaussian distribution, it can be implemented in a closed form at any time step. Directly from raw data Sampled without having to proceed step by step Calculation.

[0068] definition and .So, The distribution can be derived as follows:

[0069] Similarly, using the reparameterization technique, it can be written directly as follows:

[0070] This formula is crucial. It shows that at any time step... Noisy data It is the raw data. and pure noise A linear combination of the coefficients of which are given by Decision. When hour, 0, The distribution then approaches the standard Gaussian distribution. Therefore, the forward process successfully transforms the data distribution into a simple prior distribution (Gaussian distribution). This process does not require learning; its significance lies in providing a clear learning objective for the backward process.

[0071] The reverse process is the core of the model's learning; its goal is to transform pure noise. The process begins by gradually removing noise, ultimately restoring a clear image. DDPM did not directly learn how to... predict Instead of directly predicting noise, the task is cleverly transformed into a simpler one: predicting the noise added in the current step. The model (typically a neural network with a U-Net structure) receives a noisy image. The embedding of time step t is taken as input, and its response to noise is output. The estimate. (Based on...) Subtracting the predicted noise from the image yields a clearer, denoised image.

[0072] If the reverse conditional probability can be known You can get from the noise Begin by running this reverse process step by step to obtain... .

[0073] However, It is difficult to calculate directly because it involves the entire data distribution. Therefore, a parameterized model is used. Typically, a U-Net-structured neural network is used to learn these conditional probabilities. An inverse Markov chain is constructed, whose transition probabilities are given by... definition:

[0074] The joint distribution of the entire reverse process is:

[0075] The goal is to make To match the true posterior distribution This true posterior distribution is tractable because, given the forward process... In this case, it follows a known Gaussian distribution. Through Bayes' rule and a series of derivations, it can be proven that: The mean and variance are respectively:

[0076]

[0077] observe The expression, which depends on and added during the forward process noise on This provides a key inspiration: instead of letting neural networks directly predict the mean. Instead, it makes it predict noise. Therefore, the mean parameter is:

[0078] As for variance For simplicity, we fix it to the value that has not been learned, i.e. ,in It can be set to or .

[0079] By predicting the mean Compared with the true mean By comparing the two distributions, a loss function can be constructed. After simplification, the KL divergence between the two Gaussian distributions can ultimately be reduced to a very concise mean squared error loss:

[0080] To further simplify training, some papers have found that ignoring the weight terms in the loss function leads to better sample quality, thus achieving the final simplification goal:

[0081] in, from Uniform sampling in the middle.

[0082] In summary, the training process involves randomly selecting a time step. Take a sample from the training data Generate random noise Calculate the current noisy data Then let the neural network according to and time step The noise is predicted. The loss function is the simple mean square error between the predicted noise and the actual noise. Once the model... Once trained, one can pass through... Begin by iteratively applying the following steps to generate new samples:

[0083] This process gradually subtracts the predicted noise from the original noise, ultimately yielding a new sample from the data distribution. The loss function for training DDPM is designed to be very concise and effective. Its core is to minimize the mean squared error between the noise predicted by the model and the noise actually added during the forward propagation process. The network's goal is to "guess" the noise added to the data during forward propagation. This simplified objective makes the training process exceptionally stable, avoiding the mode collapse problem common in generative models. The model learns on a wide range of noise levels and different image patches, ultimately achieving a strong generalization ability for the concept of "denoising." Once the model is trained, it possesses a powerful generator. The sampling process begins by randomly drawing a noise vector from a standard Gaussian distribution, and then the model iteratively... Step-by-step denoising. Each step updates the current image based on the predicted noise and incorporates randomness to maintain output diversity. Ultimately, a meaningless noise point is magically transformed into a coherent, clear, and detailed image.

[0084] In the DDPM network design for IPv6 traffic imaging, the network adopts an encoder-decoder structure, maintains information flow through residual connections, and introduces an attention mechanism at a specific resolution to capture global dependencies.

[0085] The choice of network layer number directly corresponds to the need for multi-scale feature extraction. The encoder systematically compresses the input image into semantic features through four downsampling passes (up to 32×32 resolution). Each downsampling pass is accompanied by an increase in the number of channels (128→256→512). This design ensures that the network can obtain richer semantic representations while sacrificing spatial resolution. The decoder gradually restores spatial details through a symmetrical upsampling process, ultimately reconstructing a clear image. This depth balances the expansion of the receptive field with detail preservation, enabling the model to understand both the overall structure of the image and reconstruct local textures.

[0086] The design employs a ResBlock structure for each core processing unit. In deep networks, residual connections effectively mitigate the vanishing gradient problem, ensuring stable training of the network even after multiple nonlinear transformations.

[0087] The GroupNorm used within the block replaces the BatchNorm because it is more stable when batch sizes vary (especially when the sampling phase is often 1). The smooth nonlinearity introduced by the Swish activation function provides better gradient flow and model performance compared to the traditional ReLU, which is especially important for regression tasks that require accurate prediction of noise, providing a foundation for model convergence.

[0088] In this task, each ResBlock contains two 3×3 convolutions. This is because two convolutions broaden the model's perspective, and timing the temporal injection in the middle avoids overwriting the original information and allows the second convolution to capture both basic and temporal features. The structure of each ResBlock is as follows: Figure 4 .

[0089] In the intermediate layer with a feature map size of 16×16, a self-attention module is integrated into the network. At this point, the feature map already possesses sufficient compressed semantic information, and the spatial dimension is moderate, making the computational cost manageable. The attention mechanism enables the model to capture long-range dependencies between different regions of the image, which is crucial for generating structurally sound and globally coherent images. The implementation steps of the attention mechanism are as follows: Figure 5 As shown.

[0090] All convolutional layers are planned to use 3×3 kernels, a standard choice in computer vision that effectively captures local features while maintaining parametric efficiency. Downsampling is achieved through convolutions with a stride of 2, while upsampling is accomplished through interpolation and transposed convolutions, both of which can be learned end-to-end. In the decoder, features from the corresponding layers of the encoder are concatenated via skip connections. This design directly transmits high-frequency details from the encoding stage to the decoder, greatly assisting in the reconstruction of subtle image structures during the decoding process.

[0091] Based on the network structure design and planning of the model training and generation process, it is important to ensure that the data loading part is consistent with the output interface of the traffic data visualization module. In fact, the overall architecture of the network layers is directly related to the choice of using 32×32 as the size of the generated dataset.

[0092] During training, the model training loss curve is collected as follows: Figure 7 As shown in the figure, both attack traffic models converge.

[0093] c) Traffic Reconstruction Unit The flow image generated by the trained DDPM model needs to be reconstructed in this unit to output a PCAP file that conforms to the standard format, so as to facilitate subsequent analysis and processing operations.

[0094] Because the data generated by the model may contain slight errors at specific bytes in key fields, such deviations may lead to significant differences at the semantic level, thereby affecting the effective parsing and logical reconstruction of traffic.

[0095] For example, the Ethernet "Type" field is 2 bytes long. A value of 0x0800 indicates the payload is an IPv4 packet; 0x86DD indicates the payload is an IPv6 packet; and 0x0806 indicates the payload is an ARP request / response packet. If the model incorrectly generates a 0x0806 "Type" field for an IPv4 packet (0x0800), the subsequent parts of the entire frame (originally the IP header, TCP / UDP header, and application data) will be parsed by the network stack as an ARP packet. This will lead to a catastrophic parsing error because ARP packets have a fixed format (hardware type, protocol type, opcode, etc.), and the IP packet data does not conform to this format. The frame will be considered a corrupted ARP packet and discarded, resulting in the complete loss of the entire communication context. See [link to documentation] for details. Figure 6 .

[0096] Therefore, after implementing the logical reconstruction of visualized traffic, a strict verification and cleaning process must be performed on the generated data to ensure its protocol consistency and logical rationality.

[0097] The obtained image data is extracted into an array, and padding is removed according to rules. The remaining valuable parts are combined and cached in a data packet. The cached data is then verified. This verification and cleaning process is crucial when reconstructing the generated traffic image into a PCAP file. This process requires: Protocol conformance check: Checks whether the hierarchical structure of each packet conforms to the protocol specification (for example, TCP packets must be carried on top of IP packets, and the "protocol" field of the IP packet must match the transport layer type).

[0098] Field semantic reasonableness check: Check whether the values ​​of key fields are within a reasonable range (e.g., whether the combination of TCP flags is valid, and whether the ICMP type / code combination exists).

[0099] Checksum verification and repair: For IP, TCP, UDP, and other headers, the checksum needs to be recalculated. If the generated data deviates from the key byte, the original checksum will inevitably be incorrect. The cleanup process can choose to discard the packet or recalculate and fill in the correct checksum based on the corrected data.

[0100] Verify the validity of the structure and order of each expansion head.

[0101] These rigorous checks ensure that the PCAP files recovered from the visualization data generated by the DDPM model are not only syntactically correct but also semantically sound, thus providing a reliable foundation for subsequent analysis.

[0102] After data visualization, DDPM training and generation, and data reconstruction, large-scale one-click generation of IPv6 traffic can be obtained. Integrating these steps into the web interface enables one-click operation and automates traffic feature extraction and generation.

[0103] Figure 8 The paper presents a portion of the attack traffic files generated by this patent. Experiments demonstrate that each traffic sample is precisely constructed and contains the key extended header features necessary to implement the attack, providing an effective experimental data foundation for subsequent detection and analysis.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating IPv6 network traffic based on a denoising diffusion probability model, characterized in that, include: Collect raw IPv6 network traffic data and perform deep packet inspection on the raw IPv6 network traffic data; A denoising diffusion probability model is constructed based on the U-Net neural network architecture, which is used to generate IPv6 traffic. The denoising diffusion probability model is trained; The trained denoising diffusion probability model is used to generate an IPv6 traffic image; The generated IPv6 traffic image is reconstructed, verified, and standard traffic data is output.

2. The IPv6 network traffic generation method based on a denoising diffusion probability model according to claim 1, characterized in that, The deep packet inspection (DIP) process extracts the protocol structure features of the raw IPv6 network traffic data. These protocol structure features include at least the values ​​of each field in the IPv6 basic header, the type and sequence information of the extended header chain, and some bytes of the transport layer payload. The extracted protocol structure features are then encoded into an image format to form a training dataset.

3. The IPv6 network traffic generation method based on a denoising diffusion probability model according to claim 2, characterized in that, The step of encoding the extracted protocol structure features into an image format specifically includes: Extract the following fields sequentially from the IPv6 basic header: version, traffic type, flow label, payload length, next header, hop limit, and the first N bytes of the source IPv6 address and destination IPv6 address; If extended headers exist, parse the extended header chain sequentially, extract the next header type field and its key option data for each extended header; extract the first M bytes of the transport layer payload data; All extracted byte data are linearly normalized sequentially to map their numerical range to an integer interval, resulting in a corresponding pixel value sequence; the pixel value sequence is then filled into the grayscale image matrix in row-major order.

4. The IPv6 network traffic generation method based on a denoising diffusion probability model according to claim 3, characterized in that, When extracting the next header type field and its key option data for each extended header, the extraction strategy for the key option data is different for different types of extended headers; for routing headers, the routing type and remaining segment count are extracted; for fragmentation headers, the fragmentation offset and more fragmentation flags are extracted. For the destination options header, extract the option type and length.

5. The IPv6 network traffic generation method based on a denoising diffusion probability model according to claim 1, characterized in that, The denoising diffusion probability model built based on the U-Net neural network architecture specifically includes: An asymmetric encoder-decoder network structure is constructed. The encoder part contains multiple downsampling stages, each of which extracts features and reduces spatial resolution through convolutional layers and activation functions. The decoder part contains multiple upsampling stages, each of which restores spatial resolution through transposed convolution or interpolation operations. Skip connections are introduced between corresponding levels of the encoder and decoder to perform channel stitching of shallow features extracted by the encoder and deep features of the decoder to assist in the reconstruction of image details. In the feature map space in the middle of the network, a self-attention mechanism module is introduced, which enables the model to capture the global dependencies between distant pixels in the image. Within each residual convolutional block in the network, an embedding vector representing the diffusion time step is injected into the feature map through a learnable linear layer, thereby adjusting the network's behavior according to different noise levels during the reverse denoising process.

6. The IPv6 network traffic generation method based on a denoising diffusion probability model according to claim 1, characterized in that, The training of the denoising diffusion probability model specifically includes: Using a simplified mean squared error loss function The denoising diffusion probability model is trained using the following expression: in, Refers to random variables , and Find the expected value of the joint distribution. For random sampling time steps, The original flow image, Standard Gaussian noise, For the noise prediction network to be trained, The coefficients are determined by the noise scheduling table.

7. The IPv6 network traffic generation method based on a denoising diffusion probability model according to claim 1, characterized in that, The process of generating IPv6 traffic images using a trained denoising diffusion probability model specifically includes: An initial noise vector is input into the trained denoising diffusion probability model, and the noise is gradually removed by performing the reverse denoising process of the model to generate a synthetic traffic image that conforms to the characteristics of the IPv6 protocol.

8. The IPv6 network traffic generation method based on a denoising diffusion probability model according to claim 7, characterized in that, The process of reconstructing, verifying, and outputting standard traffic data from the generated IPv6 traffic image specifically includes: The synthesized traffic image is decoded, and the image pixel matrix is ​​restored to the protocol field values ​​of each layer of the network data packet according to the mapping rules. The restored protocol fields are subjected to multi-level compliance verification and semantic correction. The compliance verification includes at least protocol hierarchy structure logic verification, key field semantic range verification, header verification, and recalculation. The data packets that have passed the verification and correction and conform to the IPv6 protocol specification are encapsulated into a standard format network traffic data file for output.

9. A system for generating IPv6 network traffic based on a denoising diffusion probability model, implemented using the IPv6 network traffic generation method based on the denoising diffusion probability model as described in any one of claims 1-8, characterized in that, include: The system comprises a traffic feature extraction and encoding module, a DDPM model training and generation module, a traffic image decoding and reconstruction module, and a system control and interface module, among which: The traffic feature extraction and encoding module is used to parse the original IPv6 traffic data packets and convert their protocol features into a dataset in image format according to predefined rules; The DDPM model training and generation module includes a denoising diffusion probability model built on the U-Net architecture, which is used to learn the data distribution of the traffic image and can generate new synthetic traffic images based on the input. The traffic image decoding and reconstruction module is used to reverse decode the generated traffic image into a network data packet structure, and to perform protocol compliance verification and correction on the data packets. The system control and interface module is used to coordinate the workflow of each module and provide a user configuration interface, task scheduling, and management and output interface for generated results.

Images