An abnormal traffic data generation method, device, equipment and medium

Abstract

The application discloses an abnormal traffic data generation method and device, equipment and medium, and relates to the field of network security, comprising: constructing a structured knowledge base; the structured knowledge base comprises a network topology knowledge base and a threat intelligence knowledge base, the network topology knowledge base is constructed based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is constructed based on information extracted from a preset threat intelligence data source; a generative pre-training model is used as a base model, and the base model is fine-tuned based on the network topology knowledge base and the threat intelligence knowledge base in sequence to obtain a fine-tuned model; a target network topology description and a target threat intelligence description are input into the fine-tuned model to obtain abstract packet descriptions that meet topology constraints corresponding to the target network topology description and semantic requirements corresponding to the target threat intelligence description and output by the fine-tuned model; and the abstract packet descriptions are converted into executable physical network packets and output as abnormal traffic data.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method, apparatus, device, and medium for generating abnormal traffic data. Background Technology

[0002] As cyberattacks become increasingly complex, covert, and rapidly iterating, anomaly traffic detection technologies based on machine learning and deep learning have become core tools for cybersecurity defense. The performance of these detection methods heavily relies on large-scale, high-quality, comprehensive, and accurately labeled anomaly traffic training data. Efficiently acquiring such data has become a key bottleneck restricting the generalization ability and robustness of anomaly detection models. However, the three most commonly used methods currently have the following shortcomings in acquiring this type of data: The first method is based on passive collection of real network traffic combined with expert labeling. This method suffers from problems such as severe data imbalance, high labeling costs and susceptibility to subjective errors, as well as privacy compliance risks, and has limited data coverage and representativeness.

[0003] The second method involves experts actively generating data in a simulated environment using attack tools. While this method can obtain accurate labels, it is highly dependent on expertise and manual operation, making it costly and difficult to scale.

[0004] The third approach involves automatically synthesizing anomalous traffic using generative models. For example, generative adversarial networks (GANs) or variational autoencoders (VAEs) can learn from existing sample distributions to generate new samples. While this method reduces reliance on manual intervention to some extent, the generated data falls short in terms of semantic realism and subtle attack scenario details. This is particularly true for attack types requiring precise packet payload construction, where the quality is limited, and there is a lack of diversity due to pattern collapse. Furthermore, existing generative models lack the inherent ability to model the layered structure of the network protocol stack, often resulting in generated packets with invalid protocol field values ​​and semantic errors in application-layer payloads, making them unreliable for parsing and response by the target system. Simultaneously, the existing generative models lack awareness of the target network environment, failing to incorporate network topology, routing strategies, and IP address planning as generation conditions. This leads to generated traffic failing to reach the target system when applied in networks outside the original data collection environment.

[0005] In summary, how to generate abnormal traffic data that is both protocol-compliant and scenario-appropriate is a problem that needs to be solved. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for generating abnormal traffic data, capable of generating abnormal traffic data that is protocol-compliant and scenario-adaptive. The specific solution is as follows: Firstly, this application discloses a method for generating abnormal traffic data, including: Construct a structured knowledge base; wherein the structured knowledge base includes a network topology knowledge base and a threat intelligence knowledge base, the network topology knowledge base is constructed based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is constructed based on information extracted from a preset threat intelligence data source; The generative pre-trained model is used as the base model, and the base model is fine-tuned based on the network topology knowledge base and the threat intelligence knowledge base to obtain the fine-tuned model. The target network topology description and the target threat intelligence description are input into the fine-tuned model to obtain an abstract message description output by the fine-tuned model that simultaneously conforms to the topological constraints corresponding to the target network topology description and the semantic requirements corresponding to the target threat intelligence description. The abstract message description is converted into an executable physical network message, and the physical network message is output as abnormal traffic data.

[0007] Optionally, the process of constructing the network topology knowledge base includes: Node attributes, link relationships, and routing policies are extracted from the preset network topology data source, and a topology graph based on an attribute graph model is constructed. The node attributes include network device type, IP address range, subnet mask, operating system fingerprint, and service information. The link relationships include link type, bandwidth, latency, and connectivity. The routing policies include static routing configuration and dynamic routing protocol configuration summaries. Collect legitimate network traffic samples associated with the preset network topology data source; the legitimate network traffic samples include at least one of real packet capture data, simulated normal interactive traffic, and protocol state machine sequences; The legitimate network traffic sample is parsed into a first message description sequence in a preset storage format, and a protocol state machine label is attached to the first message description sequence for annotation. Then, the annotated first message description sequence is associated with the topology map and stored to form the network topology knowledge base.

[0008] Optionally, the process of constructing the threat intelligence knowledge base includes: The attack identifier, target protocol and port, triggering conditions, packet payload characteristics and context dependency information are extracted from the preset threat intelligence data source to obtain intelligence information; wherein, the triggering conditions include at least one of the following: a specially crafted packet sequence to be sent, a specific flag bit, a payload offset and an encoding method; the context dependency information includes at least one of the following: the service version, operating system and configuration items that the attack depends on. Collect attack traffic packet samples associated with the preset threat intelligence data source; the attack traffic packet samples include packet capture file fragments generated by proof-of-concept scripts in publicly available attack code repositories; The attack traffic packet sample is parsed into a second packet description sequence with a preset storage format. The attack feature payload and necessary fields of the protocol specification are marked in the target field of the second packet description sequence. Then, the marked second packet description sequence is associated with the intelligence information and stored to form the threat intelligence knowledge base.

[0009] Optionally, the step of fine-tuning the base model based on the network topology knowledge base and the threat intelligence knowledge base to obtain the fine-tuned model includes: The base model is fine-tuned based on the network topology knowledge base to obtain an initial fine-tuned model, so that the initial fine-tuned model outputs a legally reachable communication message sequence based on the input network topology description information; Based on the threat intelligence knowledge base, the initial fine-tuning model is fine-tuned according to instructions to obtain the fine-tuned model. The fine-tuned model embeds the corresponding attack payload into the communication message sequence according to the input threat intelligence description information, so as to output an attack traffic message sequence that carries attack semantics and simultaneously satisfies network topology description constraints.

[0010] Optionally, the step of fine-tuning the base model based on the network topology knowledge base to obtain an initial fine-tuned model includes: A first instruction dataset is constructed based on the data information stored in the network topology knowledge base; A first low-rank adapter is injected into the self-attention module of the base model using a preset parameter efficient fine-tuning method, and the weight parameters of the base model are frozen. The pedestal model after the first low-rank adapter is injected is fine-tuned using the first instruction dataset to obtain an initial fine-tuned model.

[0011] Optionally, the step of fine-tuning the initial model based on the threat intelligence knowledge base to obtain the fine-tuned model includes: A second instruction dataset is constructed based on the data stored in the threat intelligence knowledge base; A pre-defined parameter efficient fine-tuning method is used to inject a second low-rank adapter into the self-attention module of the initial fine-tuning model, and freeze the parameters of several network layers near the input layer in the initial fine-tuning model. Using the second instruction dataset, the parameters of several network layers near the output layer in the initial fine-tuned model after the second low-rank adapter is injected, as well as the parameters of the second low-rank adapter, are fine-tuned to obtain the fine-tuned model.

[0012] Optionally, converting the abstract message description into an executable physical network message includes: The abstract message description is input into the message rendering engine so that the message rendering engine can construct the protocol header fields of each layer according to the protocol type and field values ​​in the abstract message description, calculate and fill the IP layer header checksum and the transport layer pseudo header checksum, and then output the physical network message in PCAP format.

[0013] Optionally, after outputting the physical network packets as abnormal traffic data, the method further includes: The physical network packets are injected into a preset network simulation environment for playback. The protocol compliance, network reachability, and attack triggering validity of the physical network packets are verified, and the verification results are obtained. Based on the proximal policy optimization or direct preference optimization algorithm, the verification results are transformed into a reward signal, and the reward signal is used to update the parameters of the fine-tuned model.

[0014] Secondly, this application discloses an abnormal traffic data generation device, comprising: A construction module is used to build a structured knowledge base; wherein, the structured knowledge base includes a network topology knowledge base and a threat intelligence knowledge base, the network topology knowledge base is built based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is built based on information extracted from a preset threat intelligence data source; The fine-tuning module is used to take the generative pre-trained model as a base model and fine-tune the base model based on the network topology knowledge base and the threat intelligence knowledge base to obtain the fine-tuned model. The inference module is used to input the target network topology description and the target threat intelligence description into the fine-tuned model to obtain an abstract message description output by the fine-tuned model that simultaneously conforms to the topological constraints corresponding to the target network topology description and the semantic requirements corresponding to the target threat intelligence description. The conversion module is used to convert the abstract message description into an executable physical network message and output the physical network message as abnormal traffic data.

[0015] Thirdly, this application discloses an electronic device, including: Memory, used to store computer programs; A processor is configured to execute the computer program to implement the steps of the aforementioned disclosed abnormal traffic data generation method.

[0016] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned disclosed abnormal traffic data generation method.

[0017] As can be seen, this application constructs a structured knowledge base, which includes a network topology knowledge base and a threat intelligence knowledge base. The network topology knowledge base is constructed based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is constructed based on information extracted from a preset threat intelligence data source. A generative pre-trained model is used as a base model, and the base model is fine-tuned based on the network topology knowledge base and the threat intelligence knowledge base to obtain a fine-tuned model. The target network topology description and the target threat intelligence description are input into the fine-tuned model to obtain an abstract message description that simultaneously conforms to the topological constraints corresponding to the target network topology description and the semantic requirements corresponding to the target threat intelligence description. The abstract message description is converted into an executable physical network message, and the physical network message is output as abnormal traffic data.

[0018] Beneficial Effects: This application constructs a structured knowledge base comprising a network topology knowledge base and a threat intelligence knowledge base, transforming scattered and heterogeneous network topology and threat intelligence information into high-quality structured data suitable for model learning. This addresses the problems of traditional methods relying on expert experience and having a single source of knowledge, providing semantically clear and well-constrained training data for subsequent model fine-tuning. By using a generative pre-trained model as a foundation, fine-tuning is performed sequentially using topology knowledge and threat intelligence knowledge, ensuring the model is simultaneously constrained by both network topology and threat intelligence. This solves the problem of traditional generative models merely fitting statistical distributions and lacking semantic understanding, significantly improving the protocol compliance and attack semantic integrity of generated traffic. Then, by inputting the target network topology description and the target threat intelligence description into the fine-tuned model, an abstract message description that simultaneously meets topology constraints and semantic requirements is obtained. This gives the generation process scene awareness, allowing the model to automatically adapt the generated traffic based on the input target network description, solving the problem of difficult scene adaptation in existing technologies. The generated traffic can be delivered normally and correctly parsed in the target network. Ultimately, by converting abstract message descriptions into executable physical network messages, the model output is automatically converted into real messages. This allows for the generation of files that can be directly used for testing or training without human intervention, significantly reducing labor costs. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0020] Figure 1 This is a flowchart of an abnormal traffic data generation method disclosed in this application; Figure 2 This is a schematic diagram of a specific abnormal traffic data generation architecture disclosed in this application; Figure 3 This application discloses a specific method for generating abnormal traffic data, which is illustrated in the flowchart below. Figure 4 This is a schematic diagram of the structure of an abnormal traffic data generation device disclosed in this application; Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0021] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0022] The three most commonly used methods for acquiring anomalous traffic data currently suffer from the following drawbacks: The first method passively collects data based on real network traffic and combines it with expert labeling. This method suffers from severe data imbalance, high labeling costs, susceptibility to subjective errors, and privacy compliance risks, resulting in limited data coverage and representativeness. The second method involves experts actively generating data in a simulation environment using attack tools. While this method can obtain accurate labels, it heavily relies on professional knowledge and manual operation, making it costly and difficult to scale. The third method uses generative models to automatically synthesize anomalous traffic. For example, generative adversarial networks or variational autoencoders can be used to learn the distribution of existing samples to generate new samples. This type of method reduces reliance on manual intervention to some extent, but the generated data is insufficient in terms of semantic authenticity and subtle attack scenario features. Especially for attack types requiring precise packet payload construction, the generation quality is limited, and there is a lack of diversity due to pattern collapse. Furthermore, existing generative models lack the inherent modeling capability for the layered structure of the network protocol stack, often resulting in generated packets with illegal protocol field values ​​and semantic errors in application layer payloads, making them unreadable and unresponsive to the target system. Meanwhile, the existing generation model lacks the ability to perceive the target network environment during the generation process. It does not take information such as network topology, routing strategy, and IP address planning as generation conditions, which results in the generated traffic failing to reach the target system normally when applied in a network other than the original collection environment.

[0023] Therefore, this application discloses an abnormal traffic data generation method, apparatus, device, and medium that can generate abnormal traffic data that is protocol compliant and scenario-adaptive.

[0024] See Figure 1 and Figure 2 As shown in the figure, this application discloses a method for generating abnormal traffic data, the method comprising: Step S11: Construct a structured knowledge base; wherein the structured knowledge base includes a network topology knowledge base and a threat intelligence knowledge base, the network topology knowledge base is constructed based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is constructed based on information extracted from a preset threat intelligence data source.

[0025] This embodiment discloses a data acquisition and processing module, which aims to construct a large-scale, high-quality, protocol-constrained structured knowledge base to provide supervised training signals for the model. This structured knowledge base includes a network topology knowledge base and a threat intelligence knowledge base, thereby transforming scattered and heterogeneous network topology and threat intelligence information into high-quality structured data that the model can learn from. This solves the problems of traditional methods relying on expert experience and having a single source of knowledge, providing semantically clear and well-constrained training corpus for subsequent model fine-tuning.

[0026] The network topology knowledge base is constructed based on information extracted from preset network topology data sources, while the threat intelligence knowledge base is constructed based on information extracted from preset threat intelligence data sources. In a specific implementation, a heterogeneous data source parallel acquisition framework can be used. Through adaptive crawlers and domain parsers, raw information is extracted from network topology data sources such as internet topology databases, network simulation cases, and public routing tables, as well as from public threat intelligence sources such as vulnerability databases, attack pattern databases, and public PoC (Proof of Concept) repositories. This information is then uniformly structured, cleaned, semantically annotated, and augmented to form the corresponding network topology knowledge base and threat intelligence knowledge base.

[0027] The construction process of the network topology knowledge base includes: extracting node attributes, link relationships, and routing policies from the preset network topology data source, and constructing a topology graph based on an attribute graph model; the node attributes include network device type, IP address range, subnet mask, operating system fingerprint, and service information; the link relationships include link type, bandwidth, latency, and connectivity; the routing policies include static routing configuration and dynamic routing protocol configuration summaries; collecting legitimate network traffic samples associated with the preset network topology data source; the legitimate network traffic samples include at least one of real packet capture data, simulated normal interactive traffic, and protocol state machine sequences; parsing the legitimate network traffic samples into a first message description sequence in a preset storage format, and attaching a protocol state machine label to the first message description sequence for annotation, and then storing the annotated first message description sequence in association with the topology graph to constitute the network topology knowledge base.

[0028] Specifically, a dedicated metadata parser is developed for authoritative datasets such as CAIDA (Cooperative Association for Internet Data Analysis) Internet topology data, Internet Topology Zoo, and RIPEAtlas. This parser converts raw formats (such as GraphML, BGP (Border Gateway Protocol) routing tables, and RouterOS configurations) into a unified attribute graph model. In this attribute graph model, nodes store relevant attributes of network devices, including: network device type (e.g., host, server, router, switch), IP address range, subnet mask, MAC address, operating system fingerprint (i.e., operating system type and version information), and open service information (e.g., open port numbers, running service types, and protocol versions). Edges store link relationships, including: link type (e.g., wired link, wireless link), bandwidth, latency, and connectivity between devices. Furthermore, routing policies are extracted and associated with the topology graph, including static routing configurations (e.g., static routing table entries) and dynamic routing protocol configuration summaries (e.g., configuration parameters for routing protocols such as OSPF (Open Shortest Path First) and BGP).

[0029] Secondly, legitimate network traffic samples associated with the preset network topology data source are collected. These legitimate network traffic samples come from at least one of the following sources: real packet capture data, such as pcap (PacketCapture Library) files collected from a real network environment via port mirroring; simulated normal interactive traffic, such as traffic generated by simulating normal business communication in a network simulation platform; and protocol state machine sequences, such as abstract sequences describing the TCP three-way handshake process. Specifically, for each topology, the corresponding pcap file is obtained from publicly available traffic archives (such as the Wireshark sample library or network simulation project samples) as legitimate network traffic samples.

[0030] Then, the collected legitimate network traffic samples are parsed into a first message description sequence in a preset storage format, and a protocol state machine label is attached to this first message description sequence for annotation. During the parsing process, the DPKT (DataPlane Development Kit) library is used to perform deep parsing on each legitimate network traffic sample message, extracting key fields from the IP layer and TCP / UDP / ICMP layer headers, such as source IP address, destination IP address, source port, destination port, protocol type, flags, sequence number, acknowledgment number, etc., as well as application layer protocol semantics, such as HTTP request lines, DNS (Domain Name System) query names, etc. Continuous interactive messages belonging to the same communication session are organized into a flow-level description list, forming the first message description sequence. In addition, to strengthen the expression of protocol constraints, an additional protocol state machine label is attached during annotation. For example, for TCP flows, it is indicated that they must contain a handshake sequence of SYN, SYN-ACK, and ACK messages, and the sequence number must satisfy a random increment rule. The samples are stored as JSON-formatted message description sequences. Each record contains a five-tuple (source IP address, destination IP address, source port, destination port, protocol type), key header fields, and a payload example.

[0031] Finally, the labeled first message description sequence is associated with and stored in relation to the aforementioned constructed topology graph to form a network topology knowledge base. Specifically, the attribute graph model of each topology is associated with its corresponding legitimate traffic message description sequence, so that subsequent model training can simultaneously obtain network structure information and normal traffic samples conforming to the communication specifications of that topology from the same topology, thereby forming a complete topology-traffic sample pair for downstream instruction fine-tuning.

[0032] Furthermore, the construction process of the threat intelligence knowledge base includes: extracting attack identifiers, target protocols and ports, triggering conditions, packet payload characteristics, and context dependency information from the preset threat intelligence data source to obtain intelligence information; wherein, the triggering conditions include at least one of a specially crafted packet sequence to be sent, a specific flag bit, a payload offset, and an encoding method; the context dependency information includes at least one of the service version, operating system, and configuration items that the attack depends on; collecting attack traffic packet samples associated with the preset threat intelligence data source; the attack traffic packet samples include packet capture file fragments generated by proof-of-concept scripts in publicly available attack code repositories; parsing the attack traffic packet samples into a second packet description sequence in a preset storage format, and marking the attack feature payload and necessary protocol specification fields in the target fields of the second packet description sequence, and then storing the marked second packet description sequence in association with the intelligence information to constitute the threat intelligence knowledge base.

[0033] Specifically, an incremental crawler and information extraction pipeline is designed for NVD (National Vulnerability Database), CVEDetails (Common Vulnerabilities and Exposures Details), ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge), Exploit-DB, and public PoC (Proof of Concept) repositories on GitHub. A sequence labeling method combining rule-based approaches and pre-trained language models (such as BERT) is employed to extract various intelligence information from unstructured text, including attack identifiers, target protocols and ports, triggering conditions, packet payload characteristics, and contextual dependencies.

[0034] The attack identifiers include the CVE number (e.g., CVE-2021-44228), ATT&CK TTP ID (Tactical, Technical and Procedural Identifier, e.g., T1190), and the attack name (e.g., "Log4Shell"). Target protocols and ports include TCP, UDP, ICMP, HTTP, SMB, and other protocol types, as well as affected port numbers (e.g., port 80 for HTTP, port 443 for HTTPS). Triggering conditions include at least one of the following: a specially crafted message sequence to be sent, specific flag bits, payload offset, and encoding method. For example, for the Log4Shell vulnerability, the triggering condition can be described as: inserting a malicious string containing JNDI lookup syntax at a specified position in any header of an HTTP request. This string uses the format ${jndi:ldap: / / ...}, where the payload can be URL-encoded or Base64-encoded. Message payload characteristics include required strings (e.g., "jndi:ldap: / / "), byte sequences, field values, and required protocol constraints (e.g., TCP window size, checksum correctness). Context dependency information includes at least one of the following: the service version the attack depends on (such as Log4j 2.x version), the operating system (such as Windows, Linux), and configuration items (such as enabling JNDI lookup).

[0035] Secondly, attack traffic packet samples are collected and associated with pre-defined threat intelligence data sources. These attack traffic packet samples include packet capture file fragments generated by proof-of-concept scripts from publicly available attack code repositories. Each intelligence report is associated with one or more attack traffic packet samples, which can be PCAP fragments generated after running a publicly available PoC script, recording the complete attack packet sequence that triggered the vulnerability. For example, for the CVE-2021-44228 vulnerability, the corresponding PoC script can be obtained from Exploit-DB or GitHub, the script can be run, and traffic can be captured to obtain PCAP file fragments containing malicious HTTP requests.

[0036] Then, the collected attack traffic packet samples are parsed into a second packet description sequence with a preset storage format, and the target fields of the second packet description sequence are labeled with attack feature payloads and necessary fields of the protocol specification. During the parsing process, for each attack method, its associated PoC traffic sample is parsed into a standard packet description format, and the fields are labeled at the field level to indicate which are attack feature payloads and which are necessary fields that meet the protocol specification. For example, for an HTTP request packet, it needs to be labeled that: the request line and the Host header are necessary fields of the protocol specification (must exist and be correctly formatted), while the malicious string inserted in the User-Agent header is an attack feature payload. It should be noted that all message descriptions are serialized using a unified JSON Schema, which includes the following fields: network context identifier (e.g., network name, topology ID), flow identifier (used to identify multiple messages belonging to the same session), message sequence number (the order of messages in the flow), protocol type (e.g., TCP, UDP, HTTP), 5-tuple (source IP address, destination IP address, source port, destination port, transport layer protocol), dictionary of header fields for each layer (containing key fields and their values ​​for the IP layer, transport layer, and application layer), payload content and its constraints (e.g., must contain specific strings or meet specific encodings). This schema design ensures that the model can learn both the distribution of field values ​​and the constraints between fields.

[0037] Finally, the annotated second message description sequence is associated with and stored in conjunction with the previously extracted intelligence information to form a threat intelligence knowledge base. Specifically, the attack identifier, target protocol and port, triggering conditions, message payload characteristics, and contextual dependency information of each intelligence item are associated with its corresponding attack traffic message description sequence. This allows subsequent model training to simultaneously obtain attack description information and attack traffic samples that conform to attack semantics from the same intelligence item, thereby forming a complete intelligence-attack sample pair for downstream instruction fine-tuning.

[0038] As described above, both the network topology knowledge base and the threat intelligence knowledge base are labeled and stored using a unified message description format (such as JSON format). This provides semantically clear and well-constrained training data for subsequent dual knowledge augmentation, ensuring that the large model can accurately learn network protocol specifications and attack construction logic from the underlying data. Furthermore, to improve the model's generalization ability, this application also sets up data augmentation mechanisms. For example, for topology samples, variants are generated by randomly pruning nodes, modifying IP prefixes, and adding redundant links; for attack samples, the payload undergoes various encoding transformations (including URL encoding, Base64 encoding, and Unicode escaping) and protocol fields (such as source port, window size, and TTL) are fine-tuned while maintaining the attack semantics. The augmented dataset can be expanded by 5 to 10 times, effectively mitigating overfitting. Finally, all samples are divided into training, validation, and test sets and stored in JSONL format for downstream fine-tuning.

[0039] Step S12: Use the generative pre-trained model as the base model, and fine-tune the base model based on the network topology knowledge base and the threat intelligence knowledge base to obtain the fine-tuned model.

[0040] This embodiment also discloses a dual knowledge enhancement module, which aims to enable a large model to gradually learn network topology constraints and threat intelligence constraints through a two-stage fine-tuning strategy, and ultimately have the end-to-end generation capability from composite instructions to dual compliant message sequences.

[0041] Specifically, this application uses a generative pre-trained model as a foundation, and fine-tunes it using topological knowledge and threat intelligence knowledge to ensure that the model is simultaneously constrained by network topology and threat intelligence. This addresses the problem that traditional generative models only fit statistical distributions and lack semantic understanding, significantly improving the protocol compliance and attack semantic integrity of generated traffic. The dual knowledge enhancement module, through two-stage efficient fine-tuning, enables the model to possess both topology awareness and attack construction capabilities, greatly improving the protocol compliance and coverage of generated traffic. The foundation model can be a large-scale generative pre-trained model with code understanding and protocol understanding capabilities, such as CodeLlama-13B and StarCoder2-15B. Open-source weights are prioritized for local deployment to ensure data privacy and controllability.

[0042] Step S13: Input the target network topology description and the target threat intelligence description into the fine-tuned model to obtain an abstract message description output by the fine-tuned model that simultaneously conforms to the topological constraints corresponding to the target network topology description and the semantic requirements corresponding to the target threat intelligence description.

[0043] In this embodiment, by inputting the target network topology description and the target threat intelligence description into the fine-tuned model, an abstract message description that simultaneously meets the topological constraints and semantic requirements is obtained, enabling the generation process to have scene awareness capabilities. The model can automatically adapt and generate traffic based on the input target network description, solving the problem of difficult scene adaptation in the prior art. The generated traffic can be delivered normally in the target network and correctly parsed.

[0044] In other words, during the inference phase, the target network topology description and the target threat intelligence description are first concatenated into a natural language compound instruction, which is then input into the fine-tuned model. To enhance generation reliability, a constraint decoding mechanism is introduced during the generation process of the fine-tuned model: key fields in the abstract message description are forced to conform to protocol specifications through regular expressions or finite state machines. These key fields include at least one of IP address format, port range, and TCP flag values. For the checksum field, a placeholder (such as "0x0000") is controlled to be output by the fine-tuned model, and the actual value is calculated in subsequent steps. After the generated result is filtered by simple rules (such as removing duplicate messages and supplementing necessary interactions), it is output in standard JSON format as the abstract message description.

[0045] Step S14: Convert the abstract message description into an executable physical network message, and output the physical network message as abnormal traffic data.

[0046] This embodiment also discloses a message synthesis and verification module. This module is responsible for converting the abstract message description output by the large model into physical network messages and providing verification feedback based on the simulation environment to drive continuous model optimization. That is, this application first converts the abstract message description into executable physical network messages, realizing the automated conversion from model output to real messages. Files that can be directly used for testing or training can be obtained without manual intervention, significantly reducing labor costs.

[0047] It should also be noted that after outputting the physical network packets as abnormal traffic data, this application further includes a feedback optimization step. Specifically, after outputting the physical network packets as abnormal traffic data, the process further includes: injecting the physical network packets into a preset network simulation environment for playback; verifying the protocol compliance, network reachability, and attack triggering validity of the physical network packets to obtain verification results; and converting the verification results into reward signals based on near-end policy optimization or direct preference optimization algorithms, and using the reward signals to update the parameters of the fine-tuned model.

[0048] In other words, to verify the authenticity and validity of the generated traffic, this application first injects physical network packets into a preset network simulation environment for replay. Specifically, this application provides a standard integration interface for a network simulation platform, which can automatically generate a simulation network environment script (such as a Mininet Python script) based on the input target network topology description, thereby starting a virtual network containing specified nodes, links, and routing policies, and then calling the tcpreplay traffic replay tool to inject physical network packets from the attacker's node in the virtual network. Secondly, the protocol compliance, network reachability, and attack trigger validity of the physical network packets are verified to obtain verification results. Specifically, traffic is captured at the target node and intermediate network devices, and the vulnerability trigger flags of the target service are monitored (such as JNDI query requests from Log4Shell). After verification, three indicators are calculated: protocol compliance (including checksum accuracy and illegal flag ratio), network reachability (the proportion of packets successfully reaching the target node), and attack validity (whether the target vulnerability is triggered). Each indicator is normalized to a score between 0 and 1, and the weighted sum is used to obtain the overall reward value.

[0049] Finally, based on Proximal Policy Optimization (PPO) or Direct Preference Optimization (DPO) algorithms, the verification results are transformed into reward signals, which are then used to update the parameters of the fine-tuned model. In the PPO scheme, message synthesis and simulation verification are treated as a whole as the environment, the message description sequence generated by the model is considered as the action, and the reward value is the overall reward score. A Kullback-Leibler Divergence penalty term is introduced to suppress deviations from the original fine-tuning distribution, and the adapter weights are updated in batches using collected generated samples. In the DPO scheme, preference pairs are constructed by comparing successful and failed generation trajectories, directly optimizing the model's preference probability. The feedback optimization cycle can be set to execute once a week or once every 1000 new instructions, allowing the model to continuously evolve in actual test feedback and gradually adapt to complex and ever-changing network environments and new attack methods. In other words, this application uses reinforcement learning or direct preference optimization algorithms to fine-tune the model for alignment, thereby iteratively improving the authenticity and effectiveness of the generated traffic and forming a reinforcement loop that emphasizes both knowledge-driven and empirical feedback.

[0050] As can be seen, this application constructs a structured knowledge base containing both a network topology knowledge base and a threat intelligence knowledge base, transforming scattered and heterogeneous network topology and threat intelligence information into high-quality structured data that can be used for model learning. This solves the problems of traditional methods relying on expert experience and having a single source of knowledge, providing semantically clear and well-constrained training data for subsequent model fine-tuning. By using a generative pre-trained model as a foundation, fine-tuning is performed sequentially using topology knowledge and threat intelligence knowledge, ensuring that the model is simultaneously constrained by both network topology and threat intelligence. This addresses the problem of traditional generative models only fitting statistical distributions and lacking semantic understanding, significantly improving the protocol compliance and attack semantic integrity of generated traffic. Then, by inputting the target network topology description and the target threat intelligence description into the fine-tuned model, an abstract message description that simultaneously meets topology constraints and semantic requirements is obtained. This gives the generation process scene awareness, allowing the model to automatically adapt the generated traffic based on the input target network description, solving the problem of difficult scene adaptation in existing technologies. The generated traffic can be delivered normally in the target network and correctly parsed. Ultimately, by converting abstract message descriptions into executable physical network messages, the model output is automatically converted into real messages. This allows for the generation of files that can be directly used for testing or training without human intervention, significantly reducing labor costs.

[0051] See Figure 3 As shown in the illustration, this application discloses a specific method for generating abnormal traffic data. Compared to the previous embodiment, this embodiment further explains and optimizes the technical solution. Specifically, it includes: Step S21: Construct a structured knowledge base; wherein the structured knowledge base includes a network topology knowledge base and a threat intelligence knowledge base, the network topology knowledge base is constructed based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is constructed based on information extracted from a preset threat intelligence data source.

[0052] Step S22: Use the generative pre-trained model as the base model, and fine-tune the base model according to the network topology knowledge base to obtain the initial fine-tuned model, so that the initial fine-tuned model outputs a legally reachable communication message sequence according to the input network topology description information.

[0053] In this embodiment, fine-tuning is mainly divided into two stages. In the first stage, the base model is fine-tuned based on the network topology knowledge base, forcing the model to output a legally reachable normal communication message sequence according to the given network topology description information, thereby learning implicit protocol constraints such as IP address planning, route reachability, TCP state machine and application layer protocol format.

[0054] In a specific implementation, the step of fine-tuning the base model based on the network topology knowledge base to obtain an initial fine-tuned model includes: constructing a first instruction dataset based on the data information stored in the network topology knowledge base; injecting a first low-rank adapter into the self-attention module of the base model using a preset parameter efficient fine-tuning method, and freezing the weight parameters of the base model; and fine-tuning the base model after injecting the first low-rank adapter using the first instruction dataset to obtain the initial fine-tuned model.

[0055] In this embodiment, a first instruction dataset (i.e., a topology-normal traffic instruction dataset) is first constructed based on the data information stored in the network topology knowledge base. Each instruction in this first instruction dataset contains two parts: the first part is network topology information described in a natural language mixed structured JSON, including node attributes (such as device type, IP address range, subnet mask, operating system fingerprint, open services, etc.), link relationships (such as link type, bandwidth, latency, and connectivity), and routing policies (such as static route configuration and dynamic routing protocol configuration summary); the second part is a clear description of a legitimate communication task, such as "HTTP GET request from host A to server B" or "ICMP Echo request from host C to host D". The expected output of each instruction is a sequence of legitimate communication messages that conform to the communication specifications under this network topology.

[0056] Furthermore, a pre-defined, efficient parameter fine-tuning method is employed. A first low-rank adapter is injected into the self-attention module of the base model, and the weight parameters of the base model are frozen. Specifically, Low-Rank Adaptation (LoRA) is used as the efficient parameter fine-tuning method. In the self-attention module of the base model, low-rank adapters are injected for the query, key, and value projection matrices respectively, i.e., a low-rank decomposition matrix (obtained by multiplying two smaller matrices) is added next to the original weight matrix. In terms of parameter settings, the rank r of the low-rank adapter can be set to 8, and the scaling factor alpha can be set to 32. Simultaneously, all original weight parameters of the base model are frozen, ensuring they remain unchanged during training, allowing only the parameters in the low-rank adapter to be updated.

[0057] Then, the pedestal model after injecting the first low-rank adapter was fine-tuned using the first instruction dataset to obtain the initial fine-tuned model. During the fine-tuning process, the optimizer AdamW was used, with a learning rate of 2e-4, a linear warm-up followed by cosine decay learning rate scheduling strategy, a batch size of 8, a gradient accumulation step count of 4, and training for 3 to 5 epochs. The loss function adopted was the cross-entropy loss function based on autoregressive language modeling, which maximizes the probability of generating a correct message description sequence based on the input network topology description and communication task description. In the validation phase, in addition to calculating perplexity, the following metrics were also evaluated: message format accuracy (whether the generated message conforms to the preset JSON Schema), IP address attribution legitimacy (whether the generated IP address belongs to the IP address range limited by the input topology), TCP state machine integrity (whether the TCP stream contains the three-way handshake sequence of SYN, SYN-ACK, and ACK, and whether the sequence number meets the random increment rule), and application layer protocol field legitimacy (such as whether the HTTP request method, URI, and header fields conform to the RFC specification). Through the above fine-tuning, an initial fine-tuned model is obtained. This model has internalized network topology constraints and protocol specifications and can output a legally reachable sequence of communication messages based on the input network topology description information.

[0058] Step S23: Based on the threat intelligence knowledge base, fine-tune the initial fine-tuning model to obtain the fine-tuned model, so that the fine-tuned model embeds the corresponding attack payload in the communication message sequence according to the input threat intelligence description information, so as to output an attack traffic message sequence that carries attack semantics and simultaneously satisfies the network topology description constraints.

[0059] In this embodiment, in the second stage, while retaining the aforementioned network topology knowledge, a threat intelligence knowledge base is superimposed for secondary fine-tuning, enabling the model to learn how to map vulnerability triggering conditions and malicious payload embedding methods into attack packets that conform to protocol specifications. This allows the model to ultimately be able to collaboratively reason and generate attack traffic packet sequences that carry attack semantics and simultaneously satisfy network topology description constraints under any specified topology and intelligence combination.

[0060] In a specific implementation, the step of fine-tuning the initial fine-tuning model based on the threat intelligence knowledge base to obtain a fine-tuned model includes: constructing a second instruction dataset based on the data information stored in the threat intelligence knowledge base; injecting a second low-rank adapter into the self-attention module of the initial fine-tuning model using a preset parameter efficient fine-tuning method, and freezing the parameters of several network layers near the input layer in the initial fine-tuning model; and using the second instruction dataset to fine-tune the parameters of several network layers near the output layer in the initial fine-tuning model after the injection of the second low-rank adapter, as well as the parameters of the second low-rank adapter, to obtain the fine-tuned model.

[0061] In this embodiment, a second instruction dataset (i.e., an intelligence-attack traffic instruction dataset) is first constructed based on the data information stored in the threat intelligence knowledge base. Each instruction in this second instruction dataset contains a structured threat intelligence description and a corresponding attack traffic packet sequence. The structured threat intelligence description includes: attack identifiers (such as CVE number, ATT&CK TTP ID, attack name), target protocol and port (such as HTTP / 80 port), triggering conditions (such as a specially crafted packet sequence to be sent, specific flag bits, payload offset, encoding method), payload format (such as ${jndi:ldap: / / attacker.com / exploit}), and optional context information (such as target IP address, target port). The expected output of each instruction is the attack traffic packet sequence corresponding to the threat intelligence description, which is formed by embedding the attack payload within a legitimate communication packet sequence framework.

[0062] Similarly, using a pre-defined parameter-efficient fine-tuning method, a second low-rank adapter is injected into the self-attention module of the initial fine-tuning model, and the parameters of several network layers near the input layer in the initial fine-tuning model are frozen. Specifically, based on the initial fine-tuning model that has completed the first stage of fine-tuning, a new set of independent second low-rank adapters is added. The structure of the second low-rank adapter is the same as that of the first low-rank adapter (rank r=8, scaling factor alpha=32), which is used to learn the mapping relationship between attack semantics and packet structure. At the same time, the parameters of several network layers near the input layer in the initial fine-tuning model are frozen (e.g., the parameters of the bottom 8 Transformer blocks are frozen). These bottom-level network parameters have already learned network topology constraints and protocol specifications in the first stage, and they are frozen in this stage to prevent forgetting. In addition, the parameters of the completed first-stage low-rank adapter are also frozen.

[0063] Finally, using the second instruction dataset, the parameters of several network layers near the output layer in the initial fine-tuned model after injecting the second low-rank adapter, as well as the parameters of the second low-rank adapter, are fine-tuned to obtain the fine-tuned model. During the fine-tuning process, the fine-tuning learning rate of the second instruction dataset is set lower than the learning rate of the first-stage fine-tuning, for example, reduced to 1e-5, to maintain the stability of the knowledge learned in the first stage. Training is performed for 2 to 3 epochs. This stage only updates two parts of the parameters: one is the parameters of several network layers near the output layer in the initial fine-tuned model (e.g., the parameters of the high-level Transformer blocks), and the other is the parameters of the newly injected second low-rank adapter. Through this setting, the model gradually learns the ability to embed attack payloads into legitimate message frames while maintaining topology awareness and protocol compliance capabilities.

[0064] Furthermore, to maintain the topological knowledge learned in the first stage, one of the following strategies can be adopted: First, mix 10% to 20% of the first-stage samples into the training data of the second stage for multi-task joint fine-tuning, so that the model does not forget normal communication generation tasks while training attack generation tasks; Second, adopt the Elastic Weight Consolidation (EWC) method to apply regularization penalties to the model parameters, where the strength coefficient of the regularization penalty is positively correlated with the importance of the parameters to the first-stage tasks, that is, to impose stronger constraints on the important parameters in the first stage; Third, adopt the aforementioned independent adapter scheme, dynamically load the first-stage adapter or the second-stage adapter according to the task type during inference, or merge the weights of the two sets of adapters before loading.

[0065] Through the two-stage fine-tuning described above, the fine-tuned model is obtained. This fine-tuned model possesses dual generation capabilities: on the one hand, it can generate a legally reachable communication packet sequence based on the input network topology description information; on the other hand, it can embed corresponding attack payloads at appropriate positions in the legal communication packet sequence based on the input threat intelligence description information (e.g., inserting a JNDI injection string into the User-Agent header of an HTTP request), thereby outputting an attack traffic packet sequence that carries attack semantics and simultaneously satisfies the network topology description constraints. The IP addresses in this attack traffic packet sequence belong to the IP address range defined by the target network topology, the TCP stream contains a complete three-way handshake sequence, the application layer protocol format conforms to the RFC specification, and the attack payload is placed in the correct field position and uses the correct encoding method.

[0066] Step S24: Input the target network topology description and the target threat intelligence description into the fine-tuned model to obtain an abstract message description output by the fine-tuned model that simultaneously conforms to the topological constraints corresponding to the target network topology description and the semantic requirements corresponding to the target threat intelligence description.

[0067] Step S25: Input the abstract message description into the message rendering engine so that the message rendering engine can construct the protocol header fields of each layer according to the protocol type and field value in the abstract message description, calculate and fill the IP layer header checksum and the transport layer pseudo header checksum, and then output the physical network message in PCAP format and output the physical network message as abnormal traffic data.

[0068] In this embodiment, the message synthesis and verification module is equipped with a message rendering engine. This message rendering engine can automatically call the underlying construction library to automatically calculate the checksum, length and other protocol-mandated fields according to the field value list generated by the model, generate a complete link layer frame and encapsulate it into a standard PCAP file or real-time stream, ensuring that the output traffic strictly conforms to the RFC (Request For Comments, a series of numbered documents) specification in terms of format.

[0069] Specifically, based on the Scapy library, a mapper was designed to convert JSON descriptions into Scapy message objects. The mapping rules are as follows: The corresponding IP layer type (e.g., IPv4 or IPv6) is selected based on the protocol type (proto field) in the abstract message description; the corresponding transport layer type (e.g., TCP or UDP) is selected based on the source port (sport field) and destination port (dport field); and the corresponding application layer payload is automatically constructed based on application layer fields (e.g., method, uri, headers). For example, when the method, uri, and headers fields are detected, an HTTP request message is automatically constructed.

[0070] This application inputs the generated abstract message description (usually in JSON format) into the message rendering engine. The message rendering engine constructs the protocol header fields for the data link layer, network layer, transport layer, and application layer layer, based on the protocol type and field values ​​in the abstract message description. Specifically, it extracts the values ​​of the header fields for each layer from the abstract message description, including but not limited to: IP layer: source IP address, destination IP address, protocol type, service type, and Time to Live (TTL); TCP layer: source port, destination port, sequence number, acknowledgment number, data offset, flags (such as SYN, ACK, PSH, RST, FIN), and window size; UDP layer: source port, destination port, and length; and application layer: request line, status line, header fields, and message body. For TCP streams, the packet rendering engine also maintains a session state table. When the sequence number and acknowledgment number output by the model in the abstract packet description lack continuity (e.g., the sequence number increment between adjacent packets is not equal to the payload length of the previous packet), the packet rendering engine will automatically correct the sequence number and acknowledgment number of subsequent packets based on the sequence number of the first SYN packet and the subsequent payload length to ensure the consistency of the TCP state machine. For example, for a TCP stream, if the sequence number of the first SYN packet is set to X, then the sequence numbers of subsequent packets will be corrected sequentially to X+1, X+1+len(payload1), X+1+len(payload1)+len(payload2), etc., ensuring that the sequence number monotonically increases and covers all sent data.

[0071] After filling in all protocol header fields and payloads, the message rendering engine automatically calculates and fills in the IP layer header checksum and the transport layer pseudo-header checksum. For the IP layer header checksum, it calculates the sum of the one's complement of all 16-bit words in the IP header and fills the result into the checksum field of the IP header. For the TCP or UDP transport layer checksum, it first constructs a 12-byte structure containing the IP pseudo-header (including source IP address, destination IP address, protocol type, and TCP / UDP length), then treats the TCP / UDP segment as a string of 16-bit words and performs the one's complement sum, filling the final result into the checksum field of the TCP or UDP header. All checksum calculations are automatically completed by calling the built-in checksum calculation functions of the Scapy library.

[0072] Finally, the packet rendering engine encapsulates all constructed packets into physical network packets in standard PCAP (Packet Capture) format. The PCAP file contains a global header and multiple packet records, each containing a timestamp, packet length, and complete link-layer frame data. Furthermore, the packet rendering engine supports multiple output methods: outputting standard PCAP files for offline testing; real-time injection via the tcpreplay tool, replaying packets from the PCAP file to a specified network interface according to capture time intervals; or directly sending packets to a specified network interface via raw sockets. For large-scale batch generation scenarios, the packet rendering engine employs a multi-process parallel construction approach. Specifically, multiple abstract packet descriptions are distributed to multiple worker processes, each independently executing packet construction and checksum calculation tasks, with no state dependency between processes. Through parallel processing, the packet rendering engine can render thousands of packets per second, meeting the needs of generating large-scale abnormal traffic datasets.

[0073] Through the above processing, the message rendering engine converts the abstract message description output by the model into a transmittable and parseable physical network message in the actual network, and outputs it in PCAP format. This PCAP file can be directly used for training downstream abnormal traffic detection models, or directly injected into a network simulation environment for testing and verification.

[0074] For more detailed processing of steps S21 and S24, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0075] As can be seen, this application addresses the problems of limited coverage, poor protocol compliance, difficulty in scenario adaptation, and high manual costs in existing abnormal traffic data generation technologies by proposing a knowledge-enhanced intelligent model-based abnormal traffic data generation method. First, by automatically collecting and parsing internet topology databases, vulnerability databases, and public PoC repositories, a structured network topology knowledge base and threat intelligence knowledge base are constructed, solving the problems of traditional methods relying on expert experience and having a single knowledge source. Second, a two-stage fine-tuning strategy is used to enhance the knowledge of the base model. The first stage internalizes network topology constraints and protocol specifications, and the second stage enables it to master attack semantic embedding methods, thereby possessing the ability to generate dual-compliant attack traffic in any specified environment, overcoming the limitations of poor protocol compliance and difficulty in scenario adaptation in existing generation models. Finally, a packet rendering engine automatically synthesizes the abstract descriptions output by the model into physical packets conforming to RFC specifications, and a feedback optimization loop is formed by combining it with a simulation verification platform, continuously improving the authenticity and effectiveness of the generated data while reducing manual intervention. Through the above technical solution, the present invention realizes the large-scale and automated generation of high-quality, highly realistic, highly comprehensive and scenario-adaptable labeled abnormal traffic data, providing a solid data foundation for downstream abnormal traffic detection models.

[0076] See Figure 4 As shown in the figure, this application discloses an abnormal traffic data generation device, which includes: Module 11 is used to build a structured knowledge base; wherein, the structured knowledge base includes a network topology knowledge base and a threat intelligence knowledge base, the network topology knowledge base is built based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is built based on information extracted from a preset threat intelligence data source; The fine-tuning module 12 is used to take the generative pre-trained model as the base model and fine-tune the base model based on the network topology knowledge base and the threat intelligence knowledge base to obtain the fine-tuned model. Inference module 13 is used to input the target network topology description and the target threat intelligence description into the fine-tuned model to obtain an abstract message description output by the fine-tuned model that simultaneously conforms to the topological constraints corresponding to the target network topology description and the semantic requirements corresponding to the target threat intelligence description. The conversion module 14 is used to convert the abstract message description into an executable physical network message and output the physical network message as abnormal traffic data.

[0077] As can be seen, this application constructs a structured knowledge base containing both a network topology knowledge base and a threat intelligence knowledge base, transforming scattered and heterogeneous network topology and threat intelligence information into high-quality structured data that can be used for model learning. This solves the problems of traditional methods relying on expert experience and having a single source of knowledge, providing semantically clear and well-constrained training data for subsequent model fine-tuning. By using a generative pre-trained model as a foundation, fine-tuning is performed sequentially using topology knowledge and threat intelligence knowledge, ensuring that the model is simultaneously constrained by both network topology and threat intelligence. This addresses the problem of traditional generative models only fitting statistical distributions and lacking semantic understanding, significantly improving the protocol compliance and attack semantic integrity of generated traffic. Then, by inputting the target network topology description and the target threat intelligence description into the fine-tuned model, an abstract message description that simultaneously meets topology constraints and semantic requirements is obtained. This gives the generation process scene awareness, allowing the model to automatically adapt the generated traffic based on the input target network description, solving the problem of difficult scene adaptation in existing technologies. The generated traffic can be delivered normally in the target network and correctly parsed. Ultimately, by converting abstract message descriptions into executable physical network messages, the model output is automatically converted into real messages. This allows for the generation of files that can be directly used for testing or training without human intervention, significantly reducing labor costs.

[0078] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the abnormal traffic data generation method performed by the electronic device disclosed in any of the foregoing embodiments.

[0079] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0080] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0081] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored on it include operating system 221, computer program 222 and data 223, etc., and the storage method can be temporary storage or permanent storage.

[0082] The operating system 221 manages and controls the various hardware devices and computer programs 222 on the electronic device 20 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system 221 can be Windows, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of performing the abnormal traffic data generation method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 223 may include data received by the electronic device from external devices, as well as data collected by its own input / output interface 25.

[0083] Furthermore, embodiments of this application also disclose a computer-readable storage medium storing a computer program. When the computer program is loaded and executed by a processor, it implements the abnormal traffic data generation method steps disclosed in any of the foregoing embodiments.

[0084] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0085] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0086] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, compact disc read-only memory (CD-ROM), or any other form of storage medium known in the art.

[0087] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0088] The above provides a detailed description of the abnormal traffic data generation method, apparatus, device, and storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only intended to help understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for generating abnormal traffic data, characterized in that, include: Construct a structured knowledge base; wherein the structured knowledge base includes a network topology knowledge base and a threat intelligence knowledge base, the network topology knowledge base is constructed based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is constructed based on information extracted from a preset threat intelligence data source; The generative pre-trained model is used as the base model, and the base model is fine-tuned based on the network topology knowledge base and the threat intelligence knowledge base to obtain the fine-tuned model. The target network topology description and the target threat intelligence description are input into the fine-tuned model to obtain an abstract message description output by the fine-tuned model that simultaneously conforms to the topological constraints corresponding to the target network topology description and the semantic requirements corresponding to the target threat intelligence description. The abstract message description is converted into an executable physical network message, and the physical network message is output as abnormal traffic data.

2. The abnormal traffic data generation method according to claim 1, characterized in that, The construction process of the network topology knowledge base includes: Node attributes, link relationships, and routing policies are extracted from the preset network topology data source, and a topology graph based on an attribute graph model is constructed. The node attributes include network device type, IP address range, subnet mask, operating system fingerprint, and service information. The link relationships include link type, bandwidth, latency, and connectivity. The routing policies include static routing configuration and dynamic routing protocol configuration summaries. Collect legitimate network traffic samples associated with the preset network topology data source; the legitimate network traffic samples include at least one of real packet capture data, simulated normal interactive traffic, and protocol state machine sequences; The legitimate network traffic sample is parsed into a first message description sequence in a preset storage format, and a protocol state machine label is attached to the first message description sequence for annotation. Then, the annotated first message description sequence is associated with the topology map and stored to form the network topology knowledge base.

3. The abnormal traffic data generation method according to claim 1, characterized in that, The process of constructing the threat intelligence knowledge base includes: The attack identifier, target protocol and port, triggering conditions, packet payload characteristics and context dependency information are extracted from the preset threat intelligence data source to obtain intelligence information; wherein, the triggering conditions include at least one of the following: a specially crafted packet sequence to be sent, a specific flag bit, a payload offset and an encoding method; the context dependency information includes at least one of the following: the service version, operating system and configuration items that the attack depends on. Collect attack traffic packet samples associated with the preset threat intelligence data source; the attack traffic packet samples include packet capture file fragments generated by proof-of-concept scripts in publicly available attack code repositories; The attack traffic packet sample is parsed into a second packet description sequence with a preset storage format. The attack feature payload and necessary fields of the protocol specification are marked in the target field of the second packet description sequence. Then, the marked second packet description sequence is associated with the intelligence information and stored to form the threat intelligence knowledge base.

4. The abnormal traffic data generation method according to claim 1, characterized in that, The base model is fine-tuned based on the network topology knowledge base and the threat intelligence knowledge base to obtain the fine-tuned model, including: The base model is fine-tuned based on the network topology knowledge base to obtain an initial fine-tuned model, so that the initial fine-tuned model outputs a legally reachable communication message sequence based on the input network topology description information; Based on the threat intelligence knowledge base, the initial fine-tuning model is fine-tuned according to instructions to obtain the fine-tuned model. The fine-tuned model embeds the corresponding attack payload into the communication message sequence according to the input threat intelligence description information, so as to output an attack traffic message sequence that carries attack semantics and simultaneously satisfies network topology description constraints.

5. The abnormal traffic data generation method according to claim 4, characterized in that, The step of fine-tuning the base model based on the network topology knowledge base to obtain an initial fine-tuned model includes: A first instruction dataset is constructed based on the data information stored in the network topology knowledge base; A first low-rank adapter is injected into the self-attention module of the base model using a preset parameter efficient fine-tuning method, and the weight parameters of the base model are frozen. The pedestal model after the first low-rank adapter is injected is fine-tuned using the first instruction dataset to obtain an initial fine-tuned model.

6. The abnormal traffic data generation method according to claim 4, characterized in that, The step of fine-tuning the initial model based on the threat intelligence knowledge base to obtain the fine-tuned model includes: A second instruction dataset is constructed based on the data stored in the threat intelligence knowledge base; A pre-defined parameter efficient fine-tuning method is used to inject a second low-rank adapter into the self-attention module of the initial fine-tuning model, and freeze the parameters of several network layers near the input layer in the initial fine-tuning model. Using the second instruction dataset, the parameters of several network layers near the output layer in the initial fine-tuned model after the second low-rank adapter is injected, as well as the parameters of the second low-rank adapter, are fine-tuned to obtain the fine-tuned model.

7. The abnormal traffic data generation method according to claim 1, characterized in that, The step of converting the abstract message description into an executable physical network message includes: The abstract message description is input into the message rendering engine so that the message rendering engine can construct the protocol header fields of each layer according to the protocol type and field values ​​in the abstract message description, calculate and fill the IP layer header checksum and the transport layer pseudo header checksum, and then output the physical network message in PCAP format.

8. The abnormal traffic data generation method according to any one of claims 1 to 7, characterized in that, After outputting the physical network packets as abnormal traffic data, the method further includes: The physical network packets are injected into a preset network simulation environment for playback. The protocol compliance, network reachability, and attack triggering validity of the physical network packets are verified, and the verification results are obtained. Based on the proximal policy optimization or direct preference optimization algorithm, the verification results are transformed into a reward signal, and the reward signal is used to update the parameters of the fine-tuned model.

9. An abnormal traffic data generation device, characterized in that, include: A construction module is used to build a structured knowledge base; wherein, the structured knowledge base includes a network topology knowledge base and a threat intelligence knowledge base, the network topology knowledge base is built based on information extracted from a preset network topology data source, and the threat intelligence knowledge base is built based on information extracted from a preset threat intelligence data source; The fine-tuning module is used to take the generative pre-trained model as a base model and fine-tune the base model based on the network topology knowledge base and the threat intelligence knowledge base to obtain the fine-tuned model. The inference module is used to input the target network topology description and the target threat intelligence description into the fine-tuned model to obtain an abstract message description output by the fine-tuned model that simultaneously conforms to the topological constraints corresponding to the target network topology description and the semantic requirements corresponding to the target threat intelligence description. The conversion module is used to convert the abstract message description into an executable physical network message and output the physical network message as abnormal traffic data.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the abnormal traffic data generation method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the abnormal traffic data generation method as described in any one of claims 1 to 8.

Images