A network traffic data processing method

Abstract

The present application relates to the technical field of data processing, in particular to a network traffic data processing method, which comprises: inputting network traffic samples into a feature encoding network, outputting data representations of each sample and class center vectors corresponding to each category; inputting the data representation of a target category sample, the corresponding original feature and the class center vector as conditions to construct a dual-space collaborative denoising generation framework, performing a joint denoising generation operation in the hidden space and the original feature space to obtain a new hidden space sample point of the target category; and mapping the new hidden space sample point of the target category back to the original feature space through a feature reconstruction network to obtain a new target category sample. The present application can alleviate the problem of tail category recognition difficulty caused by the interweaving of category imbalance, category overlap and feature missing in network traffic data.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method for processing network traffic data. Background Technology

[0002] With the rapid development of network and communication technologies, machine learning-based anomaly detection systems have become an important means of ensuring network security. However, traffic data in real-world network environments typically faces a complex data distribution resulting from the interplay of the following three types of problems:

[0003] (a) Category Imbalance Problem

[0004] In network traffic data, normal traffic dominates, while samples of various attack traffic types are extremely scarce. This imbalanced distribution causes machine learning models to favor the head category (normal class) during training, thus severely reducing their ability to detect tail category attacks, such as advanced persistent threats and zero-day attacks.

[0005] (ii) Issues of overlapping categories

[0006] Because attack traffic is highly covert, its statistical characteristics often overlap or mix with those of normal traffic in the feature space. Research confirms that in imbalanced learning scenarios, class overlap is more critical than class imbalance itself, and is a key factor causing a significant decline in classification performance. Class overlap compresses the discrimination boundary of tail classes, significantly increasing the difficulty of classification.

[0007] (iii) The problem of missing eigenvalues

[0008] Due to the complex network acquisition environment, such as packet loss, sensor failure, and transmission delay, network traffic data often suffers from missing features, such as connection duration, protocol type, and traffic statistics. This data gap not only disrupts the integrity of the data structure but also affects the model's accurate representation of the data distribution.

[0009] In practical applications, the above three types of problems are often intertwined and exacerbated by each other: class imbalance makes tail classes more vulnerable in overlapping areas, and feature loss further blurs the already blurred class boundaries, which together severely restrict the performance of abnormal behavior detection systems.

[0010] To address the above problems, existing technologies mainly attempt to solve them from the following aspects:

[0011] 1. Oversampling method based on variational autoencoder

[0012] In the prior art, existing solutions utilize conditional variational autoencoders (CVAEs) to construct a class balancing module, generate samples for the tail classes through a class-specific generator, and combine a discriminator and a classifier to guide the quality of the generated data, such as Chinese patent application CN121525030A. However, this type of method has the following shortcomings: (1) The KL divergence constraint of the standard VAE mainly focuses on the overall structural compactness and lacks explicit constraints on class discriminability, making it difficult to guarantee the discriminability of the generated samples in scenarios with severe class overlap; (2) The generation process is carried out only in a single latent space and lacks constraints on the original feature space structure, which can easily lead to the generated samples deviating from the true data distribution; (3) This method assumes that the data is complete and cannot handle input data with missing values.

[0013] 2. Oversampling method based on generative adversarial networks

[0014] Another existing technology uses recurrent generative adversarial networks (GANs) to generate intrusion data, treating normal traffic as the source domain and attack traffic as the target domain, and generating tail category samples through domain transformation, such as Chinese patent application CN121333758A. However, the GAN architecture itself has inherent problems such as training instability and mode collapse; in addition, this type of method converts high-dimensional heterogeneous network traffic data into RGB pixel images for processing, destroying the structured semantic information of the original features, and also cannot handle scenarios with missing features.

[0015] 3. Sample generation method based on diffusion model

[0016] Diffusion models, due to their stable training properties and powerful distribution modeling capabilities, have been gradually introduced into network attack sample generation tasks. However, existing diffusion model methods mostly perform the diffusion process in a single space (original feature space or latent space), making it difficult to simultaneously ensure the semantic consistency and structural authenticity of the samples. Furthermore, existing methods typically assume data integrity and cannot directly handle inputs with missing values.

[0017] 4. Missing Data Handling Methods

[0018] Existing technologies typically employ a two-stage processing framework: first, missing value imputation (such as mean imputation, MissForest, GAIN, etc.), and then the imputed data is used for downstream tasks. This separate processing approach leads to a lack of co-optimization between the imputation process and the downstream task objectives, and imputation errors can propagate to subsequent tasks, limiting the overall model performance.

[0019] In summary, existing technologies have the following shortcomings when dealing with complex data distributions involving "class imbalance, class overlap, and feature loss": (1) they lack a unified framework to address all three types of problems simultaneously; (2) missing value handling is separated from downstream generation tasks; (3) the generation process is modeled only in a single space, making it difficult to guarantee the authenticity and discriminativeness of the samples; and (4) the latent space lacks explicit class discrimination structure constraints. Therefore, there is an urgent need for a method that can generate high-quality tail-class attack samples under complex data distributions. Summary of the Invention

[0020] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows:

[0021] This invention provides a method for processing network traffic data, the method comprising the following steps:

[0022] S100, the original data sample is input into the feature encoding network, and the missing information in the sample is compensated through a masking mechanism so that the feature encoding network outputs a consistent data representation under different missing modes; the original data sample is network traffic containing missing features.

[0023] S200, optimize the distribution structure of the data representation in the latent space through class center constraints, and output the data representation of each sample and the class center vector corresponding to each class; the original data sample is network traffic containing missing features.

[0024] S300: Using the data representation of the target category sample, the corresponding original features, and the category center vector as conditional inputs, a dual-space collaborative denoising generation framework is constructed. Joint denoising generation operations are performed in the latent space and the original feature space to obtain new latent space sample points of the target category.

[0025] S400, the latent space sample points of the new target category are mapped back to the original feature space through the feature reconstruction network to obtain new target category samples.

[0026] The category center constraint includes: using learnable category center vectors as reference benchmarks for each category, constraining the data representation of samples to cluster towards the reference benchmarks of the corresponding categories, and constraining the reference benchmarks of different categories to maintain a gap.

[0027] This invention addresses the challenge of tail-level category identification caused by a combination of class imbalance, class overlap, and feature loss in network traffic data. During the representation learning stage, it employs learnable mask embedding, random secondary occlusion, weighted partial reconstruction supervision, and dual-view techniques. Figure 1Consistency constraints enable end-to-end modeling of missing information without relying on external imputation methods, avoiding the propagation of imputation errors to downstream tasks. Simultaneously, class center constraints are constructed through intra-class aggregation loss, inter-class repulsion loss, and relative distance constraint loss, explicitly forming a compact intra-class and segregated inter-class discriminative structure in the latent space. This ensures minimal safety margins between data representations of different classes, mitigating class overlap from its source. Building upon this, the generation stage employs a dual-space collaborative denoising generation framework, performing collaborative denoising generation in both the latent and original feature spaces. Latent space loss constrains class semantics, while original space loss constrains the authenticity of data distribution, ensuring that the generated tail-class samples possess both class discriminative power and structural rationality. Theoretical analysis shows that the inter-class separation structure in the latent space maintains a strict lower bound on distance after being transferred to the original feature space under Lipshitz continuous mapping conditions, providing a theoretical guarantee for mitigating inter-class overlap in generated samples. In the diffusion sampling phase, by combining a continuous-time diffusion framework with a second-order numerical solver, the number of sampling steps is compressed to tens of steps, making the time complexity of the generation phase linearly related to the number of sampling steps and the complexity of a single network forward propagation. This significantly reduces the computational overhead compared to the thousands of iterative sampling steps of the traditional diffusion model.

[0028] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a flowchart of a network traffic data processing method provided in an embodiment of the present invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of this invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0033] It should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the steps as sequential processes, many of these steps can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the steps can be rearranged. A process can be terminated when its operation is complete, but it may also have additional steps not included in the figures. A process can correspond to a method, function, procedure, subroutine, subroutine, etc.

[0034] First Embodiment

[0035] This invention provides a network traffic data processing method to address the problems of class imbalance, class overlap, and feature loss described in the background art. The joint generation framework used in this embodiment consists of two parts: a center-contrast variational autoencoder (hereinafter referred to as the discriminative representation learning module) and a joint constraint-conditional diffusion model (hereinafter referred to as the dual-space collaborative denoising generation framework). The discriminative representation learning module performs discriminative representation learning on network traffic data containing missing features, outputting data representations for each sample and class center vectors for each category. The dual-space collaborative denoising generation framework uses the data representations and class center vectors output by the discriminative representation learning module as conditional inputs, and performs collaborative denoising generation in the latent space and the original feature space to obtain new target category samples. The following describes the process in conjunction with... Figure 1 Each step is described in detail.

[0036] like Figure 1 As shown, the method includes the following steps.

[0037] S100, Representation learning step: Input the original data sample into the feature encoding network, and use the masking mechanism to compensate for the missing information in the sample so that the feature encoding network outputs a consistent data representation under different missing modes.

[0038] This step is implemented by the discriminative representation learning module. In this embodiment, the feature encoding network and the feature reconstruction network constitute the discriminative representation learning module. The feature encoding network adopts a Transformer architecture to map the input network traffic samples to Gaussian distribution parameters in the latent space, namely the mean vector and the log-variance vector.

[0039] Specifically, let the input sample be the original feature vector. The feature encoding network first projects each feature of the input sample independently into a feature label through a linear mapping, with each feature label having a preset hidden dimension. For features with a first missing position, instead of filling in with a fixed value, the feature label at that position is replaced with a globally shared, learnable mask embedding, thus enabling the model to adaptively learn the optimal representation of the missing position during training.

[0040] For all feature labels, a feature encoding network adds learnable positional encodings to preserve the location information of each feature in the original samples. The feature labels and positional encodings are then added together and passed sequentially through multiple Transformer feature encoding network layers. Each layer contains a multi-head self-attention mechanism and a feedforward network. The multi-head self-attention mechanism captures global dependencies between different features, while the feedforward network performs non-linear transformations on the features at each location. Layers are connected via residual connections and layer normalization to mitigate the vanishing gradient problem in deep networks and accelerate training convergence.

[0041] After passing through multiple Transformer feature encoding network layers, the outputs of all feature labels are averaged over the feature dimension to obtain the global representation vector of the entire sequence. Finally, this global representation vector is input into two independent fully connected layers, which output the mean vector and log-variance vector of the latent variables, respectively. The dimensions of these two vectors are both preset latent space dimensions.

[0042] Through the above structure, the feature encoding network encodes input samples of dimension D in the original feature space into distribution parameters of dimension dz in the latent space, realizing a representational mapping from the original feature space to a continuous latent space. In an illustrative embodiment, when the latent space dimension dz is smaller than the original feature dimension D, this mapping can achieve dimensionality reduction, thereby reducing the data dimensionality while maintaining effective information. The feature reconstruction network also adopts the Transformer architecture to reconstruct the sampling points in the latent space into samples in the original feature space.

[0043] Specifically, let the sampled latent variables be vectors in the latent space. The feature reconstruction network first expands the latent variables into multiple initial labels through a linear mapping layer. The number of labels is the same as the dimension of the original features, and the dimension of each label is the preset latent dimension. Subsequently, learnable positional encodings are added to these initial labels to recover the original feature order corresponding to each position.

[0044] The initial labels, after adding positional encoding, are sequentially passed through multiple layers of a Transformer feature reconstruction network. Each layer contains a masked multi-head self-attention mechanism, a cross-attention mechanism, and a feedforward network. The masked multi-head self-attention mechanism establishes dependencies between currently generated partial features; the cross-attention mechanism uses the global representation output by the feature encoding network as keys and values, interacting semantic information in the latent space with the current feature reconstruction state of the feature reconstruction network, enabling the feature reconstruction network to fully utilize the global context information extracted by the feature encoding network during reconstruction; and the feedforward network performs nonlinear transformations on the features at each position. The layers are also connected through residual connections and layer normalization.

[0045] After reconstructing the network layers using multiple Transformer features, the outputs at each location are mapped back to the original feature dimensions through a linear mapping layer, resulting in reconstructed samples with the same dimensions as the input samples.

[0046] Through the above structure, the feature reconstruction network restores the low-dimensional latent variables in the latent space to complete samples in the original feature space, realizing the inverse mapping from the latent space to the original feature space.

[0047] The feature encoding network and the feature reconstruction network together constitute the discriminative representation learning module, and they are interconnected through a latent space. During the training phase, the feature encoding network maps the original samples to distribution parameters in the latent space, samples the latent variables from it, and inputs them into the feature reconstruction network, which reconstructs them into samples. The feature encoding network and the feature reconstruction network are jointly optimized through a reconstruction loss, so that the reconstructed samples output by the feature reconstruction network approximate the original input samples of the feature encoding network.

[0048] During the generation phase, the feature encoding network no longer participates. Instead, the diffusion model directly synthesizes new latent variables in the latent space, and then the feature reconstruction network maps them back to the original feature space to generate new samples.

[0049] In one illustrative embodiment, both the Transformer feature encoding network layer and the Transformer feature reconstruction network layer have 4 layers; the multi-head self-attention mechanism has 8 heads; the preset hidden dimension is 128, and the preset latent space dimension is 16. The dimension of the learnable mask embedding is the same as the preset hidden dimension. It should be understood that the above parameters are merely illustrative and do not constitute a limitation on the scope of protection of this invention.

[0050] This invention addresses anomaly behavior detection scenarios based on network traffic data and can be applied to network environments such as enterprise LANs, campus networks, data centers, and cloud platforms. The original data samples are network traffic feature data collected and extracted from these network environments. This network traffic feature data includes samples of at least two categories, and each category may contain samples with missing features. The missing feature corresponds to the first missing position in the original data sample caused by incomplete data collection. The category is the label type of the sample, including a normal category and multiple attack categories; wherein, samples corresponding to the normal category are network communication data without attack behavior, and samples corresponding to the attack category are network communication data containing attack behavior; the number of samples in each category constitutes the category distribution of the dataset. In network anomaly behavior detection scenarios, the number of samples in the normal category is usually much greater than that in the attack categories; therefore, the normal category is designated as the head category, and the attack categories as the tail categories.

[0051] In this embodiment of the invention, the network traffic characteristic data can be obtained in the following ways:

[0052] First, obtain raw network traffic data from the network environment. Specifically, this can be done by mirroring all traffic from a switch or router port and sending it to the analysis port; or by using a network splitter to obtain a copy of the traffic through physical splitting or replication; or by installing packet capture software on the server terminal device to capture the traffic of the local network card.

[0053] Then, feature extraction is performed on the acquired raw network traffic data. Specifically, traffic feature extraction tools can be used to extract statistical features of each network flow from the raw data packets to generate structured traffic feature data; flow records can also be directly obtained from network devices using network flow protocols; or network security monitoring frameworks can be used to perform in-depth analysis of network traffic to generate structured logs containing rich contextual information.

[0054] The network traffic characteristic data obtained after the above processing includes the following two types of information:

[0055] (a) Basic characteristics: including but not limited to network flow identification information, protocol type, network service type, source IP address, destination IP address, source port number, destination port number, flow duration, number of forward packets, number of backward packets, total number of forward bytes, and total number of backward bytes. Protocol types include but are not limited to TCP, UDP, ICMP, etc.; network service types include but are not limited to HTTP, HTTPS, SSH, DNS, etc.

[0056] (ii) Statistical characteristics: including but not limited to statistical values ​​of data packet length, data packet interval time, uplink and downlink data volume, and connection counts for a specific service or host. Statistical values ​​include maximum, minimum, mean, and variance.

[0057] Furthermore, the compensation process for missing information in the sample using a masking mechanism specifically includes:

[0058] S101, replace the feature representation of the first missing position with a learnable first mask embedding.

[0059] The original data samples are marked with a missing mask, and the original missing mask marking the first missing position is denoted as M. orig ∈{0,1} D Where D is the feature dimension of the original data sample, 1 indicates that the feature is a valid observation, and 0 indicates that it is truly missing. During the feature encoding stage, missing values ​​are not pre-impregnated; instead, a globally shared, learnable embedding vector, i.e., the first mask embedding e, is used. mask The feature representations of all first missing locations are replaced, thereby explicitly modeling missing patterns during representation learning, enabling the discriminative representation learning module to learn reasonable representations of missing locations end-to-end. mask The dimension of the embedding vector is dt, where dt is the dimension of the labeled vector after feature mapping. This embedding vector serves as a trainable parameter of the feature encoding network, and its value is continuously updated during network training using the backpropagation algorithm. After training convergence, the value stored in this embedding vector represents the globally shared missing location representation that optimizes the overall loss function of the network.

[0060] S102, in the feature dimensions of the original data sample, at the observable feature positions other than the first missing position, a second mask obtained by random sampling is used for secondary occlusion to construct an incomplete input view.

[0061] To enhance the discriminative representation learning module's ability to infer missing features, a random occlusion mechanism is further introduced during the training phase. Specifically, a second mask M is obtained by independently sampling random masks along the feature dimension based on a Bernoulli distribution. art ∈{0,1} D In the feature dimensions of the original data sample, secondary occlusion is performed at observable feature locations other than the first missing location to construct a more incomplete input view. The occluded locations in the second mask constitute the second missing location. The discriminative representation learning module actually receives a visible mask of M. input =M orig ⊙M art , where ⊙ represents element-wise product.

[0062] As training iterates, different features are randomly occluded, enabling the discriminative representation learning module to learn stable semantic representations from diverse missing patterns. This strategy allows the discriminative representation learning module to learn the global semantic structure of the data based on more limited contextual information.

[0063] S103 performs weighted reconstruction supervision on the reconstruction output of the feature reconstruction network.

[0064] During the decoding phase, a weighted partial reconstruction strategy is employed to supervise the reconstruction of the input view. This involves simultaneously constraining the reconstruction of both artificially occluded and visible regions, assigning different weight coefficients to each. The visible region refers to the location in the input view that is not covered by any mask, i.e., the actual observable feature location in the input view. The artificially occluded region refers to the location in the input view that is randomly occluded by the second mask, but whose corresponding position in the original data sample is actually a valid observation; that is, this position is not marked as a true missing location by the first missing location. In other words, the artificially occluded region is the second missing location, i.e., the location that is occluded twice but whose original value is actually known. Since the feature value of this region is masked in the input view, but the true value is available during network training, it can be used to effectively supervise the reconstruction capability of the feature encoding network. The unoccluded locations include the visible region and the first missing location.

[0065] This invention assigns higher supervision weights to artificially occluded areas than to unoccluded areas, enabling the network to focus on masked areas with known labels during training, thereby enhancing the network's ability to recover from missing local features and its robustness.

[0066] Among them, the mask M corresponding to the second missing position target Defined as: M target =M orig ⊙(1-M art ).

[0067] The reconstruction loss used in the weighted reconstruction supervision is a weighted reconstruction loss, which includes a first term and a second term. The first term is the squared reconstruction error of the artificially occluded area, and the second term is the product of the squared reconstruction error of the visible area and a preset weight coefficient.

[0068] The reconstruction loss is mathematically represented as: .

[0069] Where x represents the original input feature. M is the reconstructed output of the feature reconstruction network. input =M orig ⊙M art The visible mask corresponding to the input view is θ, which is a preset weight coefficient. In an illustrative embodiment, θ = 0.1. The artificially occluded region provides the main supervision signal, driving the model to learn the ability to infer missing values; the visible region provides weak constraints to prevent the feature reconstruction network from generating structural shifts, thereby ensuring the stability of the decoding mapping while maintaining the mask reconstruction characteristics.

[0070] Through the aforementioned weighted partial reconstruction supervision, the feature reconstruction network learns the ability to recover complete features from partial observed features, enabling the network's reconstruction output to approximate the original input in artificially occluded areas.

[0071] S104, apply consistency constraints to the first data representation obtained by the feature encoding network of the original data sample and the second data representation obtained by the feature encoding network of the input view, so as to obtain a data representation that is consistent with different missing patterns.

[0072] The latent space is a low-dimensional representation space obtained by the feature encoding network after compressing and abstracting samples in the original feature space. The latent space and the original feature space are mapped to each other through the feature encoding network and the feature reconstruction network, wherein the feature encoding network maps samples in the original feature space to data representations in the latent space, and the feature reconstruction network maps data representations in the latent space back to samples in the original feature space.

[0073] To further improve the stability of data representation to missing perturbations, a dual-view approach is introduced. Figure 1 Consistency constraint. Specifically, the original data samples containing only the original missing data are input into the feature encoding network to obtain the first distribution center parameter μ. clean That is, the first data representation; simultaneously, the input view constructed through two random occlusions is input into the feature encoding network to obtain the second distribution center parameter μ. masked This refers to the second data representation. The first and second data representations are represented as two specific coordinate points in the latent space of the same original data sample under different missing views. By constraining the consistency of the two in the latent space, the data representations output by the feature encoding network under different missing modes tend to be consistent, thus obtaining a data representation that is consistent across different missing modes.

[0074] The consistency constraint loss is the squared Euclidean distance between the first data representation and the second data representation, wherein the gradient of the first data representation is truncated to zero during backpropagation, causing the second data representation to unidirectionally converge towards the first data representation. The latent space consistency constraint loss function L is used for the consistency constraint loss function. cons Mathematically, this can be expressed as: .

[0075] Here, sg(·) denotes stopping the gradient operation, meaning that the value is calculated normally during forward propagation, but the gradient is truncated to zero during backward propagation. This consistency constraint blocks the gradient propagation from the second latent vector representation to the first latent vector representation, ensuring that only the second latent vector representation moves closer to the first latent vector representation. This drives the data representation output by the feature encoding network to remain consistent under different missing modes, thereby enhancing the stability of the data representation under missing modes.

[0076] In this invention, the term "missing pattern" refers to the specific distribution of which feature locations are missing in a sample. This invention relates to two types of missing patterns: the first missing pattern is the feature loss that naturally occurs during data acquisition, i.e., the original loss; the second missing pattern is the artificial loss formed after randomly applying secondary occlusion to observable features. Because the mask used for random sampling is different in each training iteration, the second missing pattern changes dynamically with training.

[0077] In this invention, ensuring consistent data representation output by the feature encoding network under different missing feature patterns means that for the same original sample, regardless of the missing feature pattern it presents when input to the feature encoding network (i.e., original missing feature or different artificially added missing features), the data representation output by the feature encoding network should be consistent. This means the data representation reflects the semantic content of the sample itself, such as traffic category and behavioral characteristics, and is unaffected by the distribution of missing feature locations. In other words, the feature encoding network is trained to be invariant to missing feature patterns; the type and quantity of missing features should not change the network's encoding of the sample's essential information, thus achieving robust encoding of missing features.

[0078] In one illustrative embodiment, the discriminative representation learning module is trained in an end-to-end manner. Batch samples are randomly sampled from the training dataset, each sample containing the original feature vector and its corresponding missing mask. For each sample in the batch, the feature representation at the first missing location is replaced with a learnable mask embedding, and a second mask is randomly sampled at the observable feature locations to construct a secondary occlusion input view. The original samples and the input view are respectively input into the feature encoding network to obtain the corresponding first and second data representations. Latent variables are sampled from the distribution of the first data representation and input into the feature reconstruction network to obtain reconstructed samples. The total loss L is calculated. Total The parameters of the feature encoding network and the feature reconstruction network are updated through backpropagation. The optimizer used is Adam, with an initial learning rate of 10. -4 The batch size is set to 128, the maximum number of training rounds is set to 500, and an early stopping mechanism is adopted, which stops training when the validation set loss does not decrease for 20 consecutive rounds.

[0079] It should be noted that S103 and S104 are two independent constraints executed in parallel. They are independent of each other and each provides gradient signals during the training of the discriminative representation learning module, collaboratively optimizing the feature encoding network and the feature reconstruction network. Specifically, S103 drives the feature reconstruction network to learn the ability to recover complete features from partially observed features through reconstruction loss; S104 drives the feature encoding network to learn data representations that are insensitive to different missing patterns through consistency loss. Together, they ensure the robustness of the discriminative representation learning module when faced with missing data.

[0080] S200 optimizes the distribution structure of the data representation in the latent space through class center constraints, and outputs the data representation of each sample and the class center vector corresponding to each class.

[0081] This step is the category center constraint optimization process in the discriminative representation learning module. The category center constraint is implemented through a first-type loss function, which includes intra-class aggregation loss, inter-class repulsion loss, and relative distance constraint loss. Specifically, the intra-class aggregation loss constrains the data representation of samples to converge towards the category center vector of their corresponding class, thereby reducing the distribution radius of similar samples in the latent space and improving intra-class compactness. The intra-class aggregation loss L... pull Defined as: .

[0082] The inter-class repulsion loss is used to constrain the class center vectors of different classes to maintain a minimum safe distance, so as to avoid the prototype centers of different classes from converging or even collapsing in the latent space, and to ensure clear class boundaries. Inter-class repulsion loss L push Defined as:

[0083] .

[0084] The relative distance constraint loss is used to constrain the distance of a sample to its own class center vector to be less than its distance to other class center vectors, thereby further enhancing inter-class separability from the perspective of relative distance. This makes each sample in the latent space closer to the class center vector of its own class and farther away from the class center vectors of other classes. Relative distance constraint loss L cc Defined as:

[0085] .

[0086] Where B is the batch size, K is the total number of categories, and z i For the data representation of the i-th sample, c y（i） Let c be the class center vector of the class y(i) to which the i-th sample belongs. k and c j Let be the class center vectors of class k and class j, respectively, m be the minimum safety margin, i be in the range of 1 to B, k and j be in the range of 1 to K, and ||·||2 be the L2 norm.

[0087] Through the joint constraints of intra-class aggregation loss, inter-class repulsion loss, and relative distance constraint loss, the class center constraint optimizes the distribution structure of the data representation output by the feature encoding network in the latent space. Specifically, the intra-class aggregation loss directly pulls the data representation of a sample toward its class's reference benchmark, reducing the distribution radius of similar samples in the latent space and achieving intra-class compactness; the inter-class repulsion loss directly pushes apart reference benchmarks of different classes, ensuring that reference benchmarks of different classes maintain a minimum safe interval and avoiding blurring of inter-class boundaries; the relative distance constraint loss, at the individual sample level, forces that the distance of each sample to its own class's reference benchmark be strictly less than its distance to other class reference benchmarks, further strengthening inter-class boundaries. Under the synergistic effect of these three factors, the data representations of similar samples cluster toward the same reference benchmark, reference benchmarks of different classes move away from each other, and sample clusters of different classes are separated by a minimum safe interval.

[0088] During the training process of the feature encoding network, the three loss functions mentioned above are used to propagate gradients to the network's parameters through backpropagation, gradually adjusting the distribution structure of the data representation to achieve the aforementioned optimization effect. After optimization by the class center constraint, the data representation of each sample and the corresponding class center vector for each class are output. The class center vector also serves as a reference benchmark for each class, guiding the subsequent generation stage.

[0089] The overall optimization objective of the discriminative representation learning module is L. total The data representation is constrained by both a first-type loss function and a second-type loss function. The first-type loss function constrains the data representation to form a compact intra-class and separated inter-class distribution structure in the latent space; the second-type loss function includes:

[0090] Reconstruction loss is used to measure the difference between the reconstructed sample output by the feature reconstruction network and the original input sample;

[0091] KL divergence loss is used to constrain the difference between the data representation distribution output by the feature encoding network and the preset prior distribution;

[0092] The consistency constraint loss is used to constrain the data representation output by the feature encoding network to remain consistent under different missing modes.

[0093] In this embodiment, the preset prior distribution can be a standard normal distribution, and the KL divergence loss L KL The calculation formula can be:

[0094] .

[0095] in, Let r be the value of the r-th dimension in the mean vector of the data representation distribution of the input sample in the latent space. Let r be the value of the r-th dimension of the variance vector of the data representation distribution of the input sample in the latent space.

[0096] The overall optimization objective L of the discriminative representation learning module total The mathematical representation of L is: total =L Recon +β·L KL +λ1·L pull +λ2·L push +λ3·L cc +γ·L cons Where β,λ1,λ2,λ3,γ are the balancing hyperparameters for each loss term. Each balancing hyperparameter is preset according to the numerical magnitude of each loss term, training stability requirements, and empirical settings, and remains fixed during training.

[0097] S300, Generation Steps: Using the data representation of the target category sample, the corresponding original features, and the category center vector as conditional inputs, construct a dual-space collaborative denoising generation framework, perform joint denoising generation operations in the latent space and the original feature space, and obtain new latent space sample points of the target category.

[0098] The latent space sample point refers to the latent variable position corresponding to the target class sample obtained in the latent space through denoising sampling. It has the same spatial meaning as the data representation obtained by mapping the real sample through the feature encoding network, but the sources are different. The data representation comes from the encoding mapping of the real sample, while the latent space sample point comes from the denoising generation of the diffusion model.

[0099] This generation step is implemented using a joint constraint diffusion model. To further improve the generation quality of tail category samples, this paper introduces a dual-space collaborative denoising generation framework based on discriminative representation learning. Unlike the traditional method of diffusion in only a single space, the dual-space collaborative denoising generation framework performs joint constraint modeling in both the latent space and the original feature space, and uses the category prototypes learned by the discriminative representation learning module as conditional information, thereby simultaneously constraining the category semantics and feature distribution during the generation process.

[0100] The target category sample is a tail category attack sample in the network abnormal behavior detection scenario; the new target category sample is a new tail category attack sample.

[0101] The dual-space collaborative denoising generation framework includes a cross-space denoising network, which consists of a cross-space feature fusion module and two independent output heads.

[0102] Specifically, the cross-spatial feature fusion module mainly consists of a linear mapping layer, an embedding layer, a concatenation layer, and a multilayer perceptron. The linear mapping layer projects noisy original features and noisy latent variables onto a unified feature dimension; the embedding layer converts the diffusion time step into a time step embedding vector and the class prototype vector into a class conditional embedding vector; the concatenation layer concatenates these vectors along the channel dimension; and the multilayer perceptron performs nonlinear fusion on the concatenated features, outputting the fused features.

[0103] The two independent output heads refer to two independent prediction branches connected to the fused features. These two independent output heads are different from the attention heads in multi-head attention mechanisms. Specifically, the first output head predicts the denoising result in the original feature space, and its output dimension is consistent with the original network traffic feature dimension. The second output head predicts the denoising result in the latent space, and its output dimension is consistent with the latent space dimension. Each of the two independent output heads contains a fully connected layer, and their parameters are not shared; they are used for denoising prediction in the original space and latent space, respectively.

[0104] The dual-space collaborative denoising generation framework is trained after the discriminative representation learning module is trained, using the tail category sample data representation, corresponding original features, and category prototypes output by the discriminative representation learning module as training data.

[0105] Specifically, the dual-space collaborative denoising generation framework performs the following operations during training:

[0106] S301, Gaussian noise is injected into the latent space and the original feature space respectively to obtain noisy latent variables and noisy original features.

[0107] The injected Gaussian noise refers to adding randomly sampled Gaussian noise to the original input feature x and its corresponding data representation z during the training process of the diffusion model, so as to temporarily construct noisy training samples.

[0108] Specifically, for the original feature space, first randomly sample a Gaussian noise ε with the same dimension as x. x , and ε x It follows a standard normal distribution N(0,I), where 0 is the mean vector and I is the identity matrix, meaning each dimension is independent with a mean of 0 and a variance of 1. Then, the noisy original feature x is obtained according to the current noise scale σ. σ :

[0109] x σ =x+σ·ε x .

[0110] For the latent space, first randomly sample a Gaussian noise ε with the same z-dimensional dimension. z , and εz It follows a standard normal distribution N(0,I), and then the noisy latent variable z is obtained according to the current noise scale σ. σ :

[0111] z σ =z+σ·ε z .

[0112] σ is determined according to a preset noise scheduling strategy. Since the original feature space and the latent space have different dimensions, Gaussian noise of the corresponding dimensions is sampled for both.

[0113] Subsequently, the joint constraint diffusion model uses x σ z σ Using diffusion time-step embedding and category-conditional embedding as inputs, the system learns to recover the original input features x and data representation z from noisy states.

[0114] S302, the noisy latent variable, noisy original feature, diffusion time step embedding and category prototype conditional embedding are fused across space to obtain fused features, and the fused features are respectively input into two independent output heads, which output latent space denoised prediction value and original space denoised prediction value respectively.

[0115] The diffusion time step embedding is used to characterize which time stage the current sample is in the diffusion denoising process. Specifically, the diffusion time step t or noise scale σ is input into a sinusoidal positional encoder, a learnable embedding layer, or a multilayer perceptron to obtain a time vector representation consistent with the hidden dimensions of the cross-spatial denoising network. This embedding enables the denoising network to perceive the current noise intensity, thereby adaptively adjusting the prediction strategy according to the current denoising progress.

[0116] Category prototype conditional embedding is used to represent target category information. Specifically, the category prototype vector learned by the discriminative representation learning module is used as input and mapped through a linear mapping layer or a multilayer perceptron to a conditional vector consistent with the hidden dimension of the cross-space denoising network. This category prototype conditional embedding guides the denoising generation process toward the specified target category, giving the generated samples a clear category semantics.

[0117] In this context, embedding refers to converting information such as time steps and category prototypes into a vector representation that can be processed by the neural network. The embedding parameters are automatically learned through the model training process, rather than being fixed features specified manually. The diffusion time step embedding and the category prototype conditional embedding are used to enable the denoising network to perceive the current denoising stage and target category information, respectively. They are concatenated with noisy features in the channel dimension and jointly input into the cross-space denoising network.

[0118] To achieve controllable category generation, for a sample labeled y, the category prototype c learned by the discriminative representation learning module is used. yAs a conditional vector, the category prototype conditional embedding is obtained after linear mapping. This embedding, along with the diffusion time step embedding, is input into the cross-spatial denoising network, thereby explicitly introducing discriminative structural information into the generation process.

[0119] The cross-spatial feature fusion is achieved through a cross-spatial feature fusion module, specifically including the following steps:

[0120] (1) After projecting the noisy latent variables and the noisy original features onto a unified feature space through the first linear mapping matrix and the second linear mapping matrix respectively, they are concatenated with the diffusion time step embedding and the category prototype conditional embedding in the channel dimension. The concatenated feature vector is then subjected to a nonlinear transformation by a multilayer perceptron to obtain the fused feature h. fuse :h fuse =MLP([W x ·x σ ||W z ·z σ ||t emb ||c emb ]).

[0121] Among them, t emb For diffusion time step embedding, c emb For category prototype conditional embedding, || represents channel concatenation, MLP is a multilayer perceptron, W x and W z Let be the first linear mapping matrix and the second linear mapping matrix, respectively, representing the linear mapping matrices of the original feature space and the latent space, used to map the noisy original feature x. σ and noisy latent variable z σ This is mapped to a unified feature dimension so that it can be subsequently concatenated and fused with temporal step embeddings and category conditional embeddings along the channel dimension. The aforementioned linear mapping matrix consists of trainable weight parameters in the neural network, which are randomly initialized at the start of training and automatically updated and determined through backpropagation during the training of the dual-space collaborative denoising generation framework.

[0122] The fused features are mapped back to the original space and the latent space through two independent output heads, respectively, to obtain the original space denoised prediction value and the latent space denoised prediction value.

[0123] S303, using the error between the latent space denoised prediction value and the real latent variable, and the error between the original space denoised prediction value and the real original feature, a joint denoising loss function is constructed, while simultaneously constraining the denoising prediction of the two spaces, namely the latent space and the original feature space.

[0124] The joint denoising loss function is: .

[0125] L JCCDMThe joint denoising loss function is defined by λ(σ), which is a weighting function related to the noise scale. In this embodiment, λ(σ) is a constant of 1, meaning that the denoising loss at different noise scales uses the same weight. In other embodiments, λ(σ) can be set as a weighting function that varies with σ according to different noise intensities, used to adaptively adjust the contribution of the loss at each noise step. Δ is the balance coefficient between the original feature space and latent space losses, used to adjust the model's emphasis on the denoising prediction errors of the two spaces; x p and z p These are the original space denoised prediction value and the latent space denoised prediction value, respectively. E[·] is the mathematical expectation symbol, representing the expected value of the random variable within the brackets, that is, averaging the loss over the entire training data distribution.

[0126] Within this joint optimization framework, the latent space loss is primarily responsible for learning category semantics, while the original space loss constrains the generated results to conform to the real data distribution, thereby preventing the generated samples from deviating from the original feature space. By appropriately setting the balance coefficient, a dynamic balance can be achieved between maintaining the original data topology to ensure the authenticity of the generated samples and introducing discriminative semantics from the latent space to improve the clarity of tail category boundaries.

[0127] Furthermore, the cross-spatial denoising network outputs the original spatial denoising prediction value and the latent space denoising prediction value during the training phase; during the sampling phase, the cross-spatial denoising network outputs the noise prediction value, which are different output forms of the same network in different modes.

[0128] The sampling process of the dual-space collaborative denoising generation framework is a multi-step iterative process. During the sampling process, the category center vector is used as conditional information, and conditional sampling is performed through a classifier-free guidance strategy to generate new latent space sample points of the target category.

[0129] During the training phase, the conditional prototype is replaced with an empty label with a preset probability, so that the dual-space collaborative denoising generation framework can learn both conditional and unconditional distributions at the same time. The preset probability ranges from 10% to 20%, preferably 10%.

[0130] During the sampling phase, starting with standard Gaussian noise, each step uses the cross-spatial denoising network to predict the noise in the current noisy sample, obtaining the predicted noise. Then, the predicted noise is subtracted from the current noisy sample to obtain a cleaner sample. After multiple iterations, the Gaussian noise is gradually restored to the clean latent variables of the target class.

[0131] During the sampling phase, each denoising step is guided by a linear combination of conditional and unconditional predictions:

[0132] P n =P φ+w·(P c -P φ ).

[0133] Among them, P n The prediction results after classifier-free guidance are used to update noisy samples in the current denoising step. P φ P represents the noise prediction output of the denoising network under unconditional conditions, meaning the denoising network doesn't know which category of sample to generate and only makes noise predictions based on the noisy input itself. c The output noise prediction value of the denoising network is given under the condition of class prototype. w is the guiding strength coefficient, with a value greater than 1. This strategy enhances the class consistency of the generated results by adjusting the degree of influence of conditional information. By adjusting the value of the guiding strength coefficient, the influence of conditional information on the generation process is controlled; the larger the value of w, the stronger the consistency between the generated samples and the target class.

[0134] S400, Decoding step: Map the latent space sample points of the new target category back to the original feature space through the feature reconstruction network to obtain new target category samples.

[0135] The decoding step is implemented through the feature reconstruction network of the discriminative representation learning module. During the generation phase, the feature reconstruction network restores the latent variables sampled from the latent space to complete samples in the original feature space, which retain the semantic features of the target category.

[0136] Furthermore, the inter-class separation structure formed in the latent space through the contrastive constraints of the discriminative representation learning module and the classifier-free guidance strategy maintains a strict lower bound on distance after being mapped back to the original feature space, thus effectively mitigating inter-class overlap between generated samples. The theoretical derivation is as follows:

[0137] From a probabilistic perspective, after introducing a classifier-free guidance strategy, the equivalent distribution of actual sampling in the diffusion model... It can be represented as: .

[0138] Here, p(z|c) and p(z) represent the conditional and unconditional probability distributions learned by the diffusion model in the latent space, respectively. This mechanism compresses the variance of the conditional distribution, making the generated latent variable z more concentrated in the neighborhood of the corresponding class prototype, thereby significantly reducing the probability of cross-class generation in the latent space.

[0139] Building upon this, the large-margin contrast constraint introduced by the discriminative representation learning module further ensures that the representations of different classes of data satisfy: ||z u -z v ||2≥m,u≠v。 z u and z vThese represent the data representations of categories u and v, respectively. In other words, the different categories in the latent space are explicitly separated, forming a discriminative structure with clear boundaries.

[0140] Furthermore, the key to mitigating overlap in sample generation lies in the stability of the mapping process. Let the feature encoding network and the feature reconstruction network be f, respectively. enc with f dec Given that a conventional neural network consists of bounded weights and continuous activation functions, the feature encoding network can be approximated as a Lipshitz continuous mapping, i.e., there exists a constant L > 0 such that: ||f enc (x u )-f enc (x v )||2≤L||x u -x v ||2.

[0141] In the generation phase, the dual-space collaborative denoising generation framework first synthesizes latent variables in the latent space. The reconstructed output is obtained through a feature reconstruction network. Because the discriminative representation learning module has good reconstruction consistency, ≈f enc ( From this, we can obtain: . and The latent variables are categories u and v, respectively. and These are the reconstruction outputs for categories u and v, respectively.

[0142] Combining the Lipschitz continuity condition, we can deduce that:

[0143] .

[0144] Further substituting the large-space constraint of the latent space ||z u -z v ||2≥m, therefore:

[0145] .

[0146] The inequality theoretically shows that the inter-class separation structure formed in the latent space by contrast constraints and classifier-free guidance strategies can still maintain a strict lower bound on distance after being mapped back to the original feature space, thus effectively alleviating inter-class overlap between generated samples.

[0147] In summary, the dual-space collaborative denoising generation framework achieves effective control over the generation process by jointly modeling in the latent space and the original feature space, and combining class prototype conditions with guided sampling strategies. Simultaneously, the synergistic effect of conditional distribution constraints, large-margin discriminative structures, and mapping stability mitigates the class overlap problem from the generation mechanism perspective.

[0148] Furthermore, the method also includes:

[0149] The new tail category attack samples are combined with the original network traffic training set to form an enhanced training set. The enhanced training set is used to train an abnormal behavior detection classification model, and the abnormal behavior detection classification model is used to classify and detect network traffic.

[0150] Specifically, the newly generated tail-category attack samples are merged with the original training set to form an augmented training set. When training the downstream abnormal behavior detection classification model on the augmented training set, the input is the augmented network traffic feature data, and the output is the predicted label of normal or attack category. The cross-entropy loss function is used for optimization, and after training, it is used to predict the category of the network traffic to be detected.

[0151] Furthermore, the joint generation framework used in this embodiment is analyzed from the perspective of computational complexity.

[0152] In the discriminative representation learning module, both the feature encoding network and the feature reconstruction network are based on the Transformer architecture. If the original feature dimension is D and the feature label dimension is dt, then the time complexity of a single-layer self-attention mechanism is O(D). 2 The feature encoding network and the feature reconstruction network each contain N layers of attention structures, and their overall complexity is O(N·D). 2 Furthermore, the complexity of a single-layer feedforward network is O(D·(dt)). 2 In practical applications, since the feature sequence length of network traffic data is usually limited, the above computational overhead is relatively small and usually does not become a major performance bottleneck.

[0153] During the diffusion training phase, the diffusion model employs a time-step random sampling mechanism, meaning that forward and backward propagation is performed only on a single random time step at a time. Let the complexity of a single forward propagation of the joint denoising network be O(Net), and the total number of training iterations be Ttrain. Then, the overall complexity of the diffusion training phase is O(Ttrain·Net). This embodiment uses a joint modeling strategy to perform collaborative denoising in both the latent space and the original feature space, and achieves information exchange through a shared backbone network. The overall computational complexity is linearly related to the single network forward propagation, maintaining the same complexity metric as the standard diffusion model. Net refers to the computational cost required for the cross-space denoising network in the dual-space collaborative denoising generation framework to perform a complete denoising prediction.

[0154] In the diffusion sampling phase, traditional diffusion models typically perform hundreds to thousands of Markov iterations in the original feature space, resulting in a time complexity of O(Tsample·Net) and high sampling computational overhead. In contrast, this embodiment performs the diffusion process in the smooth, continuous latent space constructed by the discriminative representation learning module, effectively reducing the difficulty of modeling the data distribution. Furthermore, by combining the EDM continuous-time frame with a second-order Heun numerical solver, the number of sampling steps is compressed to Tsample (typically tens of steps). Considering that the second-order solver typically requires two network function evaluations at each step, the total number of function evaluations is approximately 2·Tsample. Therefore, the overall complexity of the generation phase can be expressed as O(Tsample·Net), which is linearly related to the number of sampling steps. Tsample refers to the total number of iterations performed by the diffusion model in the sampling phase (generation phase), i.e., the number of denoising steps required to gradually restore the target latent variable from Gaussian noise.

[0155] In summary, compared to the large-scale iterative sampling process of traditional diffusion models, this embodiment significantly reduces computational overhead while ensuring generation quality, demonstrating higher sampling efficiency.

[0156] This paper addresses the complex data distribution problem in network anomaly detection, which is caused by feature loss, class imbalance, and class overlap. It proposes a tail-class generation framework that integrates discriminative representation learning and joint diffusion modeling. In the representation learning stage, this framework introduces mask self-supervised reconstruction and center-contrast constraints. In the generation stage, it constructs a conditional diffusion mechanism that collaboratively models the latent space and the original feature space.

[0157] Compared with existing methods, the technical advantages of this method are mainly reflected in the following aspects:

[0158] (a) Representation Learning Level

[0159] The mask-based self-supervised reconstruction mechanism adaptively handles missing features during training, eliminating the need for two-stage imputation using external methods and preventing the propagation of imputation errors to downstream tasks. Simultaneously, center-contrast constraints (intra-class aggregation loss, inter-class repulsion loss, and relative distance constraint loss) explicitly construct a compact intra-class and separated inter-class discriminative structure in the latent space. This structure ensures that data representations of different classes are separated by a minimum safe interval in the latent space, providing a semantic foundation with clear class boundaries for subsequent generation stages.

[0160] (ii) Missing Feature Processing Level

[0161] Unlike the traditional two-stage processing paradigm that pre-impacts missing values ​​before using them in subsequent tasks, this method achieves end-to-end modeling of missing information in the representation learning process through learnable mask embedding to replace feature representations at missing locations, constructing incomplete input views through random secondary occlusion, weighted partial reconstruction supervision, and consistency constraints in the dual-view latent space. This enables the learning of robust semantic representations directly from the original data containing missing values, without relying on external imputation methods.

[0162] (III) Generation Quality Level

[0163] A dual-space collaborative denoising generation framework is employed to perform collaborative denoising generation in both the latent and original feature spaces. The latent space loss is responsible for learning the category semantics, while the original space loss constrains the generated results to conform to the real data distribution. Together, they ensure that the generated tail-class samples possess both clear category semantics and maintain the statistical properties of the original feature space. Theoretical analysis shows that the inter-class separation structure formed by contrast constraints in the latent space, under the Lipshitz continuous mapping condition, still maintains a strict lower bound on distance when transferred to the original feature space, thus mitigating inter-class overlap between generated samples to some extent.

[0164] (iv) Mitigation of overlapping categories

[0165] By combining a classifier-free guidance strategy with enhanced conditional information during the sampling phase, the class consistency of generated samples is further improved. Theoretical derivation shows that this mechanism compresses the variance of the conditional distribution, making the generated latent variables more concentrated in the neighborhood of the corresponding class prototype. Simultaneously, the large-margin discriminative structure in the latent space is transferred to the original feature space through a stable mapping of the feature reconstruction network, providing a theoretical guarantee for mitigating class overlap in generated samples.

[0166] (v) Computational efficiency

[0167] Time complexity analysis shows that our method, by combining the EDM continuous-time frame with a second-order Heun numerical solver in the diffusion sampling stage, compresses the number of sampling steps to tens. The overall complexity O(Tsample·Net) of the generation stage is linearly related to the number of sampling steps. Compared to the traditional diffusion model, which performs hundreds to thousands of iterations in the original feature space, the computational cost is reduced.

[0168] Second Embodiment

[0169] This invention also provides a network traffic data processing apparatus, which is based on the same inventive concept as the method embodiments described above and is capable of implementing the network traffic data processing method described in any of the embodiments above. The apparatus includes:

[0170] (a) Discriminative Representation Learning Module

[0171] The discriminative representation learning module includes a feature encoding network and a feature reconstruction network, which are used to learn representations of network traffic samples containing missing features.

[0172] The discriminative representation learning module specifically includes:

[0173] The missing information processing unit is used to compensate for missing information in the samples through a masking mechanism. Specifically, it replaces the feature representation of the first missing location with a learnable first mask embedding; at observable feature locations other than the first missing location, it performs secondary occlusion with a randomly sampled second mask to construct an incomplete input view; it performs weighted reconstruction supervision on the reconstruction output of the feature reconstruction network, wherein the supervision weight of the second missing location is greater than the supervision weight of the non-occluded location; and it applies a consistency constraint to the first data representation obtained by the feature encoding network from the original data samples and the second data representation obtained by the feature encoding network from the input view, so that the data representation output by the feature encoding network remains consistent under different missing modes.

[0174] The prototype contrastive learning unit is used to optimize the latent space structure by using learnable class center vectors as reference benchmarks for each class through intra-class aggregation loss, inter-class repulsion loss and relative distance constraint loss. This allows the data representations of samples of the same class to converge toward the reference benchmarks of the corresponding class, while maintaining the minimum safe interval between reference benchmarks of different classes. The unit outputs the data representations of each sample and the corresponding class center vectors of each class.

[0175] (II) Dual-space collaborative denoising generation framework module

[0176] The dual-space collaborative denoising generation framework module includes a cross-space denoising network, which consists of a cross-space feature fusion module and two independent output heads. It is used to perform collaborative denoising generation in the latent space and the original feature space, using the data representation of the target class samples, the corresponding original features, and the class center vector as conditional inputs, to obtain new latent space sample points of the target class.

[0177] The dual-space collaborative denoising generation framework module performs joint spatial diffusion and conditional modeling, cross-space feature fusion and denoising prediction during the training phase, and constrains the denoising prediction values ​​of the two spaces through a joint denoising loss function; during the sampling phase, the class center vector is used as conditional information, and conditional sampling is performed through a classifier-free guidance strategy to generate new latent space sample points of the target class.

[0178] (III) Decoding and Mapping Module

[0179] The decoding mapping module uses the feature reconstruction network of the discriminative representation learning module to map the latent space sample points of the target category generated by the dual-space collaborative denoising generation framework module back to the original feature space, thereby obtaining new target category samples.

[0180] (iv) Enhance the training set construction module

[0181] The enhanced training set construction module is used to combine the generated target category samples with the original training set to form an enhanced training set, use the enhanced training set to train the abnormal behavior detection model, and use the abnormal behavior detection model to classify and detect network traffic.

[0182] The discriminative representation learning module passes the data representation of each sample and the class center vector corresponding to each class to the dual-space collaborative denoising generation framework module; the dual-space collaborative denoising generation framework module passes the generated latent space sample points of the target class to the decoding mapping module; the decoding mapping module passes the generated target class samples to the enhanced training set construction module.

[0183] For details on the specific implementation of each of the above modules, please refer to the Method Implementation Examples section, which will not be repeated here.

[0184] This invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being configured to perform the method described in this invention.

[0185] This invention also provides a computer-readable storage medium storing computer-executable instructions for performing the methods described in this invention.

[0186] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this invention can be achieved, and this is not limited herein.

[0187] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for processing network traffic data, characterized in that, The method includes the following steps: S100, the original data sample is input into the feature encoding network, and the missing information in the sample is compensated through a masking mechanism so that the feature encoding network outputs a consistent data representation under different missing modes; the original data sample is network traffic containing missing features. S200, optimize the distribution structure of the data representation in the latent space through class center constraints, and output the data representation of each sample and the class center vector corresponding to each class; S300, using the data representation of the target category sample, the corresponding original features, and the category center vector as conditional inputs, construct a dual-space collaborative denoising generation framework, perform joint denoising generation operations in the latent space and the original feature space, and obtain new latent space sample points of the target category; S400, the latent space sample points of the new target category are mapped back to the original feature space through the feature reconstruction network to obtain new target category samples; The category center constraint includes: using learnable category center vectors as reference benchmarks for each category, constraining the data representation of samples to cluster towards the reference benchmarks of the corresponding categories, and constraining the reference benchmarks of different categories to maintain a gap. The missing feature corresponds to the first missing position in the original data sample caused by missing data collection; The step of compensating for missing information in samples using a masking mechanism, ensuring that the feature encoding network outputs consistent data representations under different missing patterns, specifically includes: The feature representation of the first missing location is replaced with a learnable first mask embedding; In the feature dimensions of the original data sample, at the observable feature locations other than the first missing location, a second mask obtained by random sampling is used for secondary occlusion to construct an incomplete input view. The occluded locations in the second mask constitute the second missing location. The reconstruction output of the feature reconstruction network is subjected to weighted reconstruction supervision, wherein the supervision weight of the second missing position is greater than the supervision weight of the non-occluded position; A consistency constraint is applied to the first data representation obtained by the feature encoding network from the original data sample and the second data representation obtained by the feature encoding network from the input view, so as to obtain a data representation that is consistent with different missing patterns. The category center constraint is implemented through a first type of loss function, which includes intra-class aggregation loss, inter-class repulsion loss, and relative distance constraint loss. The intra-class aggregation loss is used to constrain the data representation of samples to converge toward the class center vector of the corresponding class, so as to reduce the distribution radius of samples of the same class in the latent space. The inter-class repulsion loss is used to constrain the minimum safe interval between the class center vectors of different classes; The relative distance constraint loss is used to constrain the distance of a sample to its own class center vector to be less than the distance to other class center vectors.

2. The method according to claim 1, characterized in that, The feature encoding network and the feature reconstruction network constitute a discriminative representation learning module. The overall optimization objective of the discriminative representation learning module is constrained by a first type of loss function and a second type of loss function, wherein the second type of loss function includes: Reconstruction loss is used to measure the difference between the reconstructed sample output by the feature reconstruction network and the original input sample; KL divergence loss is used to constrain the difference between the data representation distribution output by the feature encoding network and the preset prior distribution; The consistency constraint loss is used to constrain the data representation output by the feature encoding network to remain consistent under different missing modes.

3. The method according to claim 2, characterized in that, The reconstruction loss is a weighted reconstruction loss, including a first term and a second term; the first term is the squared reconstruction error of the artificially occluded area, and the second term is the product of the squared reconstruction error of the visible area and a preset weight coefficient; wherein, the artificially occluded area is the position in the original data sample that is occluded in the second mask but not marked by the first missing position, and the visible area is the actual visible position corresponding to the input view.

4. The method according to claim 2, characterized in that, The consistency constraint loss is the squared Euclidean distance between the first data representation and the second data representation, wherein, during backpropagation, the gradient of the first data representation is truncated to zero, causing the second data representation to unidirectionally converge towards the first data representation.

5. The method according to claim 1, characterized in that, During the sampling process, the dual-space collaborative denoising generation framework uses the class center vector as conditional information and performs conditional sampling through a classifier-free guidance strategy. The classifier-free guidance strategy linearly combines unconditional noise prediction and conditional noise prediction during the sampling phase and controls the consistency between the generated samples and the target class by adjusting the guidance intensity coefficient, thereby generating new latent space sample points for the target class.

Images