A semantic migration sample generation and boundary contraction detection method for enterprise network rare attacks

Abstract

The application relates to the technical field of enterprise network security and intrusion detection, and discloses a semantic migration sample generation and boundary contraction detection method for rare attacks of an enterprise network. The method carries out numericalization, abnormal value processing, missing value filling and label standardization on enterprise office network flow data; generates an adversarial network with similar source attack samples, target category coding, attack semantic migration coding and random disturbance as input training conditions to generate target rare attack enhanced samples; divides three zones by using the normal probability of a binary classification XGBoost; constructs a rare attack global prototype and a sub-class prototype by using the leaf node number of a multi-classification XGBoost, and outputs a detection category by fusing category probability, normal boundary suspiciousness and prototype similarity. The application constructs a reliable rare attack sample channel, reliably discriminates boundary area samples, further improves the detection accuracy of the rare attack category and reduces the misjudgment rate.

Description

Technical Field

[0001] This invention relates to the field of enterprise network security and intrusion detection technology, specifically to a method for generating semantic migration samples and detecting boundary contraction for rare attacks on enterprise networks. Background Technology

[0002] Enterprise office networks carry various services such as HTTP, HTTPS, FTP, SSH, and email. Consequently, these networks are relatively vulnerable to intrusion attacks. With the diversification and increasing sophistication of network attack methods, machine learning-based network intrusion detection technology has become a crucial means of network security protection. This technology automatically identifies normal traffic from various types of attack traffic by extracting features from network traffic samples and training classification models.

[0003] However, in the current network security environment, traffic data imbalance is quite significant. Normal traffic and common attack samples are plentiful, while some high-risk attacks (such as SQL injection, cross-site scripting, and penetration testing) occur infrequently, resulting in very few available samples. This imbalance causes the trained classification model to favor the majority class, leading to low recognition rates and high false negative rates for rare attack categories. Rare attacks, on the other hand, are often more destructive and targeted, causing more severe security losses due to their false negatives. Existing technologies use sample augmentation to expand rare category samples or employ GAN-based generation methods. Known methods typically use category labels as generation conditions, generating samples for the target category in isolation. They fail to consider the semantic relationships between different attack categories in terms of attack phase, protocol behavior, and authentication behavior, and cannot utilize the transferable traffic structure contained in majority class attack samples semantically similar to the target rare attack. This results in low controllability and distortion in the structure of the generated samples. Therefore, there is an urgent need for a method to generate semantically controllable and high-quality rare attack enhancement samples under the premise of imbalanced network traffic data categories, and to further improve the detection accuracy of rare common categories, so as to provide a new solution for enterprise network security protection. Summary of the Invention

[0004] Purpose of the invention: To address the problems mentioned in the background art, this invention discloses a semantic transfer sample generation and boundary shrinkage detection method for rare attacks on enterprise networks. Based on the conditions of transfer coding and CGAN generation discrimination, a reliable rare attack sample channel is constructed, and a reliable hierarchical discrimination is performed on boundary region samples, thereby further improving the detection accuracy of rare attack categories and reducing the false positive rate.

[0005] Technical solution

[0006] This invention discloses a method for generating semantic transfer samples and detecting boundary shrinkage in response to rare attacks on enterprise networks. The method steps are as follows:

[0007] S1. Preprocess the labeled enterprise network traffic samples and divide them into training sets, and establish an attack semantic transfer relationship table.

[0008] S2. Select similar source attack samples corresponding to the rare attack category of the target according to the attack semantic transfer relationship table. Train the conditional generative adversarial network with similar source attack samples, target category encoding, attack semantic transfer encoding and random perturbation as conditions. Generate target rare attack enhancement samples and form an enhancement training set. The training weight of the enhancement samples is reduced according to the preset source credibility coefficient.

[0009] S3. Train a binary classification XGBoost model using the augmented training set. Based on the output normal probability and the preset dual-threshold three-zone division strategy, divide the samples to be detected into high-confidence normal samples that directly output the normal category and samples to be identified that enter the attack category identification.

[0010] S4. Train a multi-class XGBoost model using the augmented training set. Input the sample to be identified into the multi-class XGBoost model to obtain the class probability and leaf node number of each candidate class. Arrange the leaf node numbers into leaf node embeddings according to the order of each tree. Construct a global prototype and subclass prototype of rare attacks based on the rare attack samples in the augmented training set. Calculate the prototype similarity between the sample to be identified and the corresponding prototype.

[0011] Furthermore, step S1 preprocessing includes: quantifying enterprise network traffic samples, handling outliers, imputing missing values, and normalizing labels, and dividing the processed samples into training set, validation set, and test set.

[0012] Furthermore, the attack semantic migration relation table is established based on one or more of the attack stage, protocol behavior, access entry point, authentication behavior, and traffic statistics characteristics. When generating target rare attack enhancement samples, the attack semantic migration relation table is queried according to the target rare attack category to determine candidate similar source attack categories. When the target rare attack category corresponds to multiple candidate similar source attack categories, a category is selected with moderate probability, and similar source attack samples are extracted from the real training samples of the selected category.

[0013] Further, in step S2, the generator of the conditional generative adversarial network combines similar source attack samples, target class codes, attack semantic transfer codes, and random perturbations into joint inputs according to feature dimensions and outputs initial generated samples; the discriminator, given the target class codes and attack semantic transfer codes, distinguishes between real target rare attack samples and initial generated samples, calculates adversarial loss based on the discrimination results, and updates the parameters of the generator and discriminator through backpropagation.

[0014] Furthermore, the target sample anchoring, source sample structure fusion, local perturbation and numerical range truncation are sequentially performed on the initially generated samples to finally obtain the target rare attack enhancement samples. The target rare attack enhancement samples and the real training samples form the enhancement training set.

[0015] Furthermore, in step S2, the source credibility coefficient is less than 1, and the training weight of a single target rare attack enhancement sample is the product of the training weight of a single real training sample of the same category and the source credibility coefficient; the number of enhancement samples to be generated is determined according to the number of real training samples of each target rare attack category, the preset enhancement factor, and the preset expansion limit.

[0016] Furthermore, the dual-threshold three-zone division strategy in step S3 is as follows: a preset attack threshold and a high-confidence normal threshold are set, and the high-confidence normal threshold is greater than the attack threshold; when the normal probability is greater than or equal to the high-confidence normal threshold, the sample to be detected is classified into the high-confidence normal core zone and the normal category is output; when the normal probability is greater than the attack threshold but less than the high-confidence normal threshold, the sample to be detected is classified into the suspicious boundary zone; when the normal probability is less than or equal to the attack threshold, the sample to be detected is classified into the explicit attack zone.

[0017] Furthermore, the binary XGBoost model and the multi-class XGBoost model are connected through normal boundary region judgment and normal boundary suspicion. For samples to be detected whose normal probability reaches the high-confidence normal threshold, their detection category is fixed as the normal category, and the category probability and prototype similarity output by the multi-class XGBoost model do not participate in the final category judgment of the sample. For samples to be detected that fall into the suspicious boundary region or the clear attack region, the category probability and leaf node embedding output by the multi-class XGBoost model are used to identify candidate categories. The normal boundary suspicion is calculated based on the normal probability output by the binary XGBoost model, and the category probability, normal boundary suspicion, and prototype similarity output by the multi-class XGBoost model are fused to obtain the classification score of each candidate category. The high-confidence normal threshold, prototype similarity fusion weight, and normal boundary suspicion fusion weight are determined by discrete grid search on the validation set, and the macro-average F1 score of the validation set is used as the selection index for parameter combination.

[0018] Beneficial effects:

[0019] 1. This invention establishes an attack semantic transfer relationship table between similar source attack categories and target rare attack categories, and uses attack semantic transfer encoding and target category encoding together as conditions to run through the generation and discrimination process of conditional generative adversarial networks. For the same target rare attack category, different similar source attack categories correspond to different transfer encodings, forming different conditional generation paths. Therefore, the generation process is no longer based solely on isolated generation of category labels, but rather inherits the usable network traffic structure from similar source attack samples along a specified semantic transfer path, ensuring that the generated rare attack samples are structurally consistent with the target attack semantics, thus alleviating the problem of scarce rare attack samples and distorted generated samples under class imbalance conditions.

[0020] 2. This invention divides the samples to be detected into a high-confidence normal core region, a suspicious boundary region, and a clearly defined attack region by using an attack threshold and a high-confidence normal threshold. High-confidence normal samples directly output the discrimination result, while only difficult-to-classify samples are sent to the attack category identification process. In the attack category identification, the category probability of a multi-classification model, the suspiciousness of the normal boundary obtained from the normal probability, and the similarity to rare attack prototypes are fused for scoring and judgment. Thus, samples in the normal and attack boundary regions receive cross-validation of multi-level evidence, enhancing the judgment stability of rare attack categories under majority class submersion, while reducing the false positive rate of normal samples and the false negative rate of rare attacks. Attached Figure Description

[0021] Figure 1 This is a flowchart of the overall method of the present invention;

[0022] Figure 2 This is a schematic diagram illustrating the attack semantic transfer relationship, attack semantic transfer encoding, and its coupling relationship with the conditional generative adversarial network in an embodiment of the present invention.

[0023] Figure 3 This is a flowchart of the detection steps of the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] like Figure 1 As shown, this invention discloses a method for generating semantic transfer samples and detecting boundary shrinkage in response to rare attacks on enterprise networks. The method steps are as follows:

[0026] Step 1: Obtain enterprise office network traffic samples and perform data preprocessing to construct training, validation, and test sample sets. The training sample set is used to train conditional generative adversarial networks, binary XGBoost models, and multi-class XGBoost models; the validation sample set is used to select XGBoost model parameters, high-confidence normal thresholds, and fusion weights; the test sample set is only used to evaluate the detection performance after training.

[0027] Step 1.1: Read multiple CSV files from the CIC-IDS2017 dataset (the normal traffic in the CIC-IDS2017 dataset includes multi-user interaction behavior built on protocols such as HTTP, HTTPS, FTP, SSH, and email; this embodiment uses it as experimental data for enterprise office network traffic with multi-user and multi-protocol characteristics). Remove leading and trailing spaces from field names and attack category labels, and merge the network traffic samples from each file. Each network traffic sample includes one or more traffic characteristics such as flow duration, number of packets, packet length, traffic rate, arrival time interval, TCP flag count, active time, and idle time.

[0028] The attack category labels are standardized. Specifically, the original labels Web Attack-BruteForce, Web Attack-XSS, and Web Attack-SQL Injection are unified with their corresponding standard category names, retaining these three subcategories of web attacks. Other attack category labels retain their original names after removing leading and trailing spaces. To control the training scale, this embodiment randomly samples categories with a large number of samples, retaining a maximum of 60,000 real network traffic samples per category. Categories with fewer than this limit retain all real samples. The random seed is set to 2026.

[0029] Step 1.2: Numericalize traffic features other than attack category labels. Convert feature items that cannot be parsed into valid values, as well as positive and negative infinity values, to null values. Then, convert the numericalized traffic features into 32-bit floating-point numbers. This process does not perform one-hot encoding, frequency encoding, or label encoding on protocol type, service type, or connection state.

[0030] Step 1.3: The real network traffic samples are stratified according to attack category labels, dividing them into training, validation, and test sets. This embodiment uses a ratio of 60%, 15%, and 25% to maintain the original category proportions in each set as much as possible, and retains real samples of rare attacks in all three sets.

[0031] Targeted rare attack augmentation samples are generated only after the data partitioning is complete, and are added only to the training sample set, not to the validation or test sample sets. Therefore, both the validation and testing processes use real network traffic samples, preventing targeted rare attack augmentation samples from entering the evaluation data.

[0032] Step 1.4: Calculate the median of each traffic feature based on the training sample set, and use the obtained median to impute missing values ​​in the training, validation, and test sample sets, respectively. Missing value imputation statistics are not calculated separately for the validation and test sample sets. An attack category labeling table is established based on the training sample set and applied to the validation and test sample sets.

[0033] Step 1.5: For the Conditional Generative Adversarial Network (CGAN), the training sample set with missing value imputation is standardized. The mean and standard deviation required for standardization are calculated only from the training sample set. The initial generated samples output by the CGAN are inversely standardized to restore the original feature space, and then subjected to target sample anchoring, source sample structure fusion, local perturbation, and numerical range truncation to form target rare attack enhancement samples. The binary classification XGBoost model and the multi-class classification XGBoost model use the traffic features with missing value imputation but without the aforementioned standardization process.

[0034] Step 2: As Figure 2 As shown, the target rare attack category is determined, the attack semantic transfer relationship between similar source attack categories and the target rare attack category is established in advance, and the attack semantic transfer code is generated.

[0035] Step 2.1: Determine the target rare attack category based on the number of real samples for each attack category in the training sample set. In this CIC-IDS2017 experiment, Web Attack-XSS, Web Attack-SQL Injection, Infiltration, and Bot were identified as the target rare attack categories. Heartbleed only participated in the global prototype construction and detection evaluation of rare attacks and was not used for sample augmentation as a target rare attack category.

[0036] Step 2.2: Establish attack semantic migration relationships in advance based on protocol behavior, access entry point, attack stage, authentication behavior, and traffic statistics characteristics. This embodiment uses pre-defined attack semantic migration relationships, without calculating attack category correlation during the training of the conditional generative adversarial network, nor filtering similar source attack categories based on correlation thresholds.

[0037] The attack semantic migration relationship is as follows: the similar source attack category corresponding to Web Attack-XSS is WebAttack-Brute Force; the similar source attack categories corresponding to Web Attack-SQL Injection are Web Attack-Brute Force and Web Attack-XSS; the similar source attack categories corresponding to Infiltration are FTP-Patator, SSH-Patator and Bot; and the similar source attack categories corresponding to Bot are PortScan, DDoS and FTP-Patator.

[0038] When a rare attack category for a target corresponds to multiple similar attack categories, a category is randomly selected with equal probability from the similar attack categories that have real samples in the current training sample set, and then similar attack samples are drawn from the selected category. The above correspondence remains unchanged during this training process.

[0039] Step 2.3: Determine the migration relationship type based on the combination of similar source attack categories and target rare attack categories. This embodiment sets seven migration relationship types: authentication behavior to Bot migration, authentication breach to penetration attack migration, Bot to penetration attack migration, denial-of-service behavior to Bot attack migration, scanning behavior to Bot attack migration, web attack internal migration, and general attack migration. The corresponding identifiers are, in order: auth_to_bot, auth_to_infiltration, bot_to_infiltration, dos_to_bot, scan_to_bot, web_semantic_shift, and generic_attack_shift.

[0040] The migration relationship type is converted into a seven-dimensional one-hot attack semantic migration code in the order described above. For example, the attack semantic migration code corresponding to Web Attack-Brute Force to Web Attack-SQL Injection is as follows: The attack semantics transfer encoding corresponding to FTP-Patator to Bot is as follows: The attack semantics transfer encoding corresponding to PortScan to Bot is as follows: The general attack migration, as a reserved coding position for unregistered migration combinations, was not actually used to generate target rare attack enhancement samples in this CIC-IDS2017 experiment.

[0041] Target category encoding and attack semantic transfer encoding are constructed separately. Target category encoding specifies the target rare attack category to which the initially generated sample belongs, while attack semantic transfer encoding represents the migration path from similar source attack categories to the target rare attack category. In this embodiment, a four-dimensional one-hot form of target category encoding is constructed in the order of Web Attack-XSS, Web Attack-SQL Injection, Infiltration, and Bot. The same target rare attack category can correspond to different attack semantic transfer encodings.

[0042] Step 2.4: The generator is input by concatenating similar source attack samples, target class codes, attack semantic transfer codes, and random perturbations; the discriminator is input by concatenating real target rare attack samples or initially generated samples with the same target class codes and attack semantic transfer codes. The coupling relationship is expressed as follows:

[0043]

[0044] In the formula, Indicates attack samples with similar sources; Indicates the target's rare attack category Corresponding target category code; Indicates similar source attack categories Rare attack categories to target Attack semantic transfer coding; Indicates random perturbation; and These represent the generator and the discriminator, respectively. Indicates the initial generated sample; This represents a rare attack sample targeting a real target. and These represent the generator parameters and discriminator parameters, respectively. The target category code is used to limit the target rare attack category to which the generated result belongs, and the attack semantic transfer code is used to distinguish different migration paths to the same target rare attack category. The two cannot be substituted for each other. Unlike methods that only use the target category code as a generation condition, this invention simultaneously inputs similar source attack samples, the target category code, and the attack semantic transfer code into the generator, and simultaneously inputs the target category code and the attack semantic transfer code into the discriminator, so that the same target rare attack category can correspond to different conditional generation paths. The attack semantic transfer code participates in forward and backward propagation through the conditional inputs of the generator and discriminator, without setting a separate independent semantic transfer direction constraint loss.

[0045] Step 2.5: Constructing Conditional Generative Adversarial Network Training Batches. Each training batch first selects a rare target attack category with equal probability from the set of rare target attack categories. Then, based on a preset attack semantic transfer relationship, it selects a similar source attack category and extracts similar source attack samples and real rare target attack samples respectively, while simultaneously generating random perturbations. When the number of real training samples for the corresponding category is less than the batch size, a sampling method with replacement is used to form the training batch.

[0046] Step 3: Construct and train a conditional generative adversarial network (GAN) based on attack semantic transfer, using similar source attack samples to generate target rare attack enhancement samples. The GAN includes a generator and a discriminator, with attack semantic transfer encoding serving as conditional input to both the generator and the discriminator.

[0047] Step 3.1: Construct the generator. Assume the network traffic sample contains... There are 1 numerical feature, and the target category encoding dimension is 1. Attack semantic transfer coding dimension The dimension of the random perturbation is Then the input dimension of the generator is In this embodiment, ; =7; Therefore, the input dimension of the generator is random disturbance A 24-dimensional standard normal random variable is used.

[0048] The generator is configured sequentially with a fully connected layer containing 384 neurons, a batch normalization layer, a LeakyReLU activation layer, a second fully connected layer containing 384 neurons, a second batch normalization layer, a second LeakyReLU activation layer, and a linear output layer. The negative half-axis slope of both LeakyReLU activation layers is 0.2, and the number of neurons in the output layer is... The generator receives standardized similar-source attack samples, target class encoding, attack semantic transfer encoding, and random perturbations, and outputs an initial generated sample. .

[0049] Step 3.2: Construct the discriminator. The input dimension of the discriminator is... The discriminator is configured sequentially with a fully connected layer containing 384 neurons, a LeakyReLU activation layer, a random inactivation layer with an inactivation ratio of 0.15, a second fully connected layer containing 192 neurons, a second LeakyReLU activation layer, a second random inactivation layer with an inactivation ratio of 0.10, and a single-neuron linear output layer. The negative half-axis slope of both LeakyReLU activation layers is 0.2.

[0050] The discriminator uses a binary cross-entropy loss with logistic regression, and its training loss is expressed as:

[0051]

[0052] In the formula, This represents a standardized, real-world rare attack sample; Indicates the initial generated sample; Indicates the target category code; This indicates an attack semantic transfer encoding. During discriminator training, generator gradient propagation corresponding to the initial generated samples is stopped; only the discriminator parameters are updated.

[0053] Step 3.3: The generator is trained using adversarial loss, target class distribution constraint loss, and source sample structure preservation loss. The joint loss is expressed as:

[0054]

[0055] The adversarial loss is expressed as:

[0056]

[0057] The target class distribution constraint loss consists of sample-level feature distance and feature mean distance, which are expressed as follows:

[0058]

[0059]

[0060] The source sample structure preservation loss is expressed as:

[0061]

[0062] In the formula, Indicates the training batch size; Indicates the number of flow characteristics; Indicates the first The first standardized similar-source attack sample One feature; This represents the first rare attack sample of the corresponding real target. One feature; Represents the first generated sample One characteristic.

[0063] This embodiment will Set to 1.0, Set to 4.0, Set it to 0.15, The value is set to 0.0875, therefore the actual weight of the feature mean distance in the generator joint loss is 0.35. The attack semantic transfer encoding participates in forward and backward propagation through the conditional inputs of the generator and discriminator, without setting a separate semantic transfer direction constraint loss.

[0064] In each training iteration, the discriminator parameters are first updated using the initial generated samples from the stopped generator gradient propagation. Then, the generator joint loss is calculated based on the updated discriminator, and the generator parameters are updated again. When updating the generator, the upper bound of the generator gradient norm is set to 5. The generator loss and discriminator loss are recorded separately during training.

[0065] Step 3.4: Perform tiered augmentation based on the number of real training samples for the target rare attack category. Let the first sample number threshold be... The second sample size threshold is ,and When the number of actual training samples is less than When the total number of augmented samples is controlled to be a preset multiple of the number of real training samples; when the number of real training samples is not less than And lower than At that time, the total number of samples will be supplemented to When the number of real training samples is not less than At that time, no quantity replenishment will be made.

[0066] This embodiment will Set to 80, Setting it to 1800 will be lower than The target rare attack category is expanded to twice the number of its actual training samples. Heartbleed does not belong to the target rare attack category of the conditional generative adversarial network, so it does not undergo sample augmentation, but only participates in the global prototype construction and detection evaluation of rare attacks in subsequent steps.

[0067] Step 3.5: After the generator training is complete, process the initial generated samples. Perform inverse normalization and then perform weighted fusion with real target rare attack anchored samples and similar source attack samples to obtain target rare attack enhanced samples:

[0068]

[0069] In the formula, This indicates a rare attack enhancement sample targeting the target; Indicates the inverse standardization operation; This indicates anchored samples drawn with replacement from rare attack samples of real targets; This represents a normalized similar-source attack sample as the input generator; Indicates local random perturbation; and These represent the lower and upper bounds of the feature values, respectively. The standard deviation of the local random perturbation is set to 0.006 times the standard deviation of the feature corresponding to the rare attack category of the target.

[0070] The 0.1 percentile and 99.9 percentile of each traffic feature are calculated based on the training sample set, and the numerical truncation range is determined by combining the minimum and maximum values ​​of the features in the training sample set with the non-negative attribute. For features that do not have negative values ​​in the training samples, the lower bound of the truncation is not lower than 0. After completing inverse standardization, weighted fusion, local random perturbation, and numerical range truncation, the resulting samples are identified as target rare attack enhancement samples.

[0071] Step 3.6: In this embodiment, a conditional generative adversarial network is trained using a CUDA device. The generator, discriminator, and samples and codes in the current training batch are loaded onto the GPU, and forward propagation, loss calculation, backpropagation, and parameter update are performed on the GPU.

[0072] The training batch size is set to 256. When the number of real training samples of similar source attack categories or rare target attack categories is less than the batch size, sampling with replacement is used. The training epoch is set to 30, and each training epoch performs 30 to 160 parameter updates based on the total number of real training samples of the rare target attack categories.

[0073] Both the generator and discriminator employ the AdamW optimizer. The generator's learning rate is set to 0.0008, and the discriminator's learning rate is set to 0.00064. The momentum parameters for both optimizers are set to 0.5 and 0.92, respectively, and the weight decay coefficients are both set to 0.0001. This embodiment uses a fixed learning rate, without learning rate warm-up or learning rate decay.

[0074] After completing 30 training cycles, the generator obtained from the last training cycle is set to the inference state, and initial generated samples are generated. This embodiment does not perform secondary screening based on discriminator confidence, nearest neighbor distance, or duplicate sample detection results, but instead forms target rare attack enhancement samples.

[0075] Step 4: As Figure 3 As shown, the target rare attack enhancement samples obtained in step 3 are merged with the real training samples to construct an enhanced training set, and training weights are set according to the class distribution and sample source of the real training samples. The enhanced training set is used to train binary classification XGBoost models and multi-class classification XGBoost models, respectively.

[0076] Step 4.1: According to the target rare attack category specified during the generation process, set the attack category label for the target rare attack enhancement sample, and convert it into a category number using the category number table established in Step 1. Similar source attack categories are only used to determine the starting conditions for attack semantic transfer and are not used as category labels for the target rare attack enhancement sample.

[0077] The enhanced rare attack samples are appended row-wise to the real training samples, and the category labels are merged in the same order to form the enhanced training set. All real training samples are retained. The enhanced rare attack samples are only added to the training sample set; the validation and test sample sets still only contain real network traffic samples.

[0078] Step 4.2: Calculate the class weights used by the multi-class XGBoost model based on the number of classes in the real training samples. Let the total number of real training samples be... ,category The actual number of training samples is The category weights are then calculated as follows:

[0079]

[0080] In the formula, Indicates the category imbalance adjustment index; Represents a set of categories; This represents the normalized and truncated class weights; and These represent the lower and upper bounds of the class weights, respectively. This embodiment focuses on the multi-class XGBoost model. Set it to 0.55, Set it to 0.25, Set to 40. Class weights are calculated only based on real training samples and are not recalculated when rare attack-enhanced samples are added.

[0081] The final training weights for each training sample are determined based on the sample source:

[0082]

[0083] In the formula, Indicates the first The categories of the training samples; This represents the enhanced sample weighting coefficient. This embodiment will... The weight is set to 0.30, so the training weight of a single target rare attack augmentation sample in the same category is 30% of the training weight of a single real training sample. The same augmentation sample weight coefficient is used for all four target rare attack categories.

[0084] Step 4.3: When training the binary classification XGBoost model, first map the class labels of the real training samples and the target rare attack augmentation samples to the normal class and attack class, respectively. Then, recalculate the class weights based on the number of normal and attack classes in the real training samples. The binary classification weight class imbalance adjustment index is set to 0.45, the lower limit of class weight is set to 0.25, and the upper limit of class weight is set to 12. The target rare attack augmentation samples are still multiplied by the augmentation sample weight coefficient of 0.30.

[0085] Step 5: Train a binary classification XGBoost model using the augmented training set to obtain the normal probability that the sample to be detected belongs to the normal category, and divide the high-confidence normal core region, suspicious boundary region and clear attack region according to the normal probability.

[0086] The normal boundary shrinkage described in this invention refers to not directly outputting all samples with a normal probability greater than the conventional binary classification threshold as normal, but instead setting a high-confidence normal threshold higher than the attack threshold, allowing only samples with a normal probability reaching the high-confidence normal threshold to be directly output as normal. Samples with a normal probability between the attack threshold and the high-confidence normal threshold continue to undergo attack category identification, thereby narrowing the probability range that can be directly output as normal.

[0087] Step 5.1: Map the category labels in the augmented training set to normal and attack categories. BENIGN is mapped to the value 1, and all other categories are mapped to the value 0. Following the method described in Step 4, calculate the binary classification sample weights based on the number of normal and attack categories in the real training samples. The target rare attack augmented samples are multiplied by an augmented sample weight coefficient of 0.30 based on their corresponding attack category weights.

[0088] The Parzen estimation method for tree structures in Optuna was used to search for hyperparameters in a binary XGBoost model. The search range for the number of decision trees was 120 to 420, the maximum tree depth was 3 to 8, the learning rate was 0.025 to 0.20, the minimum child node weight was 0.7 to 10, the row sampling ratio was 0.72 to 0.99, the column sampling ratio was 0.70 to 0.99, the L1 regularization coefficient was 0.0001 to 1.5, the L2 regularization coefficient was 0.5 to 10, and the maximum number of bins in the histogram was selected from 128, 256, and 512. Each set of candidate parameters was trained using an augmented training set, and the binary macro-average F1 score on the validation set was used as the parameter selection metric.

[0089] The parameters of the binary classification XGBoost model obtained in this embodiment are as follows: number of decision trees 361, maximum tree depth 8, learning rate 0.126751, minimum child node weight 7.17149, row sampling ratio 0.864137, column sampling ratio 0.731890, L1 regularization coefficient 0.327574, L2 regularization coefficient 0.999964, and maximum histogram bins 256. The model adopts a binary:logistic objective function, uses logloss as the training evaluation metric, sets the tree construction method to hist, and trains using CUDA.

[0090] After training, the sample to be tested is input into the binary classification XGBoost model to obtain the normal probability of it belonging to the normal category. A higher normal probability indicates that the sample to be detected is closer to the normal category region learned by the binary classification XGBoost model. This normal probability is not directly used as the final detection category, but rather for normal boundary region segmentation and normal boundary suspicion calculation.

[0091] Step 5.2: Set the attack threshold and high confidence normal threshold and satisfy In this embodiment, the attack threshold is fixed at 0.50, and the candidate set of high-confidence normal thresholds is set as follows: The attack threshold is used to distinguish between suspicious boundary areas and clearly attacked areas, while the high-confidence normal threshold is used to identify high-confidence normal core areas that can be directly classified as normal.

[0092] The normal boundary region of the sample to be tested is represented as:

[0093]

[0094] In the formula, Indicates a highly reliable, normal core region; Indicates a suspicious boundary area; This indicates a clearly defined attack zone. The three zones do not overlap and cover the entire range of normal probabilities from 0 to 1.

[0095] When the sample to be detected is located in the high-confidence normal core region, BENIGN is output directly without prototype similarity calculation. When the sample to be detected is located in the suspicious boundary region, BENIGN is not output directly; instead, it is fed into the multi-class XGBoost model and the rare attack prototype similarity calculation process. When the sample to be detected is located in the explicit attack region, it is also fed into the multi-class XGBoost model and the rare attack prototype similarity calculation process to determine the corresponding specific detection category. Suspicious boundary regions and explicit attack regions use different normal boundary suspicion levels in subsequent classification score calculations.

[0096] Step 5.3: Calculate the degree of suspicion of the normal boundary based on the normal probability.

[0097]

[0098] When the normal probability is not lower than the high-confidence normal threshold, the normal boundary suspicion is 0; when the normal probability is between the attack threshold and the high-confidence normal threshold, the normal boundary suspicion increases linearly as the normal probability decreases; when the normal probability is not higher than the attack threshold, the normal boundary suspicion is 1. The normal boundary suspicion is not treated as an independent detection category, but is used in step 7 to reduce the classification score of the normal category and correct the classification score of the attack category. This process results in samples with normal probabilities close to the high-confidence normal threshold receiving smaller boundary corrections, while samples with lower normal probabilities receive larger boundary corrections.

[0099] Step 5.4: On the validation sample set, a discrete grid search is performed on the high-confidence normal threshold, the prototype similarity fusion weight from Step 7, and the normal boundary suspicion fusion weight, using the validation sample set macro-average F1 as the selection metric for parameter combination. This embodiment ultimately sets the attack threshold... Setting it to 0.50 will set the high-confidence normal threshold. Set to 0.90. Once the threshold and fusion weights are determined, they will not be adjusted based on the detection results of the test sample set.

[0100] Step 6: Train a multi-class XGBoost model using the augmented training set to obtain the class probability and leaf node number of each candidate class, and construct a global prototype and subclass prototype of rare attacks based on the leaf node numbers of rare attack samples.

[0101] Step 6.1: Train the multi-class XGBoost model using the enhanced training set and corresponding sample weights constructed in Step 4. This embodiment includes BENIGN and 14 attack categories, for a total of 15 candidate categories. The multi-class XGBoost model employs the multi:softprob objective function, the hist tree construction method, and CUDA computing equipment, and uses multi-class log loss as the training evaluation metric.

[0102] The Parzen estimation method for tree structures in Optuna was used for hyperparameter search. The number of decision trees ranged from 180 to 520, the maximum tree depth from 4 to 10, the learning rate from 0.025 to 0.18, the minimum child node weight from 0.7 to 8, the row sampling ratio and column sampling ratio from 0.70 to 0.98, the L1 regularization coefficient from 0.0001 to 2.0, the L2 regularization coefficient from 0.3 to 12, and the maximum number of histogram bins from 128, 256, and 512. Each set of candidate parameters was trained using an augmented training set, and the macro-average F1 score of the validation set was used as the parameter selection metric.

[0103] The parameters of the multi-class XGBoost model obtained in this embodiment are as follows: number of decision trees 254, maximum tree depth 6, learning rate 0.171886, minimum child node weight 0.869265, row sampling ratio 0.834201, column sampling ratio 0.976514, L1 regularization coefficient 0.000712, L2 regularization coefficient 8.664503, and maximum histogram bin size 256. After training, the model outputs the class probabilities of the 15 candidate classes corresponding to the sample to be detected.

[0104] Step 6.2: Keeping the structure and parameters of the multi-class XGBoost model unchanged, call the leaf node number output function to obtain the leaf node number of each sample in each decision tree of the model. Assume the leaf node number output includes... Decision trees, samples The leaf node embedding is represented as:

[0105]

[0106] In the formula, Indicates sample In the The leaf node numbers reached in each decision tree. For a multi-class XGBoost model, This includes all decision trees built for different candidate categories in each improvement round, with leaf node numbers arranged according to the fixed output order of the model.

[0107] Leaf node numbers in different decision trees are independent of each other, and the numerical value of a leaf node number does not represent the distance between leaf nodes. Therefore, subsequent prototype construction and prototype similarity calculation only compare whether the leaf node numbers at the same position in the same decision tree are the same, and do not calculate the numerical difference between leaf node numbers in different decision trees.

[0108] Step 6.3: Construct a rare attack category set comprising Web Attack-XSS, Web Attack-SQL Injection, Infiltration, Bot, and Heartbleed. The global prototype of rare attacks is built using all samples belonging to these categories from the augmented training set, including real training samples and augmented samples for the four target rare attack categories, as well as real training samples for Heartbleed. When constructing the global prototype of rare attacks, equal sampling or category weighting is not performed on different rare attack categories.

[0109] set up This represents the set of sample indexes used to construct a global prototype of rare attacks. Indicates the category used for construction A collection of sample indices for the subclass prototype. Prototype In the The leaf node numbers on a decision tree are represented as follows:

[0110]

[0111] In the formula, This represents the global prototype of a rare attack. Indicate category The prototype of a subclass; Indicates the candidate leaf node number; This represents the indicator function. For each decision tree, the number of times each corresponding sample reaches each leaf node is counted, and the leaf node number with the most occurrences is used as the prototype value for that position in the tree; when multiple leaf node numbers have the same number of occurrences, the leaf node number with the smallest value is selected.

[0112] Step 6.4: Calculate the leaf node matching similarity between the sample to be detected and the corresponding prototype:

[0113]

[0114] The leaf node matching similarity value ranges from 0 to 1. Its value represents the proportion of the sample to be detected and its corresponding prototype reaching the same leaf node across all decision trees.

[0115] The sample to be tested and the category The category is obtained by weighting the similarity between the subclass prototype and the global prototype of rare attacks. Prototype similarity:

[0116]

[0117] In the formula, Indicate category Prototype similarity; Indicate category The prototype of a subclass; This represents the global prototype of a rare attack. Indicate category Subclass prototype weight; This represents the global prototype weight of rare attacks.

[0118] Step 6.5: Based on the augmented training set used to construct categories The number of samples in the subclass prototype determines the subclass prototype weight:

[0119]

[0120] In the formula, .

[0121] In this embodiment, the number of samples used to construct subclass prototypes for Web Attack-XSS and Bot is no less than 60, and their subclass prototype weight is set to 0.70; the number of samples used to construct subclass prototypes for Web Attack-SQL Injection, Infiltration, and Heartbleed is no less than 3 and less than 60, and their subclass prototype weight is set to 0.35. Heartbleed has no targeted rare attack augmentation samples, and its subclass prototype is constructed solely based on real training samples.

[0122] The global and subclass prototypes for rare attacks are constructed using only the augmented training set; the validation and test sets are not involved in prototype computation. The leaf node embeddings for both validation and test samples are output by the same multi-class XGBoost model. When the decision tree structure or parameters of the multi-class XGBoost model change, the leaf node embeddings and corresponding prototypes need to be recalculated.

[0123] Step 7: Combine the normal boundary suspicion output by the binary XGBoost model, the class probability output by the multi-class XGBoost model, and the prototype similarity corresponding to the sample to be detected, calculate the classification score of each candidate class, and output the detection class.

[0124] Step 7.1: Process the network traffic samples to be detected according to the numericalization, outlier handling, and missing value imputation methods described in Step 1, ensuring that the number, order, and numerical types of traffic features are consistent with those during the model training phase. Input the processed samples into the binary classification XGBoost model to obtain the normal probabilities. And based on the attack threshold and high confidence normal threshold Determine the normal boundary region and the degree of suspicion of the normal boundary. .

[0125] When the normal probability is not lower than the high-confidence normal threshold, the sample to be detected belongs to the high-confidence normal core region, and the detection result is fixed as BENIGN. When the normal probability is greater than the attack threshold but lower than the high-confidence normal threshold, the sample to be detected belongs to the suspicious boundary region. When the normal probability is not higher than the attack threshold, the sample to be detected belongs to the explicit attack region. Samples in the suspicious boundary region and explicit attack region are classified according to the subsequent fusion decision results.

[0126] Step 7.2: For the samples to be detected that were marked as suspicious boundary regions or clearly defined attack regions in Step 7.1, input them into the multi-class XGBoost model trained in Step 6 to obtain BENIGN and the class probabilities corresponding to each attack category, and call the leaf node number output function of the same model to form the leaf node embedding of the sample to be detected. Samples in the high-confidence normal core region do not undergo multi-class probability prediction and leaf node prototype similarity calculation.

[0127] Based on the leaf node matching ratio described in step 6, calculate the similarity between the sample to be detected and the global prototype of rare attacks and the prototypes of each subclass. Then, obtain the prototype similarity for Web Attack-XSS, Web Attack-SQLInjection, Infiltration, Bot, and Heartbleed according to the corresponding subclass prototype weights. The class probabilities, leaf node embeddings, and rare attack prototypes are all generated by the same multi-class XGBoost model.

[0128] Step 7.3: Set the boundary correction amounts for BENIGN and attack categories based on the suspicion level of the normal boundary:

[0129]

[0130] In the formula, Represents a set of attack categories; This indicates the number of attack categories. As the suspicion level of normal boundaries increases, the BENIGN category receives a negative correction, while all attack categories receive an average positive correction.

[0131] Candidate categories The classification score is expressed as:

[0132]

[0133] In the formula, Indicates candidate category Category score; This represents the class probability output by the multi-class XGBoost model; Represents a set of rare attack categories; Indicates an indicator function; Indicate category Prototype similarity; , and These represent the fusion weights corresponding to category probability, prototype similarity, and normal boundary suspiciousness, respectively. The classification score is used for category ranking and is not part of the normalized category probability.

[0134] The prototype similarity term only applies to rare attack categories. (Coefficient) The contribution of prototype similarity is adjusted based on the normal boundary suspicion level: the coefficient is 0.5 when the normal boundary suspicion level is 0, and 1 when the normal boundary suspicion level is 1. This allows prototype similarity to have a greater auxiliary effect on samples with a low probability of being normal.

[0135] The detection category of the sample to be tested is represented as follows:

[0136]

[0137] In the formula, Indicates the final detection category of the sample to be tested; This represents the set of candidate categories consisting of the BENIGN category and all attack categories. When two or more candidate categories have the same classification score, the category with the smaller category number is selected according to a fixed order in the category number table.

[0138] Step 7.4: Combine class probabilities with weights Set the attack threshold to 1. Fixed at 0.50. High-confidence normal threshold. from Select; Prototype similarity fusion weight Weighting of Suspicion Level with Normal Boundary All from Choose from.

[0139] On the validation sample set, candidate combinations of high-confidence normal threshold, prototype similarity fusion weight, and normal boundary suspiciousness fusion weight were iterated, and the parameter combination with the highest macro-average F1 score on the validation sample set was used as the fusion parameter. The parameters selected for this main experiment are: , , and .in, This indicates that the prototype similarity item was not enabled in the validation results of the main experiment; the independent supplementary experimental results for the prototype similarity item are described in step 8. The test sample set is not involved in the selection of fusion parameters.

[0140] Step 8: Use the CIC-IDS2017 dataset for training, validation, and ablation experiments to compare the impact of attack semantic transfer enhancement, normal boundary shrinkage, and rare attack prototype enhancement on the detection results.

[0141] Step 8.1: Read the eight CSV files from the CIC-IDS2017 dataset and analyze the category distribution. For categories with a large number of samples, retain a maximum of 60,000 real samples; for rare attack categories, retain all real samples, resulting in 279,616 samples across 15 categories. After stratifying the dataset into 60%, 15%, and 25% groups, the training, validation, and test sets contain 167,769, 41,943, and 69,904 real network traffic samples, respectively. With a random seed of 2026, the Conditional Generative Adversarial Network (CGN) was trained for 30 epochs, yielding 2,065 enhanced samples of rare target attacks. Both the CGN and the XGBoost model were trained using an NVIDIA GeForce RTX 5060 Ti and CUDA-enabled devices.

[0142] The detection results were evaluated using Accuracy, Macro-F1, Weighted-F1, and Rare-Macro-F1. Rare-Macro-F1 was calculated as the average F1 score for five rare attack categories: Web Attack-XSS, Web Attack-SQL Injection, Infiltration, Bot, and Heartbleed.

[0143]

[0144] Step 8.2: Set up four ablation models. Model A is a standard multi-class XGBoost model using only real training samples; Model B adds attack semantic transfer enhancement and enhanced sample weights to Model A; Model C adds normal boundary shrinkage to Model B; Model D adds prototype similarity candidates to Model C, and the prototype similarity fusion weights are selected by the validation sample set. The main experimental results are shown in Table 1.

[0145] Table 1

[0146]

[0147] Compared to Model A, Model B improves Rare-Macro-F1 by 0.004654, but decreases Macro-F1 by 0.002112, indicating that attack semantic transfer enhancement increases the training coverage of some rare attacks while also affecting the original class boundaries. Model C improves Macro-F1 by 0.003915 and Rare-Macro-F1 by 0.011731 compared to Model B. Compared to Model A, Model C improves Macro-F1 by 0.001803 and Rare-Macro-F1 by 0.016385, while decreasing Accuracy by 0.000486 and Weighted-F1 by 0.000280. These results reflect the difference between rare attack identification and the overall sample weighted index.

[0148] The rare attack results for Model A and Model C are shown in Table 2. Since Model D obtained the same detection results as Model C in the main experiment, the final results in Table 2 are applicable to both Model C and Model D.

[0149] Table 2

[0150]

[0151] Web Attack-XSS's recall increased from 0.288344 to 0.380368, and F1 score increased from 0.362934 to 0.383901, but precision decreased. Infiltration's recall increased from 0.888889 to 1.000000; Bot's recall increased from 0.981707 to 0.991870, and F1 score increased from 0.986721 to 0.988855. Web Attack-SQLInjection remained unchanged in this data partitioning.

[0152] Heartbleed, Web Attack-SQL Injection, and Infiltration only had 3, 5, and 9 samples respectively in the test sample set, making their metrics susceptible to the classification results of individual samples. Therefore, Heartbleed was only used as a very small sample category for prototype construction and result display, and not as the sole criterion for evaluating the overall detection performance. The prototype similarity fusion weights selected for the validation sample set in the main experiment were... Therefore, the results of model D and model C are the same, and the main experiment itself cannot show that the prototype similarity term produced a positive gain.

[0153] Step 8.3: To observe the results when the prototype similarity fusion weight is greater than 0, a separate supplementary training was conducted. This supplementary training used the same original data, data partitioning, and a sample limit of 60,000 per class, but set the enhancement factor for the least common sample class to 4, generating a total of 2,135 target rare attack enhancement samples, and then re-searched the multi-class XGBoost model parameters. Within this supplementary training, the prototype similarity fusion weight was set to 0 and 0.06 for comparison, and the results are shown in Table 3. Since the number of enhancements and model parameters in the supplementary training are different from those in the main experiment, the first row of Table 3 is not directly compared with model C in Table 1.

[0154] Table 3

[0155]

[0156] Within this supplementary training, the addition of the prototype similarity term improved Rare-Macro-F1 by 0.001077, WebAttack-XSS recall by 0.030675, and F1 by approximately 0.006381; simultaneously, accuracy decreased by approximately 0.000100, and Macro-F1 decreased by approximately 0.000468. These results indicate that, under the parameters of this supplementary training, the prototype similarity term improved some rare attack metrics, but did not simultaneously improve all overall metrics.

[0157] Step 8.4: Based on the results of the main experiment and the supplementary experiment, the attack semantic transfer enhancement mainly affects the training coverage of rare attacks. Normal boundary shrinkage improved Macro-F1 and Rare-Macro-F1 in the main experiment, while the prototype similarity term improved the Recall and F1 of some rare attack categories in the supplementary training. The effects of the three modules on different evaluation metrics are not entirely consistent. In practical use, the high-confidence normal threshold and fusion weights should be determined based on the macro-average F1 of the validation sample set.

[0158] Step 9: Using the trained binary XGBoost model, multi-class XGBoost model, rare attack global prototype, subclass prototype, and fusion parameters, classify the enterprise office network traffic samples to be detected and output the detection category.

[0159] Step 9.1: Perform the same numericalization, outlier handling, and missing value imputation on the enterprise office network traffic samples to be tested as during the training phase, ensuring that the number, order, and numerical types of traffic features in the samples to be tested remain consistent with those during model training. Missing value imputation uses the feature median calculated from the training sample set, without recalculating it based on the samples to be tested.

[0160] Step 9.2: Input the processed sample to be detected into the binary classification XGBoost model to obtain the normal probability, and determine the normal boundary region where the sample to be detected is located based on the attack threshold and the high-confidence normal threshold. If the normal probability is not lower than the high-confidence normal threshold, output BENIGN; if the normal probability is lower than the high-confidence normal threshold, continue to perform multi-class recognition and fusion decision.

[0161] Step 9.3: Obtain the class probability and leaf node embedding of the sample to be detected using a multi-class XGBoost model. Calculate the corresponding prototype similarity based on the leaf node embedding. Then, fuse the class probability, normal boundary suspicion, and prototype similarity as described in Step 7, and select the candidate class with the highest classification score as the detection class. In addition to the detection class, normal probability, normal boundary region, normal boundary suspicion, multi-class candidate class probability, rare attack prototype similarity, and model version can also be recorded for enterprise network security alert display, detection result verification, and subsequent model updates.

[0162] Conditional Generative Adversarial Networks (GANs) are used only during the model training phase to generate augmented samples of rare attacks against the target. During the detection phase, the generator and discriminator are no longer invoked, and no new network traffic samples are generated; the detection process only uses the trained binary XGBoost model, multi-class XGBoost model, rare attack prototypes, and fusion parameters.

[0163] When the traffic feature set, attack category set, or data distribution of an enterprise office network changes, data preprocessing, attack semantic transfer relationship determination, model training, prototype construction, and fusion parameter selection should be re-executed. After retraining the multi-class XGBoost model, the original leaf node numbers no longer correspond to the decision tree structure of the new model; therefore, it is necessary to reconstruct the global prototype and subclass prototype for rare attacks. When applied to different enterprise office networks, the parameters should be re-determined based on the actual protocols, business traffic, and attack samples of the target network, and the training results of this embodiment should not be directly used.

[0164] The foregoing description of the embodiments enables those skilled in the art to make or use the present invention. Various modifications to the embodiments will be readily apparent to those skilled in the art. The general principles of the invention may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention should not be limited to the embodiments shown herein, but should cover the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating semantic transfer samples and detecting boundary contraction in response to rare attacks on enterprise networks, characterized in that, The steps are as follows: S1. Preprocess the labeled enterprise network traffic samples and divide them into training sets, and establish an attack semantic transfer relationship table. S2. Select similar source attack samples corresponding to the rare attack category of the target according to the attack semantic transfer relationship table. Train the conditional generative adversarial network with similar source attack samples, target category encoding, attack semantic transfer encoding and random perturbation as conditions. Generate target rare attack enhancement samples and form an enhancement training set. The training weight of the enhancement samples is reduced according to the preset source credibility coefficient. S3. Train a binary classification XGBoost model using the augmented training set. Based on the output normal probability and the preset dual-threshold three-zone division strategy, divide the samples to be detected into high-confidence normal samples that directly output the normal category and samples to be identified that enter the attack category identification. S4. Train a multi-class XGBoost model using the augmented training set. Input the sample to be identified into the multi-class XGBoost model to obtain the class probability and leaf node number of each candidate class. Arrange the leaf node numbers into leaf node embeddings according to the order of each tree. Construct a global prototype and subclass prototype of rare attacks based on the rare attack samples in the augmented training set. Calculate the prototype similarity between the sample to be identified and the corresponding prototype.

2. The semantic transfer sample generation and boundary contraction detection method for rare attacks on enterprise networks according to claim 1, characterized in that, Step S1 preprocessing includes: quantifying enterprise network traffic samples, handling outliers, imputing missing values, and normalizing labels, and dividing the processed samples into training set, validation set, and test set.

3. The semantic transfer sample generation and boundary contraction detection method for rare attacks on enterprise networks according to claim 1, characterized in that, The attack semantic migration relationship table is established based on one or more of the following characteristics: attack stage, protocol behavior, access point, authentication behavior, and traffic statistics. When generating enhanced samples of rare attacks, the attack semantic transfer relationship table is queried according to the rare attack category to determine the candidate similar source attack category. When the rare attack category corresponds to multiple candidate similar source attack categories, a category is selected with moderate probability, and similar source attack samples are extracted from the real training samples of the selected category.

4. The semantic transfer sample generation and boundary contraction detection method for rare attacks on enterprise networks according to claim 1, characterized in that, In step S2, the generator of the conditional generative adversarial network combines similar source attack samples, target category encoding, attack semantic transfer encoding, and random perturbation into joint input according to feature dimensions and outputs the initial generated sample. Given the target category encoding and attack semantic transfer encoding, the discriminator distinguishes between rare attack samples of real targets and initially generated samples, calculates the adversarial loss based on the discrimination results, and updates the parameters of the generator and discriminator through backpropagation.

5. The semantic transfer sample generation and boundary shrinkage detection method for rare attacks on enterprise networks according to claim 4, characterized in that, The initial generated samples are sequentially subjected to target sample anchoring, source sample structure fusion, local perturbation, and numerical range truncation to finally obtain target rare attack enhancement samples. The target rare attack enhancement samples and the real training samples form the enhancement training set.

6. The semantic transfer sample generation and boundary contraction detection method for rare attacks on enterprise networks according to claim 1, characterized in that, In step S2, if the source credibility coefficient is less than 1, the training weight of a single target rare attack enhancement sample is the product of the training weight of a single real training sample of the same category and the source credibility coefficient. The number of augmented samples to be generated is determined based on the number of real training samples for each rare attack category, the preset augmentation factor, and the preset augmentation limit.

7. The semantic transfer sample generation and boundary contraction detection method for rare attacks on enterprise networks according to claim 1, characterized in that, The dual-threshold three-zone division strategy in step S3 is as follows: a preset attack threshold and a high-confidence normal threshold are set, and the high-confidence normal threshold is greater than the attack threshold; when the normal probability is greater than or equal to the high-confidence normal threshold, the sample to be detected is classified into the high-confidence normal core zone and the normal category is output. When the normal probability is greater than the attack threshold but less than the high-confidence normal threshold, the sample to be detected is classified into the suspicious boundary area; when the normal probability is less than or equal to the attack threshold, the sample to be detected is classified into the explicit attack area.

8. The semantic transfer sample generation and boundary contraction detection method for rare attacks on enterprise networks according to claim 7, characterized in that, The binary XGBoost model and the multi-class XGBoost model are connected through normal boundary region decision and normal boundary suspicion. For samples to be detected whose normal probability reaches the high-confidence normal threshold, their detection category is fixed as the normal category, and the category probability and prototype similarity output by the multi-class XGBoost model do not participate in the final category decision for that sample. For samples to be detected that fall into the suspicious boundary region or the clearly defined attack region, the category probability output by the multi-class XGBoost model and the leaf node embedding are used to identify candidate categories. The normal boundary suspicion is calculated based on the normal probability output by the binary XGBoost model, and the category probability, normal boundary suspicion, and prototype similarity output by the multi-class XGBoost model are fused to obtain the classification score for each candidate category. The high-confidence normal threshold, prototype similarity fusion weight, and normal boundary suspicion fusion weight are determined through discrete grid search on the validation set, and the macro-average F1 score of the validation set is used as the selection index for parameter combination.

Images