A small sample generation method and an intrusion autonomous perception method for attacks on a special computer network

Abstract

The application discloses a kind of attack small sample generation and intrusion autonomous perception method for special computer network, belong to intelligent home control panel technical field, first acquisition special network flow data and carry out multimodal feature extraction and fusion, cover network layer, application layer and multidimensional features such as security log to construct high-dimensional feature space;Adaptive learning algorithm is used to automatically detect network topology change and dynamically update feature model, based on conditional generative adversarial network or variational autoencoder, with normal flow features as conditional input, through adversarial training or latent space reconstruction to generate synthetic attack samples.The application can effectively solve the problem of real attack sample acquisition difficulty, improve the authenticity of generated samples through multimodal feature fusion, realize automatic high-quality sample screening, dynamically adapt to network environment changes, significantly improve the efficiency of sample library construction and reduce model update time and computing resource cost.

Description

Technical Field

[0001] This invention belongs to the field of smart home control panel technology, and in particular to a method for generating small sample attacks and autonomously sensing intrusions for dedicated computer networks. Background Technology

[0002] With the rapid development of information technology, computer networks have permeated all aspects of national security, critical infrastructure operation, and social production and life. Their security protection capabilities are directly related to economic stability and social order. In the network security protection system, intrusion detection, as a core technology for proactively detecting threats, bears the crucial responsibility of identifying network anomalies and issuing early warnings of potential attacks. Based on detection principles, intrusion detection technologies mainly include two categories: misuse detection based on feature matching and anomaly detection based on statistical modeling. Based on data sources, they encompass various methods such as network traffic analysis, host log auditing, and endpoint behavior monitoring. The effective operation of these detection technologies relies on accurate modeling of known attack patterns or normal behavior benchmarks, providing crucial technical support for network security protection.

[0003] Intrusion detection technology for dedicated computer networks has attracted widespread attention due to the unique nature of their application scenarios. Dedicated computer networks typically refer to proprietary network systems serving specific industries or fields, such as industrial control networks, military communication networks, and financial transaction networks. Their traffic patterns are relatively stable, and their protocol specifications are relatively well-defined, providing an ideal research environment for intrusion detection. Existing intrusion detection schemes for dedicated networks mostly follow the detection framework for general networks, achieving the identification and early warning of known attack types by collecting network traffic data, extracting statistical or protocol features, and constructing classification models.

[0004] Existing publicly available patent documents, such as CN107277070A and CN108924129A, focus on passive detection and defense mechanisms in intrusion detection systems, employing feature matching or statistical anomaly detection methods to identify known attack behaviors. These technical solutions demonstrate high detection accuracy when dealing with known attack types, but often exhibit significant limitations when facing new or variant attacks.

[0005] Existing intrusion detection systems generally rely on known attack signature databases or pre-trained models. Their detection capabilities are limited by the completeness of the signature database and the coverage of the model training data. Once they encounter new attacks not included in the signature database or disguised variant attacks, the detection system struggles to identify them effectively. Furthermore, in dedicated network scenarios, due to the closed and unique nature of the network environment, obtaining a sufficient number and variety of real attack samples for model training is extremely difficult. Traditional methods that rely on a small number of known samples for learning are also insufficient to support the construction of high-quality detection models. Summary of the Invention

[0006] The purpose of this invention is to provide a method for generating small attack samples and autonomously detecting intrusions for dedicated computer networks, in order to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a method for generating small sample attacks and autonomously detecting intrusions in dedicated computer networks, comprising the following steps: Step 1: Collect dedicated network traffic data. The raw traffic data of the dedicated network is obtained in real time through the traffic acquisition module, and the data is cleaned and standardized in format. Step 2 involves multimodal traffic feature extraction and fusion, extracting network layer features, application layer features, and security log features respectively, and constructing a high-dimensional multimodal feature space. The network layer features include packet length statistics, protocol type distribution features, port statistics, and traffic time sequence statistics. The application layer features include request content features, domain name query patterns, and session statistics. The security log features include alarm records, session status, and event time sequence features. Step 3 executes dedicated network topology adaptive learning. The topology adaptive learning algorithm is embedded in the traffic acquisition and analysis module to automatically detect network topology changes and dynamically update the network feature model to ensure the accuracy and timeliness of feature extraction. Step 4 generates small attack samples. Based on a conditional generative adversarial network or variational autoencoder, the normal traffic characteristics of the dedicated network are used as conditional input. Through a generator-discriminator adversarial training mechanism or a latent space reconstruction mechanism, synthetic attack samples with attack semantics but different from known attack patterns are generated. Step 5 involves conducting adversarial testing and evaluation, constructing an adversarial evaluation framework, inputting the generated synthetic attack samples into the existing intrusion detection system, determining the validity of the samples based on the identification results of the detection system, and selecting high-quality attack samples that can bypass the detection. Step 6 performs multi-label automatic annotation, automatically generating classification labels for the generated synthetic attack samples, supporting multi-dimensional label annotation of attack type, threat level and attack stage; Step 7 implements incremental updates of the generative model. Design a generative model update architecture that supports incremental learning. When a new type of attack or a change in the network environment is detected, the model is incrementally trained without the need for full retraining.

[0008] Preferably, in step 1, the traffic acquisition module uses a passive traffic mirroring method to acquire network data. The traffic acquisition module is deployed on the bypass listening port of the aggregation switch or core switch of the dedicated network. The network interface of the traffic acquisition module supports Gigabit Ethernet or 10 Gigabit Ethernet specifications. The data cleaning process includes removing duplicate packets, correcting timestamps, and processing format anomalies. The data storage adopts a distributed time-series database.

[0009] Preferably, the network layer feature extraction in step 2 includes the mean packet length, standard deviation of packet length, maximum packet length, minimum packet length, protocol type distribution ratio, source port statistical features and destination port statistical features, traffic rate features per unit time, and connection duration features; the application layer feature extraction performs in-depth analysis on common dedicated network protocols such as HTTP, DNS, SMTP, and FTP to extract request method distribution, response code distribution, domain name query frequency, and file transfer size distribution.

[0010] Preferably, in step 2, the security log features and network traffic features adopt a time window-based alignment strategy. The time window size is a preset time window parameter. The aligned multimodal feature space is fused by feature splicing. Specifically, the network layer feature vector, application layer feature vector, and security log feature vector are directly spliced ​​in the feature dimension to form a unified high-dimensional feature vector representation.

[0011] Preferably, the topology adaptive learning algorithm in step 3 includes a network topology discovery module, a topology change detection module, and a feature model update module. The network topology discovery module constructs a network topology map based on device discovery protocols and traffic analysis results. The topology discovery protocols include ARP protocol scanning, LLDP protocol link discovery, and ICMP protocol probing. The topology change detection module detects the addition or removal of devices and link changes through periodic topology probing. When a topology change is detected, a feature model update operation is triggered.

[0012] Preferably, the conditional generative adversarial network in step 4 includes two deep neural network modules: a generator and a discriminator. The generator takes random noise vectors and condition vectors of normal traffic features as input and outputs synthetic attack sample features as output. The discriminator is used to distinguish between real attack samples and generated samples. The generator contains multiple hidden layers, which adopt a fully connected layer structure and are configured with batch normalization layers. The discriminator adopts a deep neural network architecture symmetrical to the generator, and the ratio of the number of generated samples to real samples is controlled within a preset ratio range.

[0013] Preferably, in step 4, the variational autoencoder adopts an encoder-decoder structure. The encoder maps normal traffic features to the latent space. The encoder contains multiple fully connected hidden layers. The latent space mapping layer of the encoder outputs the mean vector and standard deviation vector. The latent space dimension is a preset latent space dimension. The variational autoencoder achieves random sampling through reparameterization technology. The decoder reconstructs and generates attack sample features from the latent space sampling points. The loss function includes reconstruction loss and latent space distribution constraints.

[0014] Preferably, in step 5, the adversarial evaluation framework integrates multiple existing intrusion detection systems as evaluation benchmarks. The evaluation benchmarks cover detection systems based on feature matching, detection systems based on statistical anomaly detection, and detection systems based on machine learning classification. Synthetic attack samples are input into each evaluation benchmark for detection. The detection results are divided into three categories: bypass, successful identification, and uncertain. The validity of the sample is determined by a majority voting mechanism. When more than half of the evaluation benchmarks fail to identify the sample, it is determined to be a high-quality sample.

[0015] Preferably, in step 6, the multi-label automatic labeling module labels each generated sample with attack type label, threat level label, and attack stage label. Attack type labels include scanning, intrusion, denial-of-service, and data theft. Threat level labels include low, medium, high, and severe. Attack stage labels include reconnaissance stage, weaponization stage, delivery stage, and exploitation stage. The label vectors are associated with the sample feature data and stored in the sample library, supporting multi-dimensional retrieval functions.

[0016] Preferably, in step 7, the incremental update mechanism uses an experience replay strategy to retain a subset of historical samples. The sample retention ratio is a preset first retention ratio. During incremental training, newly generated samples are mixed with retained historical samples for training. The learning rate is adjusted to a preset learning rate adjustment ratio. Elastic weight solidification technology is used to protect important parameters from being covered. The elastic weight solidification technology determines the degree of protection for each parameter based on the parameter importance metric.

[0017] Compared with the prior art, the technical effects and advantages of the present invention are as follows: This method for generating small attack samples and autonomously detecting intrusions in dedicated computer networks achieves the first active generation of attack samples through conditional generative adversarial networks or variational autoencoders. It breaks through the limitation of existing technologies that rely on known attack feature libraries, provides data support for the research of new attacks in dedicated network environments, and effectively solves the technical problem of obtaining real attack samples. By employing a multimodal traffic feature fusion strategy, a high-dimensional feature space is constructed by integrating multi-dimensional information from the network layer, application layer, and security logs. This significantly improves the realism and complexity of the generated samples, ensuring a high degree of consistency between the feature distribution of the generated samples and real attack traffic. Through the adversarial testing evaluation framework, the generated samples are input into various existing intrusion detection systems for verification. A majority voting mechanism is used to automatically filter high-quality attack samples, and the filtering accuracy reaches a significant level, realizing the automation and quantification of the evaluation process. Through a dedicated network topology adaptive learning mechanism, the system automatically detects network topology changes and dynamically updates the feature model, ensuring that the system can still maintain accurate feature extraction capabilities when the network environment changes, and the feature model update response time meets the preset timeliness requirements. The attack type multi-label automatic labeling module automatically labels each generated sample with multi-dimensional labels such as attack type, threat level, and attack stage, reducing the workload of manual labeling, significantly improving labeling efficiency, and significantly improving the usability of the sample library. Attached Figure Description

[0018] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the overall technical solution architecture of the attack small sample generation and intrusion autonomous awareness method for dedicated computer networks of the present invention. Figure 2 This is a schematic diagram of the core framework for attacking small samples in this invention; Figure 3 This is a flowchart illustrating the logic of network traffic data collection, cleaning, and multimodal traffic feature extraction and fusion according to the present invention. Figure 4 This is a flowchart illustrating the logic of the dedicated network topology adaptive learning and dynamic feature model update of the present invention. Figure 5 This is a schematic diagram of the interaction and data flow between the adversarial testing evaluation and multi-label automatic annotation of the present invention; Figure 6 This is a schematic diagram of the framework of the incremental update mechanism for the generative model of the present invention. Detailed Implementation

[0020] In the following description, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described in order to avoid obscuring the invention.

[0021] Unless otherwise defined, the directions mentioned herein, such as up, down, left, right, front, back, inside, and outside, are based on the directions shown in the figures of this invention, and are explained here together.

[0022] This invention provides a method for generating small attack samples and autonomously detecting intrusions in dedicated computer networks. The method comprises seven core processing stages: traffic data acquisition, multimodal feature extraction and fusion, topology adaptive learning, attack small sample generation, adversarial testing and evaluation, automatic multi-label annotation, and incremental updating of the generation model. This method achieves proactive generation of attack samples through conditional generative adversarial networks or variational autoencoders, overcoming the limitations of traditional methods that rely on known attack feature libraries, and providing data support for research on novel attacks in dedicated network environments.

[0023] In step 1, during the dedicated network traffic data acquisition phase, the traffic acquisition module employs a passive traffic mirroring method to obtain network data. This module is deployed on the bypass listening port of the aggregation switch or core switch in the dedicated network. Through the switch's port mirroring function, it forwards copies of all traffic passing through the switch to the traffic acquisition module. The network interface of the traffic acquisition module supports Gigabit Ethernet or 10 Gigabit Ethernet specifications, enabling real-time acquisition at high-speed link rates. Specific acquisition rates can be configured to different levels, such as 1Gbps, 10Gbps, or 40Gbps, depending on the actual network bandwidth. Internally, the traffic acquisition module maintains a circular buffer for temporary storage of received network data packets. The buffer size is configured to range from 2GB to 8GB, employing zero-copy technology to reduce the overhead of copying data packets from the network card to memory.

[0024] The raw traffic data acquired by the acquisition module includes multi-layered protocol information such as Ethernet frame headers, IP packets, transport layer protocol headers, and application layer protocol payloads. The data cleaning process first performs a duplicate packet removal operation. This operation is based on a hash calculation of the unique identifier of the data packet. The identifier is composed of a five-tuple (source IP address, destination IP address, source port, destination port, transport layer protocol) and a timestamp field. The hash algorithm uses SHA-256 to ensure uniqueness and collision resistance. For consecutive packets with the same hash value, the packet with the earliest timestamp is retained, and the remaining duplicate packets are discarded. The timestamp correction operation in the data cleaning process addresses the timing disorder caused by network device clock asynchrony. It performs the following processing logic: comparing the local acquisition time with the protocol timestamp carried by the data packet, when the difference exceeds a preset time deviation threshold (default set to 100 milliseconds), the packet timestamp is corrected based on the local acquisition time. The timestamp correction algorithm uses a linear interpolation method, proportionally interpolating the timestamp of the intermediate packet between two consecutive packets with known correct timestamps.

[0025] The data cleaning process also includes a format anomaly handling operation, which detects and processes the following types of format anomalies: First, packet length anomalies—when the actual packet length does not match the length indicated by the IP header length field, the packet is marked as an anomaly. Second, protocol field anomalies—when checksums for transport layer protocols such as TCP and UDP fail, the packet is marked as an anomaly. Third, application layer protocol parsing anomalies—when the application layer protocol parser cannot correctly parse the protocol data, the packet is marked as an anomaly. Packets with format anomalies are filtered out in subsequent processing and do not participate in the feature extraction stage.

[0026] Data storage is implemented using a distributed time-series database. This database employs a time-series data storage engine, supporting high-speed writes and efficient time-series query operations. The distributed time-series database adopts a multi-node cluster deployment architecture. The number of nodes is configured based on network scale and storage requirements, typically deploying 3 to 5 data nodes to form a master-slave cluster. Each data node is configured with independent SSD storage media for write caching and index storage, and HDD storage media for long-term data archiving. The retention period for raw traffic data is set to a preset first storage period, which is configured based on storage resources and compliance requirements, with a default value of 30 days. The storage capacity estimation formula is: Storage capacity = Collection bandwidth × Retention period × Compression ratio, where the compression ratio is typically between 0.3 and 0.5. Sampled data is extracted from the raw traffic using a uniform sampling strategy. The sampling ratio is set to a preset sampling ratio parameter, with a default value of 0.01 (i.e., one percent sampling). The retention period for sampled data is set to a preset second storage period, with a default value of 180 days.

[0027] In step 2, during the multimodal traffic feature extraction and fusion stage, the system extracts features from three dimensions: network layer, application layer, and security logs, and constructs a high-dimensional multimodal feature space for subsequent attack sample generation tasks.

[0028] The network layer feature extraction module performs deep analysis on the cleaned network traffic data, extracting features based on a preset first feature dimension. This module first performs IP layer protocol parsing, identifying IPv4 and IPv6 packets and extracting the source and destination IP address fields. For IPv4 addresses, they are converted to 32-bit integers using dotted decimal notation; for IPv6 addresses, they are extracted as 128-bit values. The transport layer protocol parsing module identifies TCP and UDP protocol packets, extracting the source and destination port fields respectively, with the port number represented as a 16-bit unsigned integer. Network layer feature extraction includes the following specific statistical features: mean packet length, standard deviation of packet length, maximum packet length, minimum packet length, median packet length, and packet length quantiles (25th percentile, 75th percentile); protocol type distribution ratio, including the proportion of TCP, UDP, ICMP, and other protocol packets in the total; source port statistical features, including the entropy value of the source port, the Gini coefficient of the source port value distribution, and the frequency of occurrence of commonly used source ports (such as the high port number dynamic port range 49152-65535); and destination port statistical features, including the destination port... The entropy value of the port, the Gini coefficient of the destination port value distribution, and the port distribution by service category (such as HTTP service port 80, HTTPS service port 443, SSH service port 22, database service port 3306 / 5432, etc.); the traffic rate characteristics per unit time, which are statistically analyzed for inbound byte rate, outbound byte rate, inbound packet rate, and outbound packet rate within a preset time window (default 1 second); the connection duration characteristics, which are statistically analyzed for the TCP connection establishment duration distribution, including average connection duration, connection duration standard deviation, and the proportion of connections distributed by length interval.

[0029] The application-layer feature extraction module performs in-depth analysis of common dedicated network protocols such as HTTP, DNS, SMTP, and FTP, extracting features based on a pre-defined second feature dimension. The HTTP protocol parsing module extracts request method distribution features, statistically analyzing the frequency and percentage of various HTTP methods such as GET, POST, PUT, DELETE, and HEAD; extracts response code distribution features, statistically analyzing the frequency and percentage of various response status codes such as 2xx, 3xx, 4xx, and 5xx; extracts request header field features, including the length distribution of the User-Agent field, the value distribution of the Content-Type field, and the frequency of the Authorization field; and extracts request body features, including the mean, standard deviation, and maximum length of the request payload, as well as the byte frequency distribution of the request payload content. The DNS protocol parsing module extracts domain name query pattern features, including query type distribution (A record, AAAA record, MX record, CNAME record, etc.), query domain name length distribution, query domain name character distribution entropy value, and authoritative domain name server response time distribution; and extracts abnormal DNS query features, including the number of high-frequency queries for a single domain, the frequency of abnormally long domain names, and the frequency of uncommon top-level domains. The SMTP protocol parsing module extracts email transmission characteristics, including sender domain distribution, recipient domain distribution, email size distribution, attachment frequency, and attachment type distribution. The FTP protocol parsing module extracts file transmission characteristics, including FTP command type distribution, filename length distribution, file size distribution, and upload / download traffic ratio.

[0030] The security log feature extraction module extracts security-related features from multi-source log data, including security device logs, application system logs, and operating system logs in the dedicated network. Security log features include the following types: alarm record features, which statistically analyze the distribution of alarm numbers within a preset time window, classify alarms by alarm level (information level, warning level, danger level, emergency level), and calculate the alarm aggregation index (defined as the number of alarms generated by the same source IP address within a short time window); session state features, which extract the distribution of the number of active sessions, the session state transition probability matrix, and the session distribution classified by protocol; and event time sequence features, which extract the time interval distribution of critical security events, event sequence pattern features, and event density distributed by time period.

[0031] Security log features and network traffic features are fused using a time window-based alignment strategy. The time window size is a preset parameter, with a default setting of 1 minute. The core logic of this alignment strategy is as follows: the time axis is divided into equally spaced time windows, each containing network traffic feature data and log feature data collected within that time period. For each time window, multiple log records within it are aggregated into a feature representation for that window. Aggregation methods include counting aggregation (counting the number of log entries), vector aggregation (encoding log types into vectors and then summing them), and time series aggregation (preserving the temporal order information of log events). The total dimension of the aligned multimodal feature space is a preset fusion feature dimension. Multimodal fusion is achieved using feature concatenation. Specifically, the network layer feature vector, application layer feature vector, and security log feature vector are directly concatenated along the feature dimension to form a unified high-dimensional feature vector representation.

[0032] In step 3, during the dedicated network topology adaptive learning phase, a topology adaptive learning algorithm is embedded in the traffic acquisition and analysis module to automatically detect network topology changes and dynamically update the network feature model.

[0033] The core functional modules of the topology adaptive learning algorithm include a network topology discovery module, a topology change detection module, and a feature model update module. The network topology discovery module constructs a network topology map based on device discovery protocols and traffic analysis results. This module supports multiple topology discovery protocols, including ARP scanning, LLDP link discovery, CDP discovery (suitable for Cisco device environments), and ICMP probe. The ARP scanning module sends ARP request packets to all possible IP addresses within the network and obtains the IP address and MAC address mapping relationship of active hosts by collecting ARP response packets. The LLDP module obtains connection information of adjacent devices, including device identifiers, port identifiers, and device capabilities, by receiving and sending LLDP packets. The CDP module implements similar functions to the LLDP module, with specific adaptations for Cisco device environments. The ICMP probe module sends ICMP echo request packets to a specified range of IP addresses and determines the reachability of the target host based on the response.

[0034] The topology change detection module detects device additions / removals and link changes through periodic topology probing. The probing period is a preset first time period, with a default setting of 6 hours. During the probing process, the module sends topology probing packets to known network device IP addresses, collects the probing response results, and compares and analyzes them with the topology data from the previous probe. A topology change is determined when the following situations are detected: a new device is discovered (a new MAC address or IP address appears); a known device disappears (no response is received from the device within three consecutive probing periods); or the link status changes (the original link connection relationship changes, such as a port status change or a change in the peer device). The topology change detection module uses a differential comparison algorithm to implement change detection. This algorithm first extracts the device fingerprint information and link connection information from the current probe results, and then compares them item by item with the historical topology data stored in the database, generating a difference report. The difference report includes a list of newly added devices, a list of disappeared devices, and a list of changed links.

[0035] When a topology change is detected, the feature model update process is triggered. The feature model update module performs incremental updates to the network feature model based on the topology change report. The update operation includes the following processing logic: For newly added devices, a new device node representation is created for them in the feature model, and the relevant network area partitioning model is updated; for disappeared devices, the corresponding device node is marked as inactive, its historical data is retained for correlation analysis, and its contribution to the calculation of current active features is removed; for devices with link changes, the relevant network path features and traffic routing feature models are updated. The response time of the feature model update operation is less than a preset time threshold, set to 5 minutes by default, to ensure that the system can adapt to network topology changes in a short time.

[0036] In step 4, which generates small attack samples, the system uses conditional generative adversarial networks or variational autoencoders, with the normal traffic characteristics of a dedicated network as conditional input, and generates synthetic attack samples with attack semantics but different from known attack patterns through a generator-discriminator adversarial training mechanism or a latent space reconstruction mechanism.

[0037] When using a conditional generative adversarial network (GAN), the network comprises two deep neural network modules: a generator and a discriminator. These two modules are collaboratively optimized through adversarial training. The generator module employs a deep neural network architecture, containing an input layer, multiple hidden layers, and an output layer. The generator's input consists of two parts: the first part is a random noise vector, sampled from a standard normal distribution, with the vector dimension set to a preset noise vector dimension (default 100 dimensionality); the second part is a conditional vector, obtained by preprocessing the normal traffic features of a dedicated network. The preprocessing operations include feature standardization (mapping feature values ​​to a standard normal distribution with a mean of 0 and a standard deviation of 1) and feature dimensionality reduction (projecting the high-dimensional feature vector to a low-dimensional conditional space using principal component analysis). The generator's hidden layers employ a fully connected layer structure, with 5 hidden layers configured. The number of neurons in each layer is 512, 1024, 1024, 512, and 256, respectively. The ReLU activation function is used, and batch normalization layers are configured between the hidden layers to stabilize the training process. The generator's output layer has the same number of neurons as the feature dimension of the target attack sample, and the output layer activation function uses the Tanh function to map the output value to the -1,1 interval.

[0038] The discriminator module also employs a deep neural network architecture to distinguish between real attack samples and generated samples. The input to the discriminator is a sample feature vector, including both real attack samples and synthetic attack samples generated by the generator. The hidden layer structure of the discriminator is symmetrical to that of the generator, with the number of neurons in each layer being 256, 512, 1024, 1024, and 512 respectively. The output layer of the discriminator contains a single neuron, and the output layer activation function is the sigmoid function. The output value represents the probability that the input sample is judged as a real attack sample.

[0039] The training process of the Conditional Generative Adversarial Network (GAN) employs the following adversarial training mechanism: In each training iteration, firstly, the generator parameters are fixed, and the discriminator parameters are updated. The discriminator's optimization objective is to maximize the output of high probability values ​​for real attack samples and low probability values ​​for synthetic attack samples. Secondly, the discriminator parameters are fixed, and the generator parameters are updated. The generator's optimization objective is to minimize the discriminator's discrimination probability for generated samples, even if the generated samples can deceive the discriminator. The loss function used is the binary cross-entropy loss function, and the discriminator's loss function is: ,in This refers to the batch sample size. The label for the real sample (with a value of 1). This is a real attack sample. It is a random noise vector. For conditional vectors, The synthetic attack sample output by the generator. This is the output of the discriminator. The generator's loss function is: The training process uses the Adam optimizer, with an initial learning rate of 0.0002, a first-order moment estimation decay rate of 0.5, a second-order moment estimation decay rate of 0.999, a batch size of 64, and a preset number of training iterations (default value 500).

[0040] The ratio of the number of generated samples to the actual samples is controlled within a preset range, which is set to the default value. to That is, for every 1 real attack sample generated, the generator generates 1 to 3 synthetic attack samples. This ratio parameter can be adjusted according to the actual application scenario. When more samples need to be generated for model training, the generation ratio of synthetic samples can be appropriately increased.

[0041] When using the variational autoencoder method, the autoencoder employs an encoder-decoder structure to reconstruct and generate attack sample features. The encoder module maps normal traffic features to the latent space. The encoder uses a deep neural network architecture, including an input layer, multiple hidden layers, and a latent space mapping layer. The input to the encoder is the normal traffic feature vector from a dedicated network, which is preprocessed before being input into the network. The hidden layer structure of the encoder is similar to the generator of a conditional generative adversarial network, containing five fully connected hidden layers with the following number of neurons: 512, 1024, 1024, 512, and 256, respectively. The ReLU activation function is used. The latent space mapping layer of the encoder contains two output branches: one branch outputs the latent space mean vector, and the other branch outputs the latent space standard deviation vector. The dimensions of both vectors are preset to the latent space dimension, which is set to 64 dimensions by default.

[0042] Variational autoencoders implement random sampling operations through reparameterization techniques. The core idea of ​​reparameterization is to transfer randomness from network parameters to independent random variables. Specifically, this is achieved by first sampling random variables from a standard normal distribution, and then... Calculate latent space sampling points ,in This is the mean vector output by the encoder. The standard deviation vector of the encoder output. This represents element-wise multiplication. Reparameterization techniques enable gradients to propagate back to the encoder parameters, achieving end-to-end learning of the latent space representation.

[0043] The decoder module reconstructs attack sample features from latent space sampling points. The decoder employs a deep neural network architecture symmetrical to the encoder, comprising an input layer, multiple hidden layers, and an output layer. The decoder's input layer receives latent space sampling points. The hidden layer structure is symmetrical to the encoder but in reverse order, with the number of neurons in each layer being as follows: The ReLU activation function is used. The number of neurons in the decoder's output layer is the same as the dimension of the input flow features, and the Tanh activation function is used in the output layer.

[0044] The loss function of a variational autoencoder consists of two parts: reconstruction loss and latent spatial distribution constraints. The reconstruction loss uses the mean squared error loss function, defined as: ,in For feature dimension, The original input features, The features of the decoder output are reconstructed. The latent spatial distribution constraint uses the KL divergence loss function, defined as... ,in The latent spatial posterior distribution learned by the encoder. Let be the prior distribution (standard normal distribution). The total loss function is: ,in The weight coefficients for the potential spatial distribution constraints are set to 0.1 by default. The training process also uses the Adam optimizer, with an initial learning rate of 0.001 and a preset number of training iterations (default value 300).

[0045] In step 5, during the adversarial testing and evaluation phase, the system constructs an adversarial evaluation framework, inputs the generated synthetic attack samples into the existing intrusion detection system, determines the validity of the samples based on the identification results of the detection system, and filters out high-quality attack samples that can bypass the detection.

[0046] The adversarial evaluation framework integrates multiple existing intrusion detection systems as evaluation benchmarks. The selection of these benchmarks follows a diversity principle, covering feature-matching-based detection systems, statistical anomaly detection-based detection systems, and machine learning classification-based detection systems. Feature-matching-based detection systems identify known attack patterns through rule matching. These systems maintain an attack feature rule base and detect attack features in traffic using pattern matching algorithms. Statistical anomaly detection-based detection systems establish normal traffic statistical models to detect abnormal traffic deviating from the normal model. These systems typically employ threshold alarm mechanisms, triggering alarms when traffic feature values ​​exceed preset thresholds. Machine learning classification-based detection systems identify attack traffic through pre-trained classification models. These systems use supervised or semi-supervised learning algorithms to train the classifier and output attack type labels for the traffic.

[0047] Synthetic attack samples are input into each evaluation benchmark for detection, and the detection process employs batch processing to improve efficiency. For each synthetic attack sample, each evaluation benchmark outputs its own detection result, which is divided into three categories: the first category is bypass, indicating that the evaluation benchmark failed to identify the sample as attack traffic and determined it to be normal traffic; the second category is successful identification, indicating that the evaluation benchmark correctly identified the sample as attack traffic; and the third category is uncertain, indicating that the evaluation benchmark cannot clearly determine the category of the sample, which usually occurs when the sample characteristics are normal and the attack boundary is ambiguous.

[0048] The validity of a sample is determined using a majority voting mechanism, with the following specific rules: The distribution of detection results across different evaluation benchmarks is statistically analyzed. If more than half of the evaluation benchmarks show a bypass result, the sample is considered a high-quality attack sample, possessing strong concealment and effectively bypassing the detection systems of multiple systems. If more than half of the evaluation benchmarks show a successful identification result, the sample is considered a low-quality attack sample, with weak concealment and easily identified by existing detection systems. If the distribution of detection results across all evaluation benchmarks is relatively balanced, the validity of the sample is uncertain and requires further evaluation through manual review.

[0049] High-quality attack samples are stored in the sample library, low-quality attack samples are placed in the regeneration queue to trigger the generator to regenerate, and uncertain samples are placed in the manual review queue for judgment by security experts. After multiple rounds of adversarial testing, evaluation, and screening, the proportion of high-quality attack samples accumulated in the sample library has gradually increased, and the quality of the sample library has been continuously optimized.

[0050] In step 6, during the multi-label automatic annotation stage, the system automatically generates classification labels for the generated synthetic attack samples, supporting multi-dimensional label annotation such as attack type, threat level, and attack stage, thereby improving the usability and searchability of the sample library.

[0051] The multi-label automatic annotation module's label generation strategy is based on the feature analysis results of synthetic attack samples. It automatically infers the label category of each sample through a pre-trained classification model. Attack type labels are determined using a multi-classification model with a deep neural network architecture. The input is the feature vector of the synthetic attack sample, and the output is the probability distribution of each attack type. Attack type labels include the following categories: scanning attacks (including port scanning, vulnerability scanning, host scanning, etc.); intrusion attacks (including unauthorized access, privilege escalation, buffer overflow exploitation, etc.); denial-of-service attacks (including bandwidth-consuming attacks, resource-consuming attacks, protocol vulnerability attacks, etc.); data theft attacks (including sensitive data extraction, credential theft, communication data interception, etc.); and malicious code attacks (including Trojan implantation, virus propagation, ransomware, etc.).

[0052] Threat level labels are determined using a multi-classification model, and include the following levels: Low risk, indicating that the attack may cause minor impact with a limited scope; Medium risk, indicating that the attack may cause moderate impact, requiring attention but no emergency response; High risk, indicating that the attack may cause serious impact, potentially leading to system malfunction or data breach; and Severe risk, indicating that the attack may cause extremely serious consequences, requiring immediate emergency response measures. The threat level determination model comprehensively considers multiple dimensions of factors, including the inherent harmfulness of the attack type, the importance of the target, and the potential scope of impact after a successful attack.

[0053] Attack phase labels are determined using a sequence labeling model, which divides attack phases based on a network attack kill chain model. Attack phase labels include the following phases: Reconnaissance phase: Attackers gather information and probe targets, including network scanning, fingerprinting, and vulnerability detection; Weaponization phase: Attackers prepare attack tools and payloads, including malicious code development, exploit code construction, and delivery carrier creation; Delivery phase: Attackers transmit the attack payload to the target system, including phishing email delivery, watering hole attacks, and supply chain contamination; Exploitation phase: Attackers trigger and execute the attack payload, including vulnerability exploitation, privilege acquisition, and lateral movement; Installation phase: Attackers install persistent backdoors on the target system, including backdoor program implantation and establishing covert channels; Command and control phase: Attackers establish communication connections with the implanted backdoor to achieve remote control; Target achievement phase: Attackers complete the preset attack objectives, including data theft and system damage.

[0054] The multi-label automatic annotation module outputs multiple label categories for each generated sample, forming a multi-dimensional label vector representation. These label vectors are stored in the metadata area of ​​the sample library, supporting retrieval, filtering, and statistical analysis by label category. For example, security researchers can use the label search function to quickly obtain all samples of a specific attack type, or filter samples with a specific threat level for analysis and research in specific scenarios.

[0055] In step 7, the incremental update stage of the generative model is implemented. The system is designed to support the incremental learning generative model update architecture. When a new type of attack or a change in the network environment is detected, the model is incrementally trained without the need for full retraining, thus improving the efficiency of model update.

[0056] The core components of the incremental update mechanism include an experience replay buffer, an incremental training scheduler, and a model parameter updater. The experience replay buffer employs a priority experience replay strategy to retain a subset of historical samples. The buffer capacity is set to a preset parameter, with a default value of 10,000 samples. The priority experience replay strategy samples based on their importance weights, which are defined as follows: ,in For the sample The timing difference error, This is the priority index parameter (default setting is 0.6), a small constant to prevent weights from being zero (default setting is 0.01). The sample retention ratio is the preset first retention ratio, defaulting to 0.3, meaning that after each update operation, the experience replay buffer retains... The historical samples were replaced by new samples.

[0057] The incremental training scheduler manages the triggering conditions and training parameter configurations for incremental training. Triggering conditions include the following categories: periodic triggering, which automatically triggers incremental training according to a preset incremental training cycle (default is 7 days); event triggering, which triggers incremental training when a new attack feature is detected; and manual triggering, which is initiated manually by the administrator as needed. Incremental training parameter configurations include learning rate adjustment, batch size configuration, and training iteration count configuration.

[0058] During incremental training, the scheduler mixes newly generated samples with historical samples retained in the experience replay buffer to form the training dataset. The learning rate is adjusted to a preset learning rate adjustment ratio, which defaults to 0.5 times the original learning rate, using a smaller learning rate to avoid new samples overwriting existing knowledge. The incremental training period is a preset second time period, which defaults to 24 hours. The time taken for a single incremental training session is less than the preset percentage of the time taken for full training, which defaults to 0.1, meaning the time taken for a single incremental training session does not exceed 10% of the time taken for full training.

[0059] The model parameter updater employs an elastic weight fixation technique to protect important parameters from being overwritten. This technique determines the degree of protection for each parameter based on a parameter importance metric. Specifically, it calculates an importance metric for each model parameter. ),in To train the loss function, For the first Parameter values ​​after the training iteration The parameter values ​​are the values ​​before incremental training; calculate the parameter update amount. ,in For learning rate, This is the elastic weight fixation coefficient (default setting is 0.5). Through elastic weight fixation, parameters with higher importance are protected during incremental training, while parameters with lower importance are more easily updated, thus achieving a balance between learning new knowledge and preserving old knowledge.

[0060] The following detailed explanation of the operation process and key parameter settings of the method of the present invention is provided with reference to a specific application example. Assume that the method of the present invention is deployed in a dedicated defense network containing approximately 500 host devices with a network bandwidth of 10Gbps. The main business systems include a command and control system, an intelligence processing system, and a communication support system. The application protocols running within the network include HTTP, HTTPS, DNS, SMTP, FTP, and several dedicated application protocols.

[0061] In the data acquisition phase of step 1, the traffic acquisition module is deployed on the mirror port of the core switch and configured to collect full traffic data. The network interface of the acquisition module uses a 10Gbps fiber optic network card, supporting full-duplex operation. The buffer size of the acquisition module is set to 4GB, and zero-copy packet capture is achieved using the DPDK development kit. After the data cleaning module performs duplicate packet removal, the amount of raw traffic data is reduced by approximately 15%, the proportion of abnormally formatted packets is approximately 2%, and the proportion of valid packets retained after cleaning is approximately 83%. The raw traffic data is stored in three data nodes of the distributed time-series database. Each node is configured with 2TB SSD storage medium for caching and indexing, and 8TB HDD storage medium for archiving. The retention period for raw traffic is set to 30 days, and the retention period for sampled data is set to 180 days.

[0062] In the feature extraction stage of step 2, the network layer feature extraction module processes approximately 50,000 data packets per second, extracting 512 dimensions of features, including 128 dimensions of packet length statistics, 64 dimensions of protocol distribution, 128 dimensions of port statistics, 128 dimensions of traffic rate, and 64 dimensions of connection features. The application layer feature extraction module parses approximately 40% of HTTP traffic, 20% of DNS traffic, 10% of SMTP traffic, 5% of FTP traffic, and 25% of dedicated protocol traffic, extracting 256 dimensions of application layer features. The security log feature extraction module collects firewall logs, intrusion detection logs, and system security logs, with a total of approximately 1,000 records collected per second, extracting 128 dimensions of log features. The time window size for time window alignment is set to 60 seconds, and the total dimensions of the aligned multimodal fusion feature space are set to 896 dimensions.

[0063] In the topology adaptive learning phase of step 3, the topology discovery module uses a combination of ARP scanning and LLDP discovery for network probing. The ARP scan covers 500 IP addresses across the entire network segment, with a scan cycle set to 6 hours and a scan time of approximately 30 seconds. The topology change detection module detected the following changes in the network topology: the addition of two host devices (IP addresses 192.168.1.100 and 192.168.1.101), one switch device (IP address 192.168.0.50), and the disconnection of one existing link and the addition of one backup link. The topology change triggers a feature model update operation, with an update response time of approximately 3 minutes, meeting the preset 5-minute time threshold requirement.

[0064] In the attack sample generation stage of step 4, a conditional generative adversarial network (GAN) method is used to generate attack samples. The input noise vector of the generator is set to 100 dimensions, and the conditional vector is set to 64 dimensions (obtained by projecting fused features from 896 dimensions through principal component analysis). The generator contains 5 hidden layers with 512, 1024, 1024, 512, and 256 neurons in each layer, using the ReLU activation function and the Tanh activation function in the output layer. The discriminator adopts a symmetric structure, and the Sigmoid activation function is used in the output layer. The Adam optimizer is used during training, with a learning rate of 0.0002, a batch size of 64, and 500 training iterations. The ratio of generated samples to real samples is set to 2:1, meaning that 2 synthetic attack samples are generated in each training iteration. In the scenario of a dedicated defense network, the attack sample feature distribution learned by the generator can cover traffic features of various attack types, including scanning, intrusion, and denial-of-service attacks.

[0065] In the adversarial testing and evaluation phase of step 5, the evaluation benchmarks integrated three intrusion detection systems: a feature matching detection system based on Snort rules, a statistical anomaly detection system based on the Naive Bayes algorithm, and a machine learning classification detection system based on the random forest algorithm. During the evaluation process, 1000 synthetic attack samples output by the generator were input into each evaluation benchmark for detection. The detection results showed that approximately 350 samples were identified as bypassed by more than half of the evaluation benchmarks (high-quality samples), approximately 450 samples were identified as successfully detected by more than half of the evaluation benchmarks (low-quality samples), and approximately 200 samples had a balanced distribution of evaluation results (uncertain samples). High-quality samples were stored in a sample library, low-quality samples were entered into a regeneration queue, and uncertain samples were entered into a manual review queue.

[0066] In the multi-label automatic annotation stage of step 6, the labeling results of high-quality samples are as follows: Attack type label distribution: scanning 30%, intrusion 40%, denial-of-service 25%, other types 5%; Threat level label distribution: low risk 15%, medium risk 35%, high risk 35%, severe 15%; Attack stage label distribution: reconnaissance stage 25%, weaponization stage 15%, delivery stage 20%, exploitation stage 30%, other stages 10%. The label vectors are associated with the sample feature data and stored in the sample database, supporting multi-dimensional retrieval.

[0067] In the incremental update phase of the generative model in step 7, the experience replay buffer capacity is set to 10,000 samples, and the sample retention ratio is set to 0.3. Upon detecting a new denial-of-service attack feature, the incremental training process is triggered. Incremental training uses 0.5 times the original learning rate, with a batch size of 32 and 100 training iterations. Incremental training takes approximately 45 minutes, accounting for 9% of the total training time (500 minutes), meeting the preset 10% time requirement. After incremental training, the generator model can effectively generate sample features of the new denial-of-service attack, and the model update achieves the expected results.

[0068] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for generating small sample attacks and autonomously detecting intrusions in dedicated computer networks, characterized in that, Includes the following steps: Step 1: Acquire raw traffic data of the private network in real time through the traffic acquisition module, and perform data cleaning and format standardization processing; Step 2: Extract network layer features, application layer features, and security log features respectively to construct a high-dimensional multimodal feature space. The network layer features include packet length statistics, protocol type distribution features, port statistics, and traffic time series statistics. The application layer features include request content features, domain name query patterns, and session statistics. The security log features include alarm records, session status, and event time series features. Step 3: Embed a topology adaptive learning algorithm in the traffic acquisition and analysis module to automatically detect network topology changes and dynamically update the network feature model to ensure the accuracy and timeliness of feature extraction; Step 4: Based on conditional generative adversarial networks or variational autoencoders, using the normal traffic characteristics of the dedicated network as conditional input, and through generator-discriminator adversarial training mechanisms or latent space reconstruction mechanisms, generate synthetic attack samples with attack semantics but different from known attack patterns.

2. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 1, characterized in that, Also includes: Step 5: Construct an adversarial evaluation framework, input the generated synthetic attack samples into the existing intrusion detection system, determine the validity of the samples based on the identification results of the detection system, and screen out high-quality attack samples that can bypass the detection. Step 6: Automatically generate classification labels for the generated synthetic attack samples, supporting multi-dimensional labeling of attack type, threat level, and attack stage; Step 7: Design a generative model update architecture that supports incremental learning. When a new type of attack or change in the network environment is detected, the model is incrementally trained without the need for full retraining.

3. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 2, characterized in that, In step 1, the traffic acquisition module uses a passive traffic mirroring method to acquire network data. The traffic acquisition module is deployed on the bypass listening port of the aggregation switch or core switch of the dedicated network. The network interface of the traffic acquisition module supports Gigabit Ethernet or 10 Gigabit Ethernet specifications. The data cleaning process includes removing duplicate packets, correcting timestamps, and processing format anomalies. The data storage adopts a distributed time-series database.

4. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 3, characterized in that, The network layer feature extraction in step 2 includes the mean packet length, standard deviation of packet length, maximum packet length, minimum packet length, protocol type distribution ratio, source port statistical features and destination port statistical features, traffic rate features per unit time, and connection duration features.

5. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 4, characterized in that, The application layer feature extraction performs in-depth analysis of common dedicated network protocols such as HTTP, DNS, SMTP, and FTP to extract the distribution of request methods, response codes, domain name query frequency, and file transfer size.

6. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 5, characterized in that, In step 2, the security log features and network traffic features adopt a time window-based alignment strategy. The time window size is a preset time window parameter. The aligned multimodal feature space is fused by feature splicing. Specifically, the network layer feature vector, application layer feature vector, and security log feature vector are directly spliced ​​in the feature dimension to form a unified high-dimensional feature vector representation.

7. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 6, characterized in that, The topology adaptive learning algorithm in step 3 includes a network topology discovery module, a topology change detection module, and a feature model update module. The network topology discovery module constructs a network topology map based on the device discovery protocol and traffic analysis results.

8. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 7, characterized in that, In step 4, the conditional generative adversarial network includes two deep neural network modules: a generator and a discriminator. The generator takes random noise vectors and condition vectors as inputs to normal traffic features and outputs synthetic attack sample features. The discriminator is used to distinguish between real attack samples and generated samples. The generator contains multiple hidden layers.

9. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 8, characterized in that, The hidden layer adopts a fully connected layer structure and is configured with a batch normalization layer. The discriminator adopts a deep neural network architecture symmetrical to the generator, and the ratio of the number of generated samples to the real samples is controlled within a preset ratio range.

10. The attack small sample generation and intrusion autonomous awareness method for dedicated computer networks according to claim 9, characterized in that, In step 4, the variational autoencoder adopts an encoder-decoder structure. The encoder maps normal traffic features to the latent space. The encoder contains multiple fully connected hidden layers. The latent space mapping layer of the encoder outputs the mean vector and standard deviation vector. The latent space dimension is a preset latent space dimension. The variational autoencoder achieves random sampling through reparameterization technology. The decoder reconstructs and generates attack sample features from the latent space sampling points. The loss function includes reconstruction loss and latent space distribution constraints.

Images