Generation and diffusion-based detection method and detection system for anomalous traffic of industrial internet

Abstract

Disclosed in the present invention are a generation and diffusion-based detection method and detection system for anomalous traffic of an industrial Internet, comprising: extracting spatial features and temporal features from a public traffic data set by using a sliding packet window and a time window, and selecting a best feature set from all of the spatial features and the temporal features by using an information gain (IG) and an information gain ratio (IGR); constructing a pseudo-anomaly generator based on a tabular denoising diffusion probabilistic model (TabDDPM) and establishing an anomalous traffic detection model composed of the pseudo-anomaly generator and a discriminator; for the trained anomalous network traffic detection model, selecting an appropriate baseline function to determine whether cumulative traffic on a window is identified as anomalous; and deploying an anomalous network traffic detection model on a mobile device and performing real-time detection. According to the present invention, the most relevant few features are selected for training and classification, so as to achieve low delay and high-precision detection, and a more advanced generation model is used to make up for the defect of the lack of simulation of unknown anomalies.

Description

A method and system for detecting abnormal traffic in industrial Internet based on generation and diffusion Technical Field

[0001] The present invention relates to the field of industrial Internet security technology, and in particular to an industrial Internet abnormal traffic detection method and detection system based on generation diffusion. Background Art

[0002] As industrial control systems transition towards internet-based and intelligent systems, more and more devices and systems are connected online. This brings significant convenience, but also introduces numerous security risks. Malicious attackers may launch attacks on the Industrial Internet, causing system malfunctions or even downtime, resulting in severe economic losses and even threatening human life. Abnormal traffic detection technology, as a crucial component of information security, can effectively detect abnormal events in industrial networks that deviate from expected behavior patterns, efficiently and accurately locate threats within them, and ensure their security and stability. With the advancement of deep learning, various neural networks with powerful representation capabilities have taken abnormal traffic detection to new levels.

[0003] Existing deep learning-based methods, such as convolutional neural networks, restricted Boltzmann machines, long short-term memory networks, and generative adversarial networks, can fit complex network traffic data distributions and extract features from raw data. Compared to traditional rule-based methods, deep learning-based methods exhibit higher detection accuracy. However, the latter's strong detection capabilities rely on anomalous training data and feature extraction methods. If the training data contains an imbalance in the number of attack types and lacks anomalous patterns, this can lead to low detection recall and high false positive rates. To improve detection robustness, in 2022, Zecheng Li et al. employed adversarial learning to generate pseudo-anomalies adapted to high-dimensional spaces, improving detection sensitivity. However, due to unstable training of generative adversarial networks, some detections suffer from poor accuracy and recall. Furthermore, existing traffic feature extraction methods generally extract a single feature per packet, resulting in a large feature size and impracticality for real-time processing. While recently studied flow-level feature extraction methods can reduce the feature size by extracting features from a sequence of packet data, their coarse granularity reduces detection robustness. Currently, the poor real-time performance and low robustness of deep learning models for anomaly traffic detection have not been fully addressed.

[0004] Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide an industrial Internet abnormal traffic detection method and detection system based on generative diffusion, select a small number of the most relevant features for training and classification, thereby achieving low latency and high-precision detection, and using a more advanced generative model to make up for the defect of insufficient simulation of unknown anomalies.

[0006] To solve the above technical problems, the present invention provides an industrial Internet abnormal traffic detection method based on generated diffusion, comprising the following steps:

[0007] Step 1: Use sliding packet window and time window to extract spatial features and temporal features from the public traffic dataset, and then use information gain IG and information gain ratio IGR to select the best feature set from all spatial features and temporal features;

[0008] Step 2: Construct a pseudo-anomaly generator based on the tabular denoising diffusion probability model TabDDPM to reconstruct the randomly input Gaussian noise image into normal or abnormal samples;

[0009] Step 3: Establish an abnormal traffic detection model and loss function consisting of a pseudo-anomaly generator and a discriminator based on a generative adversarial network, and train and update the parameters of the generator and discriminator;

[0010] Step 4: For the trained network abnormal traffic detection model, select a suitable baseline function to determine whether the accumulated traffic in a window is identified as abnormal;

[0011] Step 5: Deploy the abnormal traffic detection model and perform real-time detection.

[0012] Preferably, in step 1, selecting the best feature set specifically includes the following steps:

[0013] Step 11: Use a sliding packet window and a time window to extract spatial and temporal features from the public traffic dataset. The size of the sliding packet window is 20,000 packets, and the size of the time window is 1,000 packets.

[0014] Step 12: Information gain is the difference between the information entropy of the parent node and the total information entropy of all its child nodes. The information gain rate is the information entropy of the parent node divided by the characteristic entropy. The characteristic entropy is calculated by formula (1):

[0015] Among them, p k Indicates the proportion of samples with the eigenvalue k in the sample set;

[0016] Step 13: Sort all spatial features and temporal features according to the information gain rate, and select the top 20 features with the largest information gain rate as the features in the best feature set.

[0017] Preferably, in step 2, constructing a pseudo-anomaly generator based on the table denoising diffusion probability model TabDDPM specifically includes the following steps:

[0018] Step 21: For tabular network traffic samples Contains N num numerical features and 2 categorical features (abnormal, normal) For each category K i , using one-hot encoding as input, the dimension of input x0 is N num +∑K i And use the Gaussian quantile transformation in the scikit-learn library for preprocessing;

[0019] Step 22: In the forward diffusion process of each feature classification sample based on TabDDPM, noise that satisfies the Gaussian distribution is gradually added to the sample until the entire sample becomes noise that satisfies the normal distribution after T time steps. In the reverse process, starting from the noise that satisfies the normal distribution, a multilayer perceptron with a Dropout layer is used to predict the mean and variance of the encoded sample in the previous time step. The multilayer perceptron has an output of the same dimension as x0, where the first N num The coordinates are the predictions of Gaussian diffusion, and after T time steps, the encoded network traffic samples are predicted;

[0020] Step 23, TabDDPM model minimizes the mean square error of Gaussian diffusion term And the KL divergence of each polynomial The loss function is calculated by formula (2):

[0021] Where C represents the number of categorical features.

[0022] Preferably, in step 3, establishing an abnormal traffic detection model and a loss function consisting of a pseudo-anomaly generator and a discriminator based on a generative adversarial network, and training and updating the parameters of the generator and the discriminator specifically include the following steps:

[0023] Step 31: The pseudo-anomaly generator is composed of multiple tabular denoising diffusion probability models TabDDPM, and each TabDDPM is trained with a different number of steps T so that their reconstruction capabilities are different.

[0024] Step 32: The discriminator is a binary classifier composed of a multi-layer fully connected neural network, which is trained using samples generated by the pseudo-anomaly generator and normal samples;

[0025] Step 33: The training of the complete abnormal traffic detection model includes the training of the pseudo-anomaly generator and the adversarial training of the discriminator. The discriminator is trained using adversarial training, and the loss function is calculated by formula (3):

[0026] Among them, D(x) represents the output of the discriminator for normal samples, and D(P(x)) represents the output of the discriminator for samples generated by the pseudo-anomaly generator.

[0027] Preferably, in step 4, selecting a suitable baseline function to determine whether the cumulative flow on a window is identified as abnormal is specifically as follows: selecting the maximum value of the empirical best baseline function and the statistical best baseline function as the baseline function;

[0028] Empirically optimal baseline function thres empirical It is the minimum baseline function when the trained model classifies normal data as 0, and the statistically optimal baseline function is thres stat =mean(prec)+3*std(prec), where mean() represents the mean function, std() represents the standard deviation function, and prec represents the prediction accuracy, which is calculated by formula (4):

[0029] Among them, TP represents the number of samples that the model accurately detects and labels as category X, and FN represents the number of samples that the model incorrectly labels as category Not-X.

[0030] Preferably, in step 5, deploying an abnormal traffic detection model and performing real-time detection specifically includes the following steps:

[0031] Step 51: When the model training is completed, the pseudo-anomaly generator is discarded and only the discriminator is deployed on the mobile device. The traffic data packets are pre-processed in a window to obtain the state vector of each traffic monitoring point. The interval between two adjacent monitoring points is the window size.

[0032] Step 52: The pre-processed data is input to the discriminator for identification. Each abnormal state in the same flow is accumulated. When it exceeds the baseline function, the flow is identified as abnormal.

[0033] Accordingly, an industrial Internet abnormal traffic detection system based on generated diffusion includes: an offline core model training module, an industrial Internet traffic data packet capture module, a data packet preprocessing module and a real-time abnormal traffic detection module; the offline core training module is connected to the real-time abnormal detection module, and the industrial Internet traffic data packet capture module is connected to the data packet preprocessing module and the real-time abnormal traffic detection module in sequence.

[0034] Preferably, the offline core model training module is used to obtain an abnormal traffic detection model by training the network traffic characteristics after preprocessing the public data set in an offline environment through a denoising diffusion model and a generative adversarial network. The trained abnormal traffic detection model can be called by the real-time anomaly detection module; the industrial Internet traffic data packet capture module is used to obtain the real-time traffic data packet of the industrial Internet.

[0035] Preferably, the data packet preprocessing module is used to extract time features and spatial features from a group of industrial Internet real-time traffic data packets according to the same preprocessing method as the training data to obtain preprocessed industrial Internet traffic features.

[0036] Preferably, the real-time abnormal traffic detection module detects the pre-processed industrial Internet traffic characteristics through the discriminator of the abnormal traffic detection model obtained by the training, and determines whether the accumulated abnormal state exceeds the baseline function, thereby obtaining the detection result.

[0037] The beneficial effects of the present invention are as follows: the present invention adopts a sliding data packet window and a time window to select a small number of the most relevant and representative features from the industrial Internet traffic data packet for training and classification, thereby reducing the scale of traffic features without affecting the accuracy of abnormal traffic detection, thereby realizing low-latency real-time detection; when training the abnormal traffic detection model offline, the present invention adopts a more advanced generator based on a denoising generative diffusion model to generate diverse abnormal traffic training samples, making up for the defect of insufficient simulation of unknown anomalies, improving the robustness and sensitivity of the model, and outperforming existing methods in terms of abnormal traffic detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] FIG1 is a schematic flow chart of the detection method of the present invention.

[0039] FIG2 is a schematic diagram of the detection system architecture of the present invention. DETAILED DESCRIPTION

[0040] As shown in Figure 1, a method for detecting abnormal traffic in the industrial Internet based on generation and diffusion includes the following steps:

[0041] Step 1: Sliding packet window and time window are used to extract spatial features and temporal features from the public traffic dataset, and then the information gain (IG) and information gain ratio (IGR) are used to select the best feature set from all spatial features and temporal features.

[0042] Step 1.1: Use sliding packet window and time window to extract spatial and temporal features from the public traffic dataset. The size of the sliding packet window is 20,000 packets, and the size of the time window is 1,000 packets.

[0043] Step 1.2: Information gain is the difference between the information entropy of the parent node and the total information entropy of all its child nodes. The information gain rate is the information entropy of the parent node divided by the characteristic entropy. The characteristic entropy is calculated by formula (1):

[0044] Among them, p k Indicates the proportion of samples with the eigenvalue k in the sample set.

[0045] Step 1.3: Sort all spatial features and temporal features according to the information gain rate, and select the top 20 features with the largest information gain rate as the features in the best feature set.

[0046] Step 2: Construct a pseudo-anomaly generator based on the tabular denoising diffusion probability model (TabDDPM) to reconstruct the randomly input Gaussian noise image into normal or abnormal samples.

[0047] Step 2.1: For tabular network traffic samples Contains N num numerical features and 2 categorical features (abnormal, normal) For each category K i , using one-hot encoding as input, so the dimension of input x0 is N num +∑K i The Gaussian quantile transform from the scikit-learn library was used for preprocessing.

[0048] Step 2.2: In the forward diffusion process of each feature classification sample based on TabDDPM, noise that satisfies the Gaussian distribution is gradually added to the sample until the entire sample becomes noise that satisfies the normal distribution after T time steps. In the reverse process, starting from the noise that satisfies the normal distribution, a multilayer perceptron with a Dropout layer is used to predict the mean and variance of the encoded sample in the previous time step. The multilayer perceptron has an output of the same dimension as x0, where the first N num The coordinates are the predictions of Gaussian diffusion. After T time steps, the encoded network traffic samples are predicted.

[0049] Step 2.3, TabDDPM model minimizes the mean square error of Gaussian diffusion term And the KL divergence of each polynomial The loss function is calculated by formula (2):

[0050] Where C represents the number of categorical features.

[0051] Step 3: Establish an abnormal traffic detection model and loss function consisting of a pseudo-anomaly generator and a discriminator based on a generative adversarial network, and train and update the parameters of the generator and discriminator.

[0052] Step 3.1: The pseudo-anomaly generator is composed of multiple tabular denoising diffusion probability models (TabDDPMs), and each TabDDPM is trained with a different number of steps T, such as T = 500, T = 1000, or T = 2000, so that their reconstruction capabilities are different.

[0053] Step 3.2, the discriminator is a binary classifier composed of a multi-layer fully connected neural network, which is trained using samples generated by the pseudo-anomaly generator and normal samples.

[0054] Step 3.3: The training of the complete abnormal traffic detection model includes the training of the pseudo-anomaly generator and the adversarial training of the discriminator. The training function of each TabDDPM in the pseudo-anomaly generator is shown in Step 2.3. The discriminator is trained using adversarial training, and the loss function is calculated by formula (3):

[0055] Among them, D(x) represents the output of the discriminator for normal samples, and D(P(x)) represents the output of the discriminator for samples generated by the pseudo-anomaly generator.

[0056] Step 4: For the trained network abnormal traffic detection model, select a suitable baseline function to determine whether the accumulated traffic in a window is identified as abnormal.

[0057] The maximum value of the empirical best baseline function and the statistical best baseline function is selected as the baseline function.

[0058] Empirically optimal baseline function thres empirical It is the minimum baseline function when the trained model classifies normal data as 0, and the statistically optimal baseline function is thres stat =mean(prec)+3*std(prec). Where mean() represents the mean function, std() represents the standard deviation function, and prec represents the prediction accuracy, which is calculated by formula (4):

[0059] Among them, TP represents the number of samples that the model accurately detects and labels as category X; FN represents the number of samples that the model incorrectly labels as category Not-X.

[0060] Step 5: Deploy the network abnormal traffic detection model and perform real-time detection.

[0061] Step 5.1: When model training is complete, the pseudo-anomaly generator is discarded and only the discriminator is deployed on the mobile device. Traffic packets are preprocessed over a window to obtain the state vector for each traffic monitoring point. The interval between two adjacent monitoring points is the window size.

[0062] Step 5.2: The preprocessed data is input into the discriminator for identification. Each abnormal state in the same flow is accumulated. When it exceeds the baseline function, the flow is identified as abnormal.

[0063] Example

[0064] In order to verify the effectiveness of the solution of the present invention, the following experiments were conducted. The experimental platform of the present invention is as follows: AMD 5600X CPU and 64GB RAM and GTX 3090 GPU. The present invention evaluated the abnormal traffic detection model on the NSL-KDD public traffic dataset using Python programming software Tensorflow and Keras. The NSL-KDD dataset is a revised version of the famous KDD'99 dataset. The experiment used a pseudo-anomaly generator consisting of four TabDDPM models with step sizes of 500, 800, 1200 and 1500 respectively. We used two state-of-the-art methods to compare with the method proposed in this invention on four indicators: accuracy, precision, recall and F-measure. Table 1 shows the 20 best feature sets based on the NSL-KDD dataset extracted in step 1.

[0065] Table 1 20 best feature sets based on NSL-KDD dataset

[0066] (1) Accuracy: It is the proportion of traffic that the model correctly classifies based on the total number of classifications. The larger the value, the better the performance.

[0067] (2) Precision: The proportion of classifications for a given category that are actually correct. The larger the value, the better the performance.

[0068] (3) Recall: The class-conditional accuracy of classified traffic and total traffic. The larger the value, the better the performance.

[0069] (4) F-measure: This indicates the effectiveness of precision and recall in measuring the accuracy of the model. The larger the value, the better the performance.

[0070] Among them, TP: the number of samples that the model accurately detects and labels as category X; FP: the number of samples that the model incorrectly labels as category X; FN: the number of samples that the model incorrectly labels as category Not-X; TN: the number of samples that the model accurately detects and labels as category Not-X.

[0071] Table 2 Accuracy comparison of different detection models on the NSL-KDD dataset

[0072] Analysis of experimental results: From the experimental results, it can be seen that the network abnormal traffic detection method proposed in the present invention is higher than the two compared models in terms of various indicators of accuracy, and the detection performance of the model is further improved.

Claims

1. A method for detecting abnormal traffic in industrial Internet based on generation diffusion, characterized in that: The steps include: Step 1: Use sliding packet window and time window to extract spatial features and temporal features from the public traffic data set, and then use information gain IG and information gain ratio IGR to select the best feature set from all spatial features and temporal features; Step 2: construct a pseudo-anomaly generator based on the tabular denoising diffusion probability model TabDDPM to reconstruct the randomly input Gaussian noise image into a normal or abnormal sample; Step 3: Establish an abnormal traffic detection model and loss function consisting of a pseudo-anomaly generator and a discriminator based on a generative adversarial network, and train and update the parameters of the generator and discriminator; Step 4: For the trained network abnormal traffic detection model, select a suitable baseline function to determine whether the accumulated traffic on a window is identified as abnormal; Step 5: Deploy the abnormal traffic detection model and perform real-time detection.

2. The method for detecting abnormal traffic in the industrial Internet based on generation diffusion as claimed in claim 1 is characterized in that: In step 1, selecting the best feature set specifically includes the following steps: Step 11: Use a sliding data packet window and a time window to extract spatial features and temporal features from the public traffic data set. The size of the sliding data packet window is 20,000 data packets, and the size of the time window is 1,000 data packets. Step 12: Information gain is the difference between the information entropy of the parent node and the total information entropy of all its child nodes. The information gain rate is the information entropy of the parent node divided by the feature entropy. The feature entropy is calculated by formula (1): Among them, p k Indicates the proportion of samples with the eigenvalue k in the sample set; Step 13: Sort all spatial features and temporal features according to the information gain rate, and select the top 20 features with the largest information gain rate as the features in the best feature set.

3. The method for detecting abnormal traffic in the industrial Internet based on generation diffusion as claimed in claim 1 is characterized in that: In step 2, constructing a pseudo anomaly generator based on the tabular denoising diffusion probability model TabDDPM specifically includes the following steps: Step 21: For table-type network traffic samples Contains N num numerical features and 2 categorical features For each category K i , using one-hot encoding as input, the dimension of input x0 is N num +∑K i And use the Gaussian quantile transformation in the scikit-learn library for preprocessing; Step 22: In the forward diffusion process of each feature classification sample based on TabDDPM, noise that satisfies Gaussian distribution is gradually added to the sample until the entire sample becomes noise that satisfies normal distribution after T time steps. In the reverse process, starting from the noise that satisfies normal distribution, a multilayer perceptron with a Dropout layer is used to predict the mean and variance of the encoded sample at the previous time step. The multilayer perceptron has an output of the same dimension as x0, where the first N num The coordinates are the predictions of Gaussian diffusion, and after T time steps, the encoded network traffic samples are predicted; Step 23: TabDDPM model minimizes the mean square error of Gaussian diffusion term And the KL divergence of each polynomial The loss function is calculated by formula (2): Where C represents the number of categorical features.

4. The method for detecting abnormal traffic in the industrial Internet based on generation diffusion as claimed in claim 1 is characterized in that: In step 3, an abnormal traffic detection model and loss function consisting of a pseudo-anomaly generator and a discriminator based on a generative adversarial network are established, and the parameters of the generator and discriminator are trained and updated. Specifically, the steps include: Step 31, the pseudo anomaly generator is composed of multiple tabular denoising diffusion probability models TabDDPM, and each TabDDPM is trained with a different number of steps T, so that their reconstruction capabilities are different; Step 32, the discriminator is a binary classifier, which is composed of a multi-layer fully connected neural network and is trained using samples generated by the pseudo-anomaly generator and normal samples; Step 33: The training of the complete abnormal traffic detection model includes the training of the pseudo-anomaly generator and the adversarial training of the discriminator. The discriminator is trained using adversarial training, and the loss function is calculated by formula (3): Among them, D(x) represents the output of the discriminator for normal samples, and D(P(x)) represents the output of the discriminator for samples generated by the pseudo-anomaly generator.

5. The method for detecting abnormal traffic in the industrial Internet based on generation diffusion as claimed in claim 1 is characterized in that: In step 4, a suitable baseline function is selected to determine whether the accumulated flow on a window is identified as abnormal. Specifically, the maximum value of the empirical best baseline function and the statistical best baseline function is selected as the baseline function; Empirically optimal baseline function thres empirical is the minimum baseline function when the trained model classifies normal data as 0, and the statistically optimal baseline function is thres stat =mean(prec)+3*std(prec), where mean() represents the mean function and std() represents represents the standard deviation function, and prec represents the prediction accuracy, which is calculated by formula (4): Among them, TP represents the number of samples that the model accurately detects and marks as category X, and FN represents the number of samples that the model incorrectly marks as category Not-X.

6. The method for detecting abnormal traffic in the industrial Internet based on generation diffusion as claimed in claim 1, characterized in that: In step 5, deploying the abnormal traffic detection model and performing real-time detection specifically includes the following steps: Step 51, when the model training is completed, the pseudo-anomaly generator will be discarded, and only the discriminator will be deployed on the mobile device to pre-process the traffic data packets on a window to obtain the state vector of each traffic monitoring point. The interval between two adjacent monitoring points is the window size; Step 52: The pre-processed data is input into the discriminator for identification. Each abnormal state in the same flow is accumulated. When it exceeds the baseline function, the flow is identified as abnormal.

7. A detection system using the industrial Internet abnormal traffic detection method based on generation diffusion as claimed in claim 1, characterized in that: include: Offline core model training module, industrial Internet traffic data packet capture module, data packet preprocessing module and real-time abnormal traffic detection module; the offline core training module is connected to the real-time abnormal traffic detection module, and the industrial Internet traffic data packet capture module is connected to the data packet preprocessing module and the real-time abnormal traffic detection module in sequence.

8. The industrial Internet abnormal traffic detection system based on generation diffusion as claimed in claim 7 is characterized in that: include: The offline core model training module is used to obtain an abnormal traffic detection model by training the network traffic features after preprocessing the public data set in an offline environment through a denoising diffusion model and a generative adversarial network. The trained abnormal traffic detection model can be called by the real-time anomaly detection module; the industrial Internet traffic data packet capture module is used to obtain the real-time traffic data packets of the industrial Internet.

9. The industrial Internet abnormal traffic detection system based on generation diffusion as claimed in claim 7 is characterized in that: It includes: a data packet preprocessing module is used to extract time features and spatial features from a group of industrial Internet real-time traffic data packets according to the same preprocessing method as the training data, and obtain the preprocessed industrial Internet traffic features.

10. The industrial Internet abnormal traffic detection system based on generation diffusion as claimed in claim 7 is characterized in that: include: The real-time abnormal traffic detection module detects the pre-processed industrial Internet traffic characteristics through the discriminator of the abnormal traffic detection model obtained by the training, and determines whether the accumulated abnormal state exceeds the baseline function, thereby obtaining the detection result.

Images