3 results about "Traffic generation model" patented technology

The invention discloses a network flow generating and repairing method based on protocol constraint. The method comprises the following steps: analyzing an original traffic capture file, extracting basic features through stream-level recombination and session segmentation, and mapping a continuous time sequence and a discrete protocol field to a uniform feature space; and on the basis, constructing a diffusion type network flow generation model to capture a statistical attribute and time sequence dependency relationship of the network flow. In the generating or repairing process, a protocol state machine is constructed, protocol constraint is introduced in the reverse denoising stage, the sampling process is constrained through a legality guiding mechanism, and protocol logic violation in the generating process is avoided. And finally, through feature inverse mapping and virtual protocol stack state maintenance, reconstructing to obtain network flow data which meets a communication protocol specification and can be correctly analyzed by a real protocol stack. According to the method, the generation and repair of the network traffic can be realized under a unified framework, and the correctness of a result in protocol semantics is ensured.

The invention belongs to the technical field of traffic generation, and discloses a diversity-oriented industrial protocol format inference traffic generation method. Designing an adversarial flow generation model oriented to format inference, and isolating learning of flexible payload distribution from rigid syntactic enforcement by adopting a decoupled generation architecture; the generation process is separated from a deterministic rule, so that the traffic generation model can synthesize a high-entropy payload mode exceeding the finite diversity of an original sparse data set; by isolating flexible distributed learning from rigid syntactic enforcement, the FIGAN solves the internal conflict between syntactic effectiveness and semantic diversity, and a new normal form is provided for industrial traffic enhancement.

The application discloses a method for constructing an enhanced network threat detection model based on adversarial learning, comprising the steps of constructing a network threat detection model, constructing a threat traffic generation model, and combining the trained threat traffic generation model and the network threat detection model to obtain an enhanced network threat detection model. The application has the following beneficial effects: 1) for the emerging variant adversarial attack threat, the network threat detection model is enhanced through the adversarial training method, and the network threat detection model can better adapt to the real network environment; 2) based on WGAN, the variant attack traffic sample is generated, and the traffic sample closest to the to-be-detected traffic is screened out and replaced, so that the sample can meet the existing traffic distribution and can avoid the escape risk caused by the variant attack sample; 3) the black-box adversarial attack can be effectively coped with without assuming the variant adversarial path in advance.