用扩散模型生成更逼真的网络攻击数据,提升防御系统检测能力。
Packet-Level DDoS Data Augmentation Using Dual-Stream Temporal-Field Diffusion
- 双流结构:空间流捕捉时间模式,场流映射网络特征到扩散模型
- 生成数据与真实流量统计相似度更高,提升下游检测准确率
- 适合网络安全研究者、需要高质量训练数据的攻防模型开发者
针对分布式拒绝服务(DDoS)攻击,当前机器学习解决方案的效果高度依赖于标注训练数据的质量。为缓解数据稀缺问题,常采用合成流量进行数据增强。然而,现有合成方法难以捕捉新兴DDoS攻击中复杂的时序模式和空间分布,导致生成数据与真实流量差异大,影响检测性能。本文提出双流时序场扩散模型(DSTF-Diffusion),基于扩散模型构建多视角、多流的网络流量生成框架。其中,场流通过空间映射将网络数据特征与预训练的稳定扩散模型对齐,有效将复杂网络交互转换为扩散模型可处理的形式;空间流则采用动态时序建模,精细捕捉流量的内在时间规律。大量实验表明,本模型生成的数据在统计特性上更接近真实数据,显著提升多种下游任务的性能。
原文摘要 · Abstract (English)
In response to Distributed Denial of Service (DDoS) attacks, recent research efforts increasingly rely on Machine Learning (ML)-based solutions, whose effectiveness largely depends on the quality of labeled training datasets. To address the scarcity of such datasets, data augmentation with synthetic traces is often employed. However, current synthetic trace generation methods struggle to capture the complex temporal patterns and spatial distributions exhibited in emerging DDoS attacks. This results in insufficient resemblance to real traces and unsatisfied detection accuracy when applied to ML tasks. In this paper, we propose Dual-Stream Temporal-Field Diffusion (DSTF-Diffusion), a multi-view, multi-stream network traffic generative model based on diffusion models, featuring two main streams: The field stream utilizes spatial mapping to bridge network data characteristics with pre-trained realms of stable diffusion models, effectively translating complex network interactions into formats that stable diffusion can process, while the spatial stream adopts a dynamic temporal modeling approach, meticulously capturing the intrinsic temporal patterns of network traffic. Extensive experiments demonstrate that data generated by our model exhibits higher statistical similarity to originals compared to current state-of-the-art solutions, and enhance performances on a wide range of downstream tasks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。