Encrypted traffic data set balancing method based on transform domain

Abstract

The invention discloses an encrypted traffic data set balancing method based on a transform domain. The method comprises the following steps of: firstly, transforming an unbalanced encrypted traffic data set into an image data set, and automatically generating and balancing a transform domain image set based on the strong generation capability of a GAN (Generic Area Network) in the aspect of images. The method mainly comprises the four steps of unbalanced original traffic set preprocessing, conversion of traffic session into images, GAN-based image generation and transform domain image set balancing. Through two modes consisting of automatic optimal trimming or manual self-defined trimming, any number of images can be generated, and balance of any generalization degree is supported. Compared with a method for directly generating and balancing original encrypted traffic, the method has the advantages of higher generation capability, lighter weight and higher universality. According to the method, an effective and universal solution is provided for solving the problems of few samples and unbalanced class distribution existing in a data set by a machine learning model of encrypted traffic.

Description

technical field [0001] The invention relates to the technical field of computer and network space security, in particular to a method for balancing an encrypted traffic data set based on a transformation domain. Background technique [0002] With the development of the world Internet, a large number of network communication services and software applications use encryption technology to ensure information security. Traffic encryption technology not only protects user privacy, but also enables malicious sabotage to evade the control of commonly used security detection technologies. The rapid increase in encrypted traffic hides many illegal activities such as cyber attacks, data leakage, and extortion services, which has become a major problem in national cyberspace security governance. There are huge differences in the difficulty of capturing and marking different types of malicious encrypted traffic, resulting in serious category imbalances in existing encrypted data sets, r...

AI Technical Summary

Problems solved by technology

[0004] In short, the encrypted traffic data set has the problems of small data volume and unbalanced categories, and the protocol type and format are not uniform, resulting in poor generalization ability of the model based on deep learning, heavy workload based on manual balancing, and traditional machine-generated original samples. The trimming method is complex, time-consuming and poor in versatility

Images