DBWE-Corbat: Background network traffic generation using dynamic word embedding and contrastive learning for cyber range. Issue 129 (June 2023)

• Record Type: Journal Article
• Authors: Du, Linfeng; He, Junjiang; Li, Tao; Wang, Yunpeng; Lan, Xiaolong; Huang, Yunhua
• Is Part Of: Computers & security. Issue 129(2023)
• Publication Date: 2023-06
• Subjects: Background network traffic -- Dynamic word embedding -- Network traffic generation -- Cyber range -- Contrastive learning; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2023.103202
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: Proposed a dynamic word embedding method (DB-WE) for intelligent feature extraction from background network traffic data. Introduced the contrastive learning method SimCSE for efficient generation of high-quality and numerous background network traffic. Developed DBWE-Corbat, a complete background network traffic generation model that integrates DB-WE and SimCSE. Demonstrated through extensive experiments that DBWE-Corbat can generate high-quality traffic data to satisfy the needs of cyber range construction. The proposed approach offers an efficient and intelligent method for generating background network traffic data that accurately captures the spatiotemporal characteristics of traffic. Abstract: Background network traffic generation is critical to replicating the real network environment in Cyber Range. But how to sufficiently extract the spatio-temporal features of traffic and generate superior background network traffic are still problems for the Cyber Range. In this paper, we propose a background network traffic generative model, DBWE-Corbat. Our solution relies on intelligent feature extraction based on the DB-WE dynamic word embedding method. Which consists of Doc2Vec and two Bidirectional Long Short-Term Memory (Bi-LSTM) layers. Specifically, first we convert the traffic feature tuple data into a static word vector. Then, we capture the spatio-temporal features of the traffic for characterization. Finally, we generate high-quality and numerous background network traffic by learning the feature distribution of small samples based on the contrastive learning model SimCSE. Extensive experiments show that our approach can generate high-quality traffic data. It meets the requirements of cyber range construction compared to other traffic generation methods.