An improved anomaly traffic detection framework based on denoising diffusion implicit model
摘要
Detecting anomaly traffic is an important method for responding to cybersecurity threats. However, its accuracy and robustness are often limited by imbalanced data sets. To solve this problem, this paper proposes an anomaly traffic detection model based on an improved DDIM. The proposed method uses an autoencoder to fuse one-dimensional anomaly traffic features and convert them into two-dimensional grayscale images. This autoencoder-based conversion mechanism provides a unified data form for both data generation and classification. Then, improved DDIM models the latent distribution of traffic data through forward diffusion and reverse denoising. Improved DDIM generates high-quality and diverse anomaly samples, which reduces the model bias caused by the lack of anomaly data. The generated samples are classified by the SE-IncepCNN model. SE-IncepCNN uses an improved Inception structure to extract spatiotemporal features from low-resolution images and improves the ability to identify anomaly traffic. Compared with mainstream GAN-based methods, the proposed SE-IncepCNN classifier, trained on data augmented by our improved DDIM, achieves a detection accuracy of 95.56% on the NSL-KDD dataset, and the anomaly traffic identification rate increases by 32.16% under imbalance data set. Experimental results show that the improved DDIM greatly enhances anomaly traffic detection. Applied in the "Research on Feasibility Schemes and Simulation Environment Design for Unmanned Emergency Rescue in the Complex Environments of Northern Guangdong," this improvement substantially bolsters the practical defense capability of intrusion detection systems, enabling more robust identification of anomalous traffic patterns under complex operational conditions.