Generative adversarial networks for use in refining models for synthetic network traffic data
A system for refining one or more synthetic network traffic models is provided. The system generates synthetic network traffic data by applying a deterministic generative rule set to generate at least part of the synthetic network traffic data and applying a probabilistic generative model to generate at least part of the synthetic network traffic data. The system generates an assessment of the generated synthetic network traffic data by applying a deterministic discriminative rule set to the synthetic network traffic data and by applying a discriminative classifier model to the synthetic network traffic data. The system updates one or both of the probabilistic generative model and the discriminative classifier model based on the generated assessment.
1 . A system for training one or more cyber-analytics models based on refined synthetic network traffic data, the system comprising one or more processors configured to:
generate synthetic network traffic data, wherein generating the synthetic network traffic data comprises:
applying a deterministic generative rule set to generate at least part of the synthetic network traffic data, wherein the at least part of the synthetic network traffic data generated by applying the deterministic generative rule set comprises malformed network packets corresponding to known-genuine malicious behavior; and
applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values, wherein the at least part of the synthetic network traffic data generated by applying the probabilistic generative model comprises network traffic data similar to known-genuine network traffic data;
execute a discriminative classifier model configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
apply a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on the classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generate refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
train, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection.
2 . The system of claim 1 , wherein applying the deterministic generative rule set comprises enforcing a context-free grammar.
3 . The system of claim 1 , wherein generating the synthetic network traffic data comprises generating a plurality of synthetic network traffic packets.
4 . The system of claim 1 , wherein generating the synthetic network traffic data comprises generating synthetic IP address data.
5 . The system of claim 1 , wherein generating the synthetic network traffic data comprises generating synthetic message hash and identifier data.
6 . The system of claim 1 , wherein generating the synthetic network traffic data comprises generating synthetic data regarding a network traffic mode.
7 . The system of claim 1 , wherein generating the synthetic network traffic data comprises generating network time protocol (NTP) data.
8 . The system of claim 1 , wherein:
applying the deterministic generative rule set comprises, if a first data object is generated, requiring that set of one or more data objects related to the first data object also be generated; and
applying the probabilistic generative model comprises generating a data value for one or both of the first data object and the set of one or more data objects.
9 . The system of claim 1 , wherein:
applying the deterministic generative rule set comprises setting a predetermined range for a data value; and
applying the probabilistic generative model comprises generating the data value within the predetermined range.
10 . The system of claim 1 , wherein applying the deterministic generative rule set comprises enforcing temporal relationship criteria for a time-series of data objects.
11 . The system of claim 1 , wherein applying the deterministic generative rule set comprises enforcing a cross-correlation condition.
12 . The system of claim 1 , wherein applying the deterministic generative rule set comprises generating the synthetic network traffic data such that the synthetic network traffic data is configured to be processed by a router.
13 . A method for training one or more cyber-analytics models based on refined synthetic network traffic data, the method performed at a system comprising one or more processors, the method comprising:
generating synthetic network traffic data, wherein generating the synthetic network traffic data comprises:
applying a deterministic generative rule set to generate at least part of the synthetic network traffic data, wherein the at least part of the synthetic network traffic data generated by applying the deterministic generative rule set comprises malformed network packets corresponding to known-genuine malicious behavior; and
applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values, wherein the at least part of the synthetic network traffic data generated by applying the probabilistic generative model comprises network traffic data similar to known-genuine network traffic data;
executing a discriminative classifier model configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
applying a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on the classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generating refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
training, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection.
14 . A non-transitory computer-readable storage medium for training one or more cyber-analytics models based on refined synthetic network traffic data, the non-transitory computer-readable storage medium storing instructions configured to be executed by one or more processors of a system to cause the system to:
generate synthetic network traffic data, wherein generating the synthetic network traffic data comprises:
applying a deterministic generative rule set to generate at least part of the synthetic network traffic data, wherein the at least part of the synthetic network traffic data generated by applying the deterministic generative rule set comprises malformed network packets corresponding to known-genuine malicious behavior; and
applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values, wherein the at least part of the synthetic network traffic data generated by applying the probabilistic generative model comprises network traffic data similar to known-genuine network traffic data;
execute a discriminative classifier model configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
apply a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on the classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generate refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
train, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection.
15 . A system for training one or more cyber-analytics models based on refined synthetic network traffic data, the system comprising one or more processors configured to:
generate synthetic network traffic data, wherein generating the synthetic network traffic data comprises applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values;
generate an assessment of the generated synthetic network traffic data, wherein generating the assessment comprises:
applying a deterministic discriminative rule set to the synthetic network traffic data; and
applying a discriminative classifier model to the synthetic network traffic data, wherein the discriminative classifier model is configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
apply a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generate refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
train, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection,
wherein the generated synthetic network traffic data comprises (1) malformed network packets corresponding to known-genuine malicious behavior, and (2) network traffic data similar to known-genuine network traffic data.
16 . The system of claim 15 , wherein applying the deterministic generative rule set comprises enforcing a context-free grammar.
17 . The system of claim 15 , wherein:
applying the deterministic discriminative rule set to the synthetic network traffic data comprises generating deterministic discriminative rule set output data;
applying the discriminative classifier model to the synthetic network traffic data comprises generating discriminative classifier model output data; and
generating the assessment of the generated synthetic network traffic data comprises combining the deterministic discriminative rule set output data and the discriminative classifier model output data.
18 . The system of claim 15 , wherein:
applying the deterministic discriminative rule set comprises, if a first data object is present in the generated synthetic network traffic data, requiring that a set of one or more data objects related to the first data object also be present in the generated synthetic network traffic data; and
applying the discriminative classifier model comprises assessing a data value for one or both of the first data object and the set of one or more data objects.
19 . The system of claim 15 , wherein:
applying the deterministic discriminative rule set comprises requiring that a data value of the generated synthetic network traffic be within a predetermined range; and
applying the probabilistic generative model comprises assessing the data value within the predetermined range.
20 . A method for training one or more cyber-analytics models based on refined synthetic network traffic data, the method performed at a system comprising one or more processors, the method comprising:
generating synthetic network traffic data, wherein generating the synthetic network traffic data comprises applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values;
generating an assessment of the generated synthetic network traffic data, wherein generating the assessment comprises:
applying a deterministic discriminative rule set to the synthetic network traffic data; and
applying a discriminative classifier model to the synthetic network traffic data, wherein the discriminative classifier model is configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
applying a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generating refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
training, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection,
wherein the generated synthetic network traffic data comprises (1) malformed network packets corresponding to known-genuine malicious behavior, and (2) network traffic data similar to known-genuine network traffic data.
21 . A non-transitory computer-readable storage medium for training one or more cyber-analytics models based on refined synthetic network traffic data, the non-transitory computer-readable storage medium storing instructions configured to be executed by one or more processors of a system to cause the system to:
generate synthetic network traffic data, wherein generating the synthetic network traffic data comprises applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values;
generate an assessment of the generated synthetic network traffic data, wherein generating the assessment comprises:
applying a deterministic discriminative rule set to the synthetic network traffic data; and
applying a discriminative classifier model to the synthetic network traffic data, wherein the discriminative classifier model is configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
apply a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generate refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
train, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection, wherein the generated synthetic network traffic data comprises (1) malformed network packets corresponding to known-genuine malicious behavior, and (2) network traffic data similar to known-genuine network traffic data.
22 . A system for training one or more cyber-analytics models based on refined synthetic network traffic data, the system comprising one or more processors configured to:
generate synthetic network traffic data, wherein generating the synthetic network traffic data comprises:
applying a deterministic generative rule set to generate at least part of the synthetic network traffic data, wherein the at least part of the synthetic network traffic data generated by applying the deterministic generative rule set comprises malformed network packets corresponding to known-genuine malicious behavior; and
applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values, wherein the at least part of the synthetic network traffic data generated by applying the probabilistic generative model comprises network traffic data similar to known-genuine network traffic data;
generate an assessment of the generated synthetic network traffic data, wherein generating the assessment comprises:
applying a deterministic discriminative rule set to the synthetic network traffic data; and
applying a discriminative classifier model to the synthetic network traffic data, wherein the discriminative classifier model is configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
apply a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generate refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
train, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection.
23 . A method for training one or more cyber-analytics models based on refined synthetic network traffic data, the method performed at a system comprising one or more processors, the method comprising:
generating synthetic network traffic data, wherein generating the synthetic network traffic data comprises:
applying a deterministic generative rule set to generate at least part of the synthetic network traffic data, wherein the at least part of the synthetic network traffic data generated by applying the deterministic generative rule set comprises malformed network packets corresponding to known-genuine malicious behavior; and
applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values, wherein the at least part of the synthetic network traffic data generated by applying the probabilistic generative model comprises network traffic data similar to known-genuine network traffic data;
generating an assessment of the generated synthetic network traffic data, wherein generating the assessment comprises:
applying a deterministic discriminative rule set to the synthetic network traffic data; and
applying a discriminative classifier model to the synthetic network traffic data, wherein the discriminative classifier model is configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
applying a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generating refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
training, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection.
24 . A non-transitory computer-readable storage medium for training one or more cyber-analytics models based on refined synthetic network traffic data, the non-transitory computer-readable storage medium storing instructions configured to be executed by one or more processors of a system to cause the system to:
generate synthetic network traffic data, wherein generating the synthetic network traffic data comprises:
applying a deterministic generative rule set to generate at least part of the synthetic network traffic data, wherein the at least part of the synthetic network traffic data generated by applying the deterministic generative rule set comprises malformed network packets corresponding to known-genuine malicious behavior; and
applying a probabilistic generative model to generate at least part of the synthetic network traffic data by creating probabilistic variations using one or more random number generators to supply quasi-random values, wherein the at least part of the synthetic network traffic data generated by applying the probabilistic generative model comprises network traffic data similar to known-genuine network traffic data;
generate an assessment of the generated synthetic network traffic data, wherein generating the assessment comprises:
applying a deterministic discriminative rule set to the synthetic network traffic data; and
applying a discriminative classifier model to the synthetic network traffic data, wherein the discriminative classifier model is configured to receive the generated synthetic network traffic data and output a classification of the synthetic network traffic data as genuine or synthetic, wherein the discriminative classifier model comprises a deep learning architecture configured to recognize patterns in known-genuine network traffic data;
apply a minimax loss function or a Wasserstein loss function to iteratively refine the probabilistic generative model and the discriminative classifier model based at least in part on classification output by the discriminative classifier model, wherein iteratively refining the discriminative classifier model comprises varying neural weights of the deep learning architecture using gradient descent optimization;
generate refined synthetic network traffic data using the refined probabilistic generative model, wherein the refined synthetic network traffic data is classified as genuine by the refined discriminative classifier model; and
train, using the refined synthetic network traffic data, one or more cyber-analytics models configured to perform deep-packet inspection.