Abstract:

To address the detection bottlenecks of traditional deep learning methods in handling high-dimensional and dynamic network traffic, this paper proposed DiffGuard, an unsupervised anomaly detection framework. The framework reframed anomaly detection as a generative inpainting task, distinguishing itself from reconstruction-based methods by integrating the generative denoising power of diffusion models with adaptive sequence modeling techniques. Through a conditional reverse denoising process, DiffGuard restored the normal form of a potentially anomalous sequence and quantified the anomaly score by the reconstruction error between the original and the restored data. To enhance temporal modeling, the framework incorporated a Transformer-based conditional encoder to capture long-term dependencies. Concurrently, an adaptive sequence length mechanism based on traffic entropy was designed to dynamically adjust the analysis window to adapt to traffic dynamics. Experiments show that DiffGuard achieves an F1-score of 0.965 on the CIC-IDS-2018 dataset, outperforming mainstream methods. It also obtains an F1-score of 0.955 in detecting stealthy attacks such as Web penetration. The results validate the effectiveness and application potential of the proposed method in complex network security scenarios.

Key words: network security, anomaly detection, diffusion models, unsupervised learning, traffic analysis