BGA：一种针对高熵加密流中恶意签名提取的抗噪神经蒸馏框架
BGA: A noise-immune neural distillation framework for malicious signature extraction in high-entropy encrypted flows
- School of Cyber Science and Technology, Beihang University（北京航空航天大学网络空间科学与技术学院）
- Beijing Electronic Science and Technology Institute（北京电子科技学院）
- School of Information and Communication Engineering, Beijing University of Posts and Telecommunications（北京邮电大学信息与通信工程学院）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
针对高熵加密流恶意签名提取的注意力稀释与类别不平衡问题，本文提出抗噪神经蒸馏框架BGA，结合ANOVA、WGAN-GP、BiLSTM与自适应门控多头注意力，在基准测试中性能优异且延迟低，具备工业边缘实时应用潜力。
AI中文摘要：
为缓解高熵TLS 1.3流中的注意力稀释问题，本文提出BGA——一种针对加密威胁的抗噪神经蒸馏框架。该方法首先采用方差分析（ANOVA），从随机密码噪声中解耦高区分度的控制平面特征，具体为工业设定值。为解决包含86878条流记录的语料库内的极端类别不平衡问题，本文集成了带梯度惩罚的Wasserstein GAN（WGAN-GP）模块，该模块强制执行1-Lipschitz约束，以合成高保真的少数类样本，将罕见恶意状态命令注入（MSCI）攻击的检测召回率提升了43.2%。BGA架构的核心是集成双向长短期记忆网络（BiLSTM）用于时间依赖提取，以及自适应门控多头注意力机制。该门控单元作为神经滤波器，动态抑制加密伪影同时放大恶意签名。在CIC-IDS-2018和Edge-IIoT基准上的大量评估表明，所有关键指标的性能上限超过95.2%。此外，噪声注入压力测试证实，BGA的结构韧性更优，与普通Transformer相比性能优势达8.57%，其极低的推理延迟为0.2820 ms（通过ARM理论缩放估计为1.6920 ms），显示出在异构工业边缘网关上实现实时应用的巨大潜力，为未来硬件实现提供了有前景的架构基线。
英文摘要：
To mitigate attention dilution in high-entropy TLS 1.3 flows, we propose BGA, a noise-immune neural distillation framework for encrypted threat intelligence.The methodology first employs Analysis of Variance (ANOVA) to decouple high-discriminatory control-plane features - specifically industrial setpoints - from stochastic cryptographic noise. To resolve the extreme class imbalance within a corpus of 86,878 flow records, a Wasserstein GAN with Gradient Penalty (WGAN-GP) module, enforcing the 1-Lipschitz constraint, is integrated to synthesize high-fidelity minority samples, elevating the detection recall of rare Malicious State Command Injections(MSCI) attacks by 43.2%. At its core, the BGA architecture integrates Bidirectional Long Short-Term Memory (BiLSTM) for temporal dependency extraction and an Adaptive Gated Multi-Head Attention mechanism. This gated unit functions as a neural filter to dynamically suppress encryption artifacts while amplifying malicious signatures. Extensive evaluations on CIC-IDS-2018 and Edge-IIoT benchmarks demonstrate a performance ceiling exceeding 95.2% across all key metrics. Furthermore, noise-injection stress tests confirm BGAs superior structural resilience with a 8.57% performance margin over vanilla Transformers, while its ultra-low inference latency of 0.2820 ms (estimated 1.6920 ms via theoretical scaling for ARM) indicates a high potential for real-time feasibility on heterogeneous industrial edge gateways, providing a promising architectural baseline for future hardware implementation.
