# Research on the Simulation Method of HTTP Traffic Based on GAN
## 1 Introduction  
With the explosive development of the Internet, significant challenges have emerged in the field of security. These challenges arise from the need to protect personal information as well as the monitoring of massive network traffic. Additionally, there is an increasing threat posed by statistical analysis-based attacks, known as traffic analysis attacks [1]. Such attacks exploit network [2] traffic to analyze the trajectory and behavior of network communication users from the perspectives of statistics, real-time data behavior analysis, and big data. On the other hand, in the field of network maintenance and detection [3; 4; 5], a large amount of network data is typically required for various model training and validation purposes. During the model validation phase, trained classification models are used to differentiate between genuine and fake data. The method proposed in this paper precisely addressed the problem of generating high-quality network traffic. Existing traffic generators cannot guarantee the accuracy and authenticity of the synthesized traffic, often resulting in significant deviations. The quality and effectiveness of traffic are evaluated based on the correctness of the data types and the appropriateness of the labels. Even in real data, there are challenges in manually labeling a large amount of self-captured data, and the use of publicly available datasets may obscure sensitive information such as port numbers and IP addresses due to privacy concerns. This undoubtedly presents challenges for the research and development of network security. Currently, generative adversarial networks (GANs) have achieved excellent results in the field of image processing and audio/video domains [6; 7]. The advantage of GANs lies in their ability to learn from complex data distributions in a detailed manner. They can even generate high-resolution images that are indistinguishable from real ones based on pixel-level distribution patterns [8; 9; 10; 11; 12]. From the perspective of network traffic generation, our goal was to explore whether GANs can generate effective data-level features. Traffic obfuscation techniques involve concealing encrypted information within legitimate data packets to bypass protocol inspection. This involves disguising a certain protocol(source protocol) as another well-known protocol (target protocol) that is widely present in the network environment. As a result, it becomes challenging for attackers to identify hidden network traffic from a vast amount of normal network traffic. The term \"obfuscation\" originally appeared in the field of biology and refers to a species actively imitating certain characteristics of another species during the process of continuous biological evolution, in order to deceive predators or natural enemies. Traffic obfuscation techniques are new methods that significantly differ from traditional tunneling techniques [5]. Tunneling techniques involve encapsulating one network layer protocol into another protocol to traverse the network and reach another router. On the other hand, traffic obfuscation techniques transform known traffic data into another known data traffic through reshaping and variation, thus evading traffic analysis attacks. Traffic obfuscation techniques can achieve communication goals without the knowledge of regulators, which is the greatest advantage of this technology. Tunneling techniques, obviously, cannot guarantee this aspect. We summarize the main contributions of this paper in the following points:  
* A method based on Gaussian mixture models (GMM) was proposed for processing network data. * A method for generating data at the flow level was proposed. * The Swin Transformer was introduced into the field of network data generation. * The efficiency of the generative adversarial network architecture was further improved by combining evolutionary algorithms, leading to the proposed SEGAN (Swin evolutionary generative adversarial network) model.