Abstract: Cybersecurity threats have permeated all aspects of the railway industry, necessitating that railway cybersecurity ranges keep pace with the latest security demands. Background traffic is a core element in constructing a realistic simulation environment for cyber ranges and serves as a critical technology supporting range operations. However, effectively capturing the complex spatiotemporal characteristics of network traffic and generating highfidelity background traffic remains a significant challenge. This paper proposes a novel method for generating background traffic in railway cyber ranges (referred to as B2Diff). By integrating deep learning techniques such as BERT, bidirectional long shortterm memory networks, and diffusion models, the method captures features such as contextual semantics, spatiotemporal dependencies, and complex traffic distributions in traffic samples, thereby generating highly realistic and diverse background traffic. Experimental results demonstrate that B2Diff significantly outperforms existing methods in terms of the quality and diversity of the generated background traffic, validating its effectiveness in enhancing the simulation realism of cyber ranges.

Key words: background traffic; cyber range; diffusion model; network traffic generation; word embedding

摘要： 网络安全威胁已经渗入铁路行业方方面面，铁路网络安全靶场应跟进最新的网络安全需求.背景流量则是构建网络靶场逼真仿真环境的核心要素，是支撑靶场运营的重要技术.然而，如何有效捕捉网络流量复杂的时空特征并生成高保真背景流量仍是一项重大挑战.提出了一种新颖的铁路网络靶场背景流量生成方法(B2Diff)，通过结合BERT，BiLSTM和扩散模型等深度学习技术，实现流量样本上下文语义、时空依赖关系和复杂流量分布等特征的捕捉，进而生成高度真实且多样化的背景流量.实验结果表明B2Diff在所生成的背景流量的质量和多样性方面显著优于现有方法，验证了其在增强网络靶场仿真效果方面的有效性.

关键词: 背景流量；网络靶场；扩散模型；网络流量生成；词嵌入