Flow-based Network Traffic Generation using Generative Adversarial Networks

TL;DR

This paper introduces a GAN-based method for generating realistic flow-based network traffic data, addressing the challenge of categorical attributes and proposing new evaluation techniques, to improve network intrusion detection system testing.

Contribution

It presents three preprocessing approaches for converting categorical network data into continuous form for GANs and a domain-knowledge-based evaluation method, advancing realistic traffic generation.

Findings

Two preprocessing approaches produce high-quality synthetic data

GANs effectively generate realistic flow-based network traffic

Proposed evaluation method assesses data quality using domain knowledge

Abstract

Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.