SD-CGAN: Conditional Sinkhorn Divergence GAN for DDoS Anomaly Detection in IoT Networks

TL;DR

SD-CGAN is a novel GAN framework using Sinkhorn Divergence and synthetic data augmentation for effective DDoS anomaly detection in IoT networks, addressing class imbalance and training stability.

Contribution

Introduces SD-CGAN, combining Sinkhorn Divergence with CTGAN-based augmentation, to enhance anomaly detection accuracy and stability in IoT edge environments.

Findings

Achieves higher detection accuracy than baseline models.

Maintains computational efficiency suitable for edge deployment.

Effectively handles class imbalance and training stability issues.

Abstract

The increasing complexity of IoT edge networks presents significant challenges for anomaly detection, particularly in identifying sophisticated Denial-of-Service (DoS) attacks and zero-day exploits under highly dynamic and imbalanced traffic conditions. This paper proposes SD-CGAN, a Conditional Generative Adversarial Network framework enhanced with Sinkhorn Divergence, tailored for robust anomaly detection in IoT edge environments. The framework incorporates CTGAN-based synthetic data augmentation to address class imbalance and leverages Sinkhorn Divergence as a geometry-aware loss function to improve training stability and reduce mode collapse. The model is evaluated on exploitative attack subsets from the CICDDoS2019 dataset and compared against baseline deep learning and GAN-based approaches. Results show that SD-CGAN achieves superior detection accuracy, precision, recall, and F1-score while maintaining computational efficiency suitable for deployment in edge-enabled IoT environments.