MAGE-ID: A Multimodal Generative Framework for Intrusion Detection Systems

TL;DR

This paper presents MAGE-ID, a diffusion-based multimodal generative framework that enhances intrusion detection systems by synthesizing cross-domain network traffic data, improving detection accuracy and addressing data imbalance.

Contribution

MAGE-ID introduces a novel multimodal generative approach combining tabular and image data using diffusion models, Transformer, and CNN encoders for improved IDS data augmentation.

Findings

Outperforms TabSyn and TabDDPM in fidelity and diversity

Enhances downstream intrusion detection performance

Effective in balancing and synthesizing multimodal network data

Abstract

Modern Intrusion Detection Systems (IDS) face severe challenges due to heterogeneous network traffic, evolving cyber threats, and pronounced data imbalance between benign and attack flows. While generative models have shown promise in data augmentation, existing approaches are limited to single modalities and fail to capture cross-domain dependencies. This paper introduces MAGE-ID (Multimodal Attack Generator for Intrusion Detection), a diffusion-based generative framework that couples tabular flow features with their transformed images through a unified latent prior. By jointly training Transformer and CNN-based variational encoders with an EDM style denoiser, MAGE-ID achieves balanced and coherent multimodal synthesis. Evaluations on CIC-IDS-2017 and NSL-KDD demonstrate significant improvements in fidelity, diversity, and downstream detection performance over TabSyn and TabDDPM, highlighting the effectiveness of MAGE-ID for multimodal IDS augmentation.