Diffusion-Driven Synthetic Tabular Data Generation for Enhanced DoS/DDoS Attack Classification

TL;DR

This paper introduces a diffusion-based method to generate synthetic minority class samples in tabular network intrusion data, significantly improving attack detection performance.

Contribution

It presents a novel application of denoising diffusion models for augmenting imbalanced tabular datasets in cybersecurity.

Findings

Near-perfect recall on minority attack classes

Effective handling of class imbalance in tabular data

Potential applications in fraud detection and medical diagnostics

Abstract

Class imbalance refers to a situation where certain classes in a dataset have significantly fewer samples than oth- ers, leading to biased model performance. Class imbalance in network intrusion detection using Tabular Denoising Diffusion Probability Models (TabDDPM) for data augmentation is ad- dressed in this paper. Our approach synthesizes high-fidelity minority-class samples from the CIC-IDS2017 dataset through iterative denoising processes. For the minority classes that have smaller samples, synthetic samples were generated and merged with the original dataset. The augmented training data enables an ANN classifier to achieve near-perfect recall on previously underrepresented attack classes. These results establish diffusion models as an effective solution for tabular data imbalance in security domains, with potential applications in fraud detection and medical diagnostics.