TempoNet: Learning Realistic Communication and Timing Patterns for Network Traffic Simulation

TL;DR

TempoNet is a new generative model that accurately simulates realistic network traffic, including timing and communication patterns, to improve cybersecurity testing and training environments.

Contribution

It introduces a novel combination of multi-task learning and multi-mark temporal point processes for realistic network traffic generation, addressing limitations of previous methods.

Findings

TempoNet captures complex temporal and correlation patterns in network traffic.

Models trained on TempoNet data perform comparably to those trained on real data in intrusion detection.

Validated on real-world datasets with high fidelity and temporal consistency.

Abstract

Realistic network traffic simulation is critical for evaluating intrusion detection systems, stress-testing network protocols, and constructing high-fidelity environments for cybersecurity training. While attack traffic can often be layered into training environments using red-teaming or replay methods, generating authentic benign background traffic remains a core challenge -- particularly in simulating the complex temporal and communication dynamics of real-world networks. This paper introduces TempoNet, a novel generative model that combines multi-task learning with multi-mark temporal point processes to jointly model inter-arrival times and all packet- and flow-header fields. TempoNet captures fine-grained timing patterns and higher-order correlations such as host-pair behavior and seasonal trends, addressing key limitations of GAN-, LLM-, and Bayesian-based methods that fail to reproduce structured temporal variation. TempoNet produces temporally consistent, high-fidelity traces, validated on real-world datasets. Furthermore, we show that intrusion detection models trained on TempoNet-generated background traffic perform comparably to those trained on real data, validating its utility for real-world security applications.