Flow-based Network Traffic Generation using Generative Adversarial Networks

Abstract

Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.

arXiv comment37 pages, submitted to Computer & Security

References in corpus (6)

• Efficient Estimation of Word Representations in Vector Space
• GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium
• NIPS 2016 Tutorial: Generative Adversarial Networks
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Adversarial Examples: Attacks and Defenses for Deep Learning
• DeepDGA: Adversarially-Tuned Domain Generation and Detection

Cited by in corpus (16)

• Deep Learning for Anomaly Detection: A Survey
• A Survey of Network-based Intrusion Detection Data Sets
• 5Greplay: a 5G Network Traffic Fuzzer -- Application to Attack Injection
• Network Intrusion Datasets: A Survey, Limitations, and Recommendations
• Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks
• Flow-based detection and proxy-based evasion of encrypted malware C2 traffic
• SynGAN: Towards Generating Synthetic Network Attacks using GANs
• SFE-GACN: A Novel Unknown Attack Detection Method Using Intra Categories Generation in Embedding Space
• Detecting unknown HTTP-based malicious communication behavior via generated adversarial flows and hierarchical traffic features
• Packet-Level Adversarial Network Traffic Crafting using Sequence Generative Adversarial Networks
• Data-Driven Network Intrusion Detection: A Taxonomy of Challenges and Methods
• High-Fidelity Cellular Network Control-Plane Traffic Generation without Domain Knowledge
• UoMo: A Universal Model of Mobile Traffic Forecasting for Wireless Network Optimization
• Probabilistic Outlier Detection and Generation
• STAN: Synthetic Network Traffic Generation with Generative Neural Models
• Log2NS: Enhancing Deep Learning Based Analysis of Logs With Formal to Prevent Survivorship Bias