Generating Synthetic Tabular Data for DDoS Detection Using Generative Models

Distributed denial-of-service (DDoS) attacks are a type of cyber attack that overwhelms a target server, service or network with a flood of malicious traffic, making it unavailable to legitimate users. These attacks have become a major threat to the security of computer networks and systems, and effective intrusion detection systems (IDSs) are essential for detecting and mitigating these attacks. IDSs are used to monitor network traffic for malicious activity and can help detect and prevent DDoS attacks. Most IDSs are often designed to identify diverse types of attacks, but their efficacy can be limited when faced with attacks that exhibit extensive variations and sophisticated techniques, such as DDoS. In order to establish an effective IDS capable of identifying DDoS attacks, the acquisition of substantial volumes of labelled network data becomes crucial. This study aims to evaluate the performance of recent generative models in synthesising realistic tabular data to accurately emulate DDoS attack patterns. To achieve this, we used the CIC-DDOS2019 dataset, a comprehensive and modern collection of real-world DDoS attack scenarios. Leveraging state-of-the-art generative models, namely CTGAN, TVAE, and CopulaGAN, we synthesised realistic tabular data that emulated the characteristics and patterns observed in DDoS attack flow. We utilised various statistical metrics such as correlation scores, similarity and distance metrics, along with machine learning performance metrics, to quantitatively measure the performance of the generative models. The findings indicate that all three models have the ability to accurately emulate the patterns found in the real database, resulting in the generation of useful synthetic data. Specifically, among the classification methods used, the Random Forest method showed the most successful performance in detecting attacks with an accuracy of 99% when applied to the original dataset. In comparison, it achieved accuracy levels of 98%, 99%, and 93% when applied to datasets generated using the CTGAN, CopulaGAN, and TVAE models respectively. It can be concluded that generative networks have the potential to be useful in synthesising tabular data and may contribute to the overall performance of existing and future IDS. However, it is crucial to acknowledge that to cover a wider spectrum of attacks, more specific adjustments may need to be applied both in the data preprocessing stage and in the model architectures.