A Multi-Model Framework for Synthesizing High-Fidelity Network Intrusion Data Using Generative AI

The rapid evolution of network technologies and frequent network intrusions have amplified the demand for intrusion detection systems (IDSs) powered by artificial intelligence (AI). However, the performance of IDSs is limited by labeled intrusion data and class imbalances in existing datasets. Collecting such data through live network simulations is costly, insecure, and poses regulatory challenges. This paper presents a multi-model framework that uses a conditional tabular generative adversarial network (CTGAN) to synthesize realistic network intrusion data. The framework addresses challenges such as unstable training, mode collapse, and handling mixed data types, which are common in most generative AI models when applied to non-Gaussian tabular data generation while validating the synthesized data through qualitative and quantitative analyses. Overlaid density histograms and cumulative distribution functions (CDFs) are used for qualitative analysis. For quantitative analysis, the train-real-test-synthetic (TRTS) and train-synthetic-test-real (TSTR) methods, as well as the Kolmogorov-Smirnov (KS) test, are utilized. The TRTS and TSTR methods are classifier-based approaches with classification accuracies of 98.36% and 97.95%, respectively, and are used to assess the synthesized intrusion data to ensure the interchangeability of the synthesized intrusion data and real-world intrusion data for training IDSs. The KS test results indicate a similarity score of 0.92 between real and synthesized data. Additionally, to provide interpretable insights into the performance of the model and refrain from using real-world intrusion data for analysis purposes, the framework employs an explainable AI (XAI) approach called local interpretable model-agnostic explanation (LIME), enabling network security analysts to interpret features that influence the intrusive nature of the synthesized network intrusion data while preserving data privacy.