Analyzing DDoS Attack Classification with Data Imbalance Using Generative Adversarial Networks

DDoS attacks pose a significant threat to institutions and companies that rely on interconnected networks for their operations. Differentiating between malicious attacks and legitimate increases in web traffic is challenging, and existing defense systems struggle to identify and mitigate such attacks accurately. This study explores the impact of data imbalance on the classification of Distributed Denial of Service (DDoS) attacks and proposes a solution using synthetic data. The methodology involves data collection, preprocessing, synthetic data generation, and performance analysis. The CICDDoS2019 data set, containing over 20 million examples measured on 88 features, is used for evaluation. We generate synthetic data using a Generative Adversarial Network (GAN), focusing on three features of the original data set: time, attack type, and duration. The classification phase involved creating three distinct assemblies of the data. Varying the representation among the attack categories between balanced and imbalanced samples. We achieved this by handling the dataset: normally (imbalanced), sub-sampling to the minority class, and using GANs to generate an additional 2 million data points. A performance comparison between traditional classification methods (CNN, KNN, and XGBoost) and the use of GANs shows significant improvement. Traditional methods achieved 82-86% accuracy scores, while GANs achieved 98-99%. These findings highlight the impact of data imbalance on classification performance and demonstrate the effectiveness of GANs in mitigating the problem and enhancing accuracy. The study emphasizes the importance of considering data imbalance and innovative techniques like GANs in cybersecurity.