Differentially Private Synthetic Adversarial Network Traffic Generation Based on Tabular Diffusion Processes

IDS is becoming increasingly important as networks become more vulnerable to a variety of attacks. However, traditional ML and DL-based IDS have limited accuracy and false positive rates due to the lack of open adversarial network datasets and vendors' concerns regarding potential data leakage during the training process. To address these challenges, VAE and GAN-based network packet generation models have emerged, but they still face issues with low data fidelity. In this context, TabDDPM is a suitable option for generating network packets, as it surpasses VAE and GAN in accurately capturing data distribution characteristics and effectively learning the inherent structure of network packet formats. Despite its potential, research applying TabDDPM to network packet generation has not yet been explored. In this paper, we propose and evaluate DP-NetDDPM, a novel framework that enables adversarial network traffic generation while preserving both fidelity and privacy guarantees. Specifically, we examine the use of diffusion to generate adversarial network packet datasets and compare its performance with baseline models. Our framework focuses on three key criteria: data fidelity, adaptability for machine learning applications, and data privacy. The results show that DP-NetDDPM surpasses traditional models in both fidelity and adaptability, achieving a notable 72% improvement in fidelity and a 45% enhancement in adaptability over baselines.