Flow-based network traffic generation using Generative Adversarial Networks

• Published in: Computers & security Vol. 82; pp. 156 - 172
• Main Authors: Ring, Markus, Schlör, Daniel, Landes, Dieter, Hotho, Andreas
• Format: Journal Article
• Language: English
• Published: Amsterdam Elsevier Ltd 01-05-2019; Elsevier Sequoia S.A
• Subjects: Communications traffic; Cybersecurity; GANs; Generation; Generative adversarial networks; IDS; Image processing; Intrusion detection systems; IP (Internet Protocol); NetFlow; Traffic flow; TTUR WGAN-GP; TTUR WGAN-GP; NetFlow; IDS; Generation; GANs
• ISSN: 0167-4048; 1872-6208
• DOI: 10.1016/j.cose.2018.12.012

Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.