Flow-based network traffic generation using Generative Adversarial Networks

Abstract

Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation.A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.However, labeled data sets are necessary for training supervised data mining methods (e.g. classification algorithms) and provide the basis for evaluating the performance of supervised as well as unsupervised data mining algorithms.Objective. Large training data sets with high variance can increase the robustness of anomaly-based intrusion detection methods. Therefore, we intend to build a generative model which allows us to generate realistic flow-based network traffic. The generated data can be used to improve the training of anomaly-based intrusion detection methods as well as for their evaluation. To that end, we propose an approach that is able to learn the characteristics of collected network traffic and generates new flow-based network traffic with the same underlying characteristics. Approach and Contributions. Generative Adversarial Networks (GANs) [4]are a popular method to generate synthetic data by learning from a given set of input data. GANs consist of two networks, a generator network G and a 2 discriminator network D. The generator network G is trained to generate synthetic data from noise. The discriminator network D is trained to distinguish generated synthetic data from real world data. The generator network G is trained by the output signal gradient of the discriminator network D. G and D are trained iteratively until the generator network G is able to fool the discriminator network D. GANs achieve remarkably good results in image generation [5,6,7,8]. Furthermore, GANs have also been used for generating text [9] or molecules [10]. This work uses GANs to generate complete flow-based network traffic with all typical attributes. To the best of our knowledge, this is the first work that uses GANs for this purpose. GANs can only process continuous input attributes. This poses a major challenge since flow-based network data consist of continuous and categorical attributes. Consequently, we analyze different preprocessing strategies to transform categorical attributes of flow-based network data into continuous attributes. The first method simply ...

NetFlow Monitoring and Cyberattack Detection Using Deep Learning With Ceph

“…It can attain very excellent anomaly detection efficiency in network traffic data by extracting the CNN's spatial characteristics and the LSTM model's temporal characteristics. In [17], Markus Ring et al suggested a new technique to produce pseudo-NetFlow information based on the generation of an anti-neural network (GAN), which can produce excellent outcomes for detection and generation. The primary challenge is that GAN can handle only ongoing characteristics, and Net-Flow generally has various characteristics of classification.…”

Flow-based Detection and Proxy-based Evasion of Encrypted Malware C2 Traffic

“…packet byte-streams to be even harder to generate abiding to constraints but easier to break because the detector has more inputs that can be modified by an attacker. Recent work has focused on generating real packet traffic [5,11] and network flows [15] to improve datasets used in malware traffic detection using Generative Adversarial Networks. The flow-based approach relies entirely on the GAN to generate adversarial flows, yet it may be impossible to craft such a flow.…”

GAN Tunnel: Network Traffic Steganography by Using GANs to Counter Internet Traffic Classifiers

“…Network traffic generation using GANs has been considered for detecting intrusion, dataset augmentation, or illegality detection [6], [45], [46]. Ring et al [47] introduced flow-based traffic generation using GAN. This work aims to generate realistic network traffic to aid intrusion detection systems (IDS).…”