Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks

Abstract

Due to the growing rise of cyber attacks in the Internet, the demand of accurate intrusion detection systems (IDS) to prevent these vulnerabilities is increasing. To this aim, Machine Learning (ML) components have been proposed as an efficient and effective solution. However, its applicability scope is limited by two important issues: (i) the shortage of network traffic data datasets for attack analysis, and (ii) the data privacy constraints of the data to be used. To overcome these problems, Generative Adversarial Networks (GANs) have been proposed for synthetic flow-based network traffic generation. However, due to the ill-convergence of the GAN training, none of the existing solutions can generate high-quality fully synthetic data that can totally substitute real data in the training of ML components. In contrast, they mix real with synthetic data, which acts only as data augmentation components, leading to privacy breaches as real data is used. In sharp contrast, in this work we propose a novel and deterministic way to measure the quality of the synthetic data produced by a GAN both with respect to the real data and to its performance when used for ML tasks. As a by-product, we present a heuristic that uses these metrics for selecting the best performing generator during GAN training, leading to a novel stopping criterion, which can be applied even when different types of synthetic data are to be used in the same ML task. We demonstrate the adequacy of our proposal by generating synthetic cryptomining attacks and normal traffic flow-based data using an enhanced version of a Wasserstein GAN. The results evidence that the generated synthetic network traffic can completely replace real data when training a ML-based cryptomining detector, obtaining similar performance and avoiding privacy violations, since real data is not used in the training of the ML-based detector.

A Review of Generative Models in Generating Synthetic Attack Data for Cybersecurity

“…Mozo et al [122] proposed a WGAN-based approach to generate synthetic flow-based network traffic, addressing privacy concerns and providing a viable alternative to real data in ML training processes. Demonstrated in a crypto-mining attack scenario, the study explores diverse neural network architectures and proposes enhancements to improve the quality of synthetic data.…”

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

“…Some research proposes techniques for generating datasets, including log line clustering [ 25 ], generating network flows at fragment level [ 26 ], using Generative Adversarial Networks (GANs) to generate datasets [ 27 ], dynamically generating datasets [ 28 ], and using fuzzy association rules to integrate device logs with traffic data [ 29 ].…”

A Digital Twin for the 5G Era: the SPIDER Cyber Range

“…One of the most innovative aspects of the SPIDER cyber range is its capability to automate offensive tactics by generating synthetic traffic traces. In this regard, a significant effort has been devoted to the study of the application of the recently appeared Generative Adversarial Networks (GANs) to generate synthetic flow-based network traffic to mimic both attacks and normal traffic [17]. In contrast to other approaches using GAN as a data augmentation solution, synthetic data generated in SPIDER can fully replace real data (both attacks and normal traffic).…”