Flow-based Network Traffic Generation using Generative Adversarial Networks
Abstract
Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.
Cite
@article{arxiv.1810.07795,
title = {Flow-based Network Traffic Generation using Generative Adversarial Networks},
author = {Markus Ring and Daniel Schlör and Dieter Landes and Andreas Hotho},
journal= {arXiv preprint arXiv:1810.07795},
year = {2019}
}
Comments
37 pages, submitted to Computer & Security