Realistic network traffic simulation is critical for evaluating intrusion detection systems, stress-testing network protocols, and constructing high-fidelity environments for cybersecurity training. While attack traffic can often be layered into training environments using red-teaming or replay methods, generating authentic benign background traffic remains a core challenge -- particularly in simulating the complex temporal and communication dynamics of real-world networks. This paper introduces TempoNet, a novel generative model that combines multi-task learning with multi-mark temporal point processes to jointly model inter-arrival times and all packet- and flow-header fields. TempoNet captures fine-grained timing patterns and higher-order correlations such as host-pair behavior and seasonal trends, addressing key limitations of GAN-, LLM-, and Bayesian-based methods that fail to reproduce structured temporal variation. TempoNet produces temporally consistent, high-fidelity traces, validated on real-world datasets. Furthermore, we show that intrusion detection models trained on TempoNet-generated background traffic perform comparably to those trained on real data, validating its utility for real-world security applications.
@article{arxiv.2601.15663,
title = {TempoNet: Learning Realistic Communication and Timing Patterns for Network Traffic Simulation},
author = {Kristen Moore and Diksha Goel and Cody James Christopher and Zhen Wang and Minjune Kim and Ahmed Ibrahim and Ahmad Mohsin and Seyit Camtepe},
journal= {arXiv preprint arXiv:2601.15663},
year = {2026}
}