Realistic Synthetic Data Generation Using the TabDDPM Diffusion Model for Network Attack Detection

Relevance. Representative network-traffic datasets are required for research and testing of attack detection tools; however, their collection and annotation are labor-intensive, and data sharing is constrained by confidentiality requirements and the risk of leakage. Synthetic data can increase sample sizes and enable modeling of rare and zero-day scenarios while preserving the statistical properties of network traffic.

Objective. To improve the quality and reproducibility of generating synthetic tabular features of network traffic, using Android applications as a case study, by applying the Tabular Denoising Diffusion model (TabDDPM) and performing comprehensive validation of the generated data using a consistent set of metrics.

Methods. We employ the TabDDPM diffusion-based generative model, which is applicable to arbitrary tabular datasets. Generation performance is assessed via statistical analysis methods, including comparisons of feature distributions and inter-feature dependencies, evaluation of utility in a downstream task, and estimation of the discrepancy between synthetic and real data.

Results. A comprehensive quality assessment of TabDDPM is conducted for generating tabular features of network traffic associated with attacks or unwanted applications. The results demonstrate the feasibility of producing controlled synthetic datasets that preserve characteristic traffic patterns and enable scaling of training samples without directly copying the original records.

Novelty. We propose a unified post-generation validation protocol for synthetic traffic that integrates realism, utility, and indistinguishability metrics, thereby reducing the risk of misleading conclusions arising from fragmented evaluation. In addition, an integral quality indicator is introduced to quantify generation performance by aggregating partial metrics.

The theoretical significance lies in advancing a methodological framework for verifying tabular diffusion models in cybersecurity applications.

The practical significance is the ability to use the resulting synthetic datasets to model cyberattacks and zero-day scenarios, perform stress testing, and train and / or evaluate intrusion detection systems.

1. Ding J., Li X., Kang X., Gudivada V.N. A Case Study of the Augmentation and Evaluation of Training Data for Deep Learning. Journal of Data and Information Quality. 2019;11(4):1‒22. DOI:10.1145/3317573

2. Bansal A., Sharma R., Kathuria M. A Systematic Review on Data Scarcity Problem in Deep Learning: Solution and Applications. ACM Computing Surveys. 2022;54(10s):1‒29. DOI:10.1145/3502287

3. Alqahtani H., Kavakli-Thorne M., Kumar G. Applications of Generative Adversarial Networks (GANs): An Updated Review. Archives of Computational Methods in Engineering. 2021;28(2):525‒552. DOI:10.1007/s11831-019-09388-y. EDN:FTPNOL

4. Cubuk E.D., Zoph B., Mané D., Vasudevan V., Le Q.V. AutoAugment: Learning Augmentation Strategies From Data. Proceedings of the 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR, 15–20 June 2019, Long Beach, USA. IEEE; 2019. p.113‒123. DOI:10.1109/CVPR.2019.00020

5. Cui L., Li H., Chen K., Shou L., Chen G. Tabular data augmentation for machine learning: Progress and prospects of embracing generative AI. arXiv preprint arXiv:2407.21523. 2024. DOI:10.48550/arXiv.2407.21523

6. Goodfellow I., Pouget-Abadie J., Mirza M., Xu B., Warde-Farley D., Ozair S., et al. Generative adversarial networks. Communications of the ACM. 2020;63(11):139‒144. DOI:10.1145/3422622. EDN:SESCXD

7. Kingma D.P., Welling M. An Introduction to Variational Autoencoders. Foundations and Trends in Machine Learning. 2019;12(4):307‒392. DOI:10.1561/2200000056

8. Yang L., Zhang Z., Song Y., Hong S., Xu R., Zhao Y., et al. Diffusion Models: A Comprehensive Survey of Methods and Ap-plications. ACM Computing Surveys. 2024;56(4):1‒39. DOI:10.1145/3626235

9. Kotelnikov A., Baranchuk D., Rubachev I., Babenko A. TabDDPM: Modelling tabular data with diffusion models. arXiv preprint arXiv:2209.15421. 2022. DOI:10.48550/arXiv.2209.15421

10. Kingma D.P., Welling M. Auto-encoding variational Bayes. arXiv preprint arXiv:1312.6114. 2022. DOI:10.48550/arXiv.1312.6114

11. Ho J., Jain A., Abbeel P. Denoising Diffusion Probabilistic Models. Advances in Neural Information Processing Systems 33 (NeurIPS). 2020.

12. Sheluhin O.I., Matorin F.A. Reducing the Dimensionality of Data Arrays Using Multi-Layer Autoencoders in the Task of Classifying Mobile Applications. Proceedings of Telecommunication Universities. 2024;10(6):111‒120. (in Russ.) DOI:10.31854/1813-324X-2024-10-6-111-120. EDN:TOPDUA

13. Sheluhin O.I., Matorin F.A., Vanyushina A.V. Evaluation of the properties of multilayer autoencoders in the task of detecting and classifying mobile applications. H&ES Research. 2024;16(6):12‒20. (in Russ.) DOI:10.36724/2409-5419-2024-16-6-12-20. EDN:CRPLOR