GMA-SAWGAN-GP: A Novel Data Generative Framework to Enhance IDS Detection Performance

1. Problem Statement

Intrusion Detection Systems (IDS) face two critical challenges:

1. Poor Generalization to Unknown Threats: IDS models are typically calibrated to known attack distributions and struggle to detect zero-day or unseen attacks.
2. Limitations of Existing Data Augmentation: While Generative Adversarial Networks (GANs) offer a solution for synthesizing training data, current approaches for network traffic suffer from three major flaws:
   • Mixed-Feature Handling: Network traffic contains both discrete (categorical) and continuous features. Existing methods either use one-hot encoding (causing high dimensionality, sparsity, and loss of semantic proximity) or discard discrete features entirely (losing critical signals).
   • Feature Dependencies: Standard generators fail to capture complex short- and long-range dependencies between features within a single network flow record.
   • Training Instability: GANs are prone to mode collapse, leading to overfitting, instability, and inadequate coverage of minority attack classes.

2. Methodology: GMA-SAWGAN-GP

The authors propose GMA-SAWGAN-GP, a generative augmentation framework built on a Self-Attention-enhanced Wasserstein GAN with Gradient Penalty (WGAN-GP). The architecture consists of four key technical components:

A. Discrete-Aware Generator with Gumbel-Softmax

To handle mixed-type data without the pitfalls of one-hot encoding:

• Continuous Features: Generated via a dense head with a tanh activation, constrained to $[-1, 1]$.
• Discrete Features: Modeled using Gumbel-Softmax regularization. The generator outputs logits for categorical fields, which are converted to soft one-hot vectors using a temperature parameter ($\tau$). These are mapped to scalar values via learnable codebooks specific to each field. This allows for differentiable training while preserving categorical semantics.

B. Feature-wise Self-Attention (SA) Mechanism

Integrated into the Generator ($G$), the SA mechanism treats the $F$ features of a network record as a sequence. It computes Queries ($Q$), Keys ($K$), and Values ($V$) to capture intra-record dependencies (both short- and long-range) among features, improving the realism of synthetic flows without manual feature grouping.

C. Manifold Regularization via AutoEncoder (AE)

To prevent mode collapse and ensure synthetic samples lie on the real data manifold:

• A shared AutoEncoder (Encoder $E$ and Decoder $D$) is trained on real data.
• During generator updates, the AE weights are frozen. The generator is penalized if it produces samples that cannot be accurately reconstructed by the AE ($L_{AE}^g$). This forces the generator to produce samples within the reconstructible local geometry of the real data.

D. Entropy-Based Adaptive Loss Gating

A lightweight gating network ($f_\omega$) dynamically balances the adversarial loss ($L_d$) and the reconstruction loss ($L_{AE}^g$).

• It outputs mixing weights ($\alpha, \beta$) normalized via softmax.
• An entropy regularizer is applied to these weights to prevent them from collapsing to a single term too early, ensuring stable training and broad coverage of minority patterns.
• Final Generator Loss: $L_G^f = \alpha L_{AE}^g + \beta L_d - \gamma H(\alpha, \beta)$.

3. Key Contributions

1. Discrete-Aware Synthesis: A novel method using Gumbel-Softmax and learnable codebooks to model categorical fields, avoiding the sparsity and semantic loss of traditional one-hot encoding.
2. Cross-Feature Dependency Modeling: Integration of a feature-wise Self-Attention mechanism within the WGAN-GP generator to capture complex interactions between network flow features.
3. Manifold-Guided Stability: An AutoEncoder-guided regularization strategy that constrains synthetic samples to the real data manifold, significantly reducing mode collapse.
4. Adaptive Optimization: An entropy-based gating mechanism that automatically balances reconstruction and adversarial objectives, eliminating the need for manual loss reweighting.

4. Experimental Results

The framework was evaluated on three datasets (NSL-KDD, UNSW-NB15, CICIDS2017) using five IDS models (CNN, DNN, LSTM, CNN-BiLSTM, CNN-LSTM).

• Binary Classification:
  • The proposed method improved average binary classification accuracy by 5.3% across datasets.
  • On UNSW-NB15, improvements ranged from 4.2% to 9.3% depending on the IDS model.
• Multi-Classification:
  • Achieved an average accuracy increase of 2.2%.
  • Significant gains were observed in detecting minority classes (e.g., R2L, U2R, Shellcode), particularly for models capable of exploiting sequential dependencies (LSTM, CNN-BiLSTM).
• Generalization to Unknown Attacks (LOAO):
  • Using the Leave-One-Attack-type-Out (LOAO) method, the framework demonstrated superior robustness.
  • AUROC for unknown attacks increased by 3.9%.
  • TPR@5%FPR (True Positive Rate at 5% False Positive Rate) increased by 4.8%, indicating better detection of novel threats with low false alarms.
• Comparison with SOTA:
  • Outperformed five state-of-the-art GAN-based methods (SYN-GAN, DAE-GAN, MultiCritics-WGAN-GP, TMG-GAN, WCGAN-GP) in most binary and multi-class scenarios.
  • PCA visualizations confirmed that GMA-SAWGAN-GP provides superior geometric alignment with real data manifolds and better coverage of cluster boundaries compared to competitors.

5. Significance

This paper addresses a critical gap in cybersecurity research: the inability of current IDS augmentation techniques to effectively handle mixed-type (discrete + continuous) network traffic while maintaining training stability.

• Practical Impact: By generating high-quality synthetic data that preserves categorical semantics and feature dependencies, the framework allows IDS models to learn richer decision boundaries. This is crucial for detecting rare and novel attacks in real-world scenarios where labeled data is scarce.
• Theoretical Contribution: The integration of Gumbel-Softmax, Self-Attention, and entropy-based gating within a WGAN-GP framework provides a robust blueprint for generating complex, mixed-type tabular data beyond just network security.
• Resilience: The method significantly enhances the resilience of IDS models against distribution shifts and zero-day attacks, moving beyond simple accuracy metrics to focus on robustness (AUROC and TPR@FPR).