🤖 machine learning

Synthetic Network Packet Generation through Statistical Learning and Genetic Algorithms

This paper proposes and evaluates two constraint-enforcing methods—a high-throughput statistical learning approach and a high-quality genetic algorithm—for generating realistic, physically valid synthetic IoT network packets to address dataset scarcity and class imbalance in intrusion detection systems.

Original authors: Mayank Raj, Nathaniel D. Bastian, Lance Fiondella, Gokhan Kul

Published 2026-06-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Mayank Raj, Nathaniel D. Bastian, Lance Fiondella, Gokhan Kul

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a security guard (an Intrusion Detection System) how to spot a thief in a smart home full of IoT devices. To do this well, the guard needs to practice on a massive library of "training videos" showing both normal activity (like a light turning on) and bad activity (like a hacker trying to break in).

The problem is, real-world data is messy. Sometimes there are millions of videos of normal lights, but only five videos of a specific type of hacker attack. It's like trying to learn how to recognize a rare bird when you've only ever seen five pictures of it. Also, existing public datasets are often "rigid"—they have a fixed number of examples that don't change, and they are heavily unbalanced.

This paper proposes a solution: Let's use computers to invent (generate) new, realistic training videos. But there's a catch: if the computer just makes things up randomly, it might create impossible scenarios (like a packet with negative bytes or a flag that doesn't exist in reality).

The authors built two different "factories" to create these fake but realistic network packets, and they made sure both factories had strict quality control inspectors.

The Two Factories

1. The Statistical Factory (The "Fast & Furious" Method)
Think of this as a high-speed assembly line.

How it works: It looks at the real data, learns the "shape" of the traffic using a mathematical map (PCA), and then shoots out new packets that fit that shape.
The Safety Net: Before any packet leaves the factory, it must pass through two security gates simultaneously. One gate is a "One-Class SVM" and the other is an "Isolation Forest." If the packet looks even slightly suspicious to either gate, it is immediately thrown in the trash and a new one is made.
The Result: This method is incredibly fast. It can spit out over 1,000 packets per second. It's great for quickly filling up a training library when you need volume and consistency.

2. The Genetic Algorithm Factory (The "Evolutionary" Method)
Think of this as a slow, careful breeding program.

How it works: It starts with a small group of "parent" packets. It mixes them up (crossover), makes small random changes (mutation), and keeps the "fittest" ones—those that look most like real traffic and least like anomalies. It repeats this process over many "generations," slowly evolving better and better fake packets.
The Safety Net: Just like the first factory, every new packet must pass the same two security gates before it's allowed to stay.
The Result: This method is much slower, taking about 35 minutes to do what the first factory does in 11 seconds. However, because it "evolves" the data, the final packets have more natural variety and diversity. It's like having a more creative artist who takes longer but produces more unique variations.

The Big Test: The "Five-Sample" Challenge

The researchers tested these factories on a dataset called ACI IoT 2023, which has a massive imbalance. One category, "ARP Spoofing" (a specific type of network attack), had only 5 real examples out of over 1.2 million packets.

The Goal: Could these factories take those tiny 5 examples and turn them into 1,000 high-quality, realistic fake examples?
The Outcome: Yes. Both factories succeeded. They amplified the 5 samples by 200 times.
- The Statistical Factory did it with near-perfect consistency (0% of the fake packets were flagged as "weird" by independent testers).
- The Genetic Factory did it with a bit more variety (some packets were flagged slightly more often, but still well within the "safe" zone).

The Verdict: Which One Should You Use?

The paper concludes that neither method is strictly "better"; they serve different purposes, much like choosing between a photocopier and a painter.

Choose the Statistical Factory (The Photocopier) if you need to generate a huge dataset quickly for training a system overnight. It's fast (190 times faster than the other method) and consistent.
Choose the Genetic Factory (The Painter) if you are a "Red Team" (ethical hackers) trying to test how robust a security system is. Because this method creates more diverse and varied fake traffic, it's better for stress-testing defenses against tricky, unpredictable attacks.

What They Didn't Do (Important Limitations)

The authors are careful to note what their "factories" don't do yet:

They generate individual packets, not entire "movies" of a conversation. Real network traffic has a sequence (a handshake, then data, then a close), and these methods don't currently model that time-based flow.
They ensure the numbers are within realistic ranges (e.g., you won't get a negative packet count), but they don't guarantee the packets follow the specific "grammar" of complex protocols like MQTT or Zigbee perfectly.

In short, this paper proves you can use strict mathematical rules and evolutionary algorithms to create safe, realistic fake data to help train security systems, even when you start with almost no real examples of a specific attack.

Technical Summary: Synthetic Network Packet Generation through Statistical Learning and Genetic Algorithms

Problem Statement

Developing robust Intrusion Detection Systems (IDS) for Internet of Things (IoT) environments requires large, labeled datasets that capture realistic traffic distributions for both benign and malicious activities. However, existing public datasets suffer from fixed activity distributions and extreme class imbalance (e.g., the ACI IoT 2023 dataset contains a 175,805:1 imbalance between benign traffic and ARP Spoofing attacks). Furthermore, deep generative models like GANs and VAEs often experience mode collapse and lack mechanisms to ensure synthetic packets remain within physically valid feature ranges. Adversarial perturbation techniques similarly fail to respect the structural restrictions of legitimate network traffic. The core challenge is to create generation pipelines that incorporate hard validity constraints—explicit boundary enforcement and anomaly-model gating—directly into the synthesis process rather than relying solely on implicit distributional learning.

Methodology

The paper proposes and compares two constraint-enforcing approaches for generating synthetic IoT network packets, both operating on the ACI IoT 2023 dataset (1,231,411 packets, 75 features, 12 attack categories). Both methods share a critical architectural feature: a dual anomaly-detection gate requiring concurrent acceptance by independently trained One-Class SVM (OCSVM) and Isolation Forest (IF) models before a packet is admitted.

1. Statistical Learning Method

This approach treats generation as a sampling problem within a latent space:

Hybrid Sampling: Synthetic packets are generated via a two-source mixture: (i) PCA-based latent space sampling to preserve inter-feature correlations, and (ii) direct Gaussian sampling around class centroids to introduce variability.
Adaptive Regularization: The OCSVM regularization parameter ( $\nu$ ) and IF contamination are dynamically adjusted based on class size ( $n$ ) using $\nu_c = \min(0.1, 1/(n+1))$ to prevent overfitting on sparse classes.
Constraint Enforcement: Generated candidates undergo element-wise clamping to observed feature bounds ( $[l_c, u_c]$ ) and are subjected to a binary accept/reject gate. A packet is accepted only if both OCSVM and IF classify it as normal. Rejected packets are discarded and regenerated.

2. Genetic Algorithm (GA) Method

This approach treats packet generation as a multi-objective optimization problem:

Fitness Function: The fitness of a candidate packet balances anomaly model acceptance (80% weight) with distributional fidelity (20% weight, measured by distance to the class centroid).
Population Initialization: The initial population is constructed from three sources to balance exploitation and exploration: real training samples (perturbed), Gaussian samples, and uniform samples across the feature bounds.
Evolutionary Process: The algorithm employs tournament selection, multiple crossover operators (uniform, single-point, blend), and mutation strategies. It includes a stagnation restart mechanism to escape local optima.
Constraint Enforcement: Like the statistical method, all offspring are clipped to feature bounds, and the fitness function heavily penalizes packets that fail the dual OCSVM/IF acceptance criteria.

3. Independent Validation Framework

To ensure objective quality assessment, the authors employ a strict separation between generation and validation. Validation models (OCSVM and IF) are trained exclusively on the original ACI IoT 2023 data with no shared parameters with the generation models. A synthetic set achieves "PASS" status if the anomaly rate ( $A_f$ ) across these independent validators is below a threshold of $\tau = 0.30$ .

Key Contributions

Systematic Comparison: A direct comparison of statistical learning and genetic algorithms for constraint-enforcing synthetic IoT packet generation, evaluated against four explicit acceptance criteria.
Dual-Gate Architecture: The introduction of a dual anomaly-detection gating mechanism (OCSVM + IF) embedded directly into the synthesis pipeline, ensuring hard validity constraints are met before output.
Extreme Imbalance Handling: Empirical evidence demonstrating that both methods can successfully amplify extremely scarce attack categories (down to $n=5$ samples, specifically ARP Spoofing) by 200× to 1,000 validated packets without degrading below the anomaly threshold.
Computational Trade-off Analysis: A quantitative analysis revealing a ~190:1 throughput ratio between the two methods, providing evidence-based selection criteria for different deployment contexts.

Experimental Results

Evaluated on the complete ACI IoT 2023 dataset, both methods achieved PASS status across all 12 attack categories under the independent validation framework ( $\tau = 0.30$ ).

Statistical Learning Performance:
- Anomaly Rate: Achieved an average anomaly rate of 1.20% across four validation tiers (0.00% on class-specific tiers, 13.20% on global IF for the Benign class due to high intra-class variance).
- Throughput: ~1,091 packets/second.
- Characteristics: Near-uniform anomaly rates with low per-class variance, indicating high consistency but limited intra-class variability.
Genetic Algorithm Performance:
- Anomaly Rate: Achieved an average anomaly rate of 0.62% across two class-specific tiers.
- Throughput: ~5.7 packets/second.
- Characteristics: Organic per-class variance (0.00%–2.50%), indicating broader exploration of the valid feature space.
Extreme Imbalance Case (ARP Spoofing, $n=5$ ):
- Both methods successfully generated 1,000 validated packets.
- Statistical method: 0.00% anomaly rate.
- GA method: 2.50% anomaly rate (OCSVM), 0.00% (IF).
- Standard oversampling (SMOTE) is noted to fail in this regime due to degenerate neighborhood structures in high-dimensional space.

Significance and Claims

The paper claims that embedding hard validity constraints directly into the generation pipeline successfully produces synthetic IoT packets that are consistently accepted as "normal-for-class" by independent validators, addressing the limitations of existing deep generative models.

The authors posit that the choice between methods depends on the deployment context:

Statistical Learning is suited for rapid dataset augmentation where efficiency and consistency are priorities (e.g., expanding training sets for overnight IDS training).
Genetic Algorithms are suited for scenarios where diversity is the priority, such as adversarial robustness testing, red team traffic generation, or stress testing IDS with varied traffic representations within valid boundaries.

The work highlights that while both methods overcome the "generation gap" for scarce classes, they differ fundamentally in computational cost and the nature of the synthetic diversity they produce. The paper concludes by noting limitations, specifically the lack of sequential flow modeling and protocol-specific semantic validation, suggesting these as areas for future research.