💻 computer science

Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection

This paper proposes a BGAN-augmented TabTransformer framework that simultaneously addresses class imbalance and adversarial vulnerability in intrusion detection by generating synthetic minority and adversarial samples, resulting in significantly improved Macro-F1 scores and robustness against attacks on the CICIDS2017 dataset.

Original authors: Raihan Sultan Pasha Basuki, Aliyah Kurniasih

Published 2026-07-21

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Raihan Sultan Pasha Basuki, Aliyah Kurniasih

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a massive, bustling city where data flows like cars on endless highways. To keep this city safe, we have security guards called Intrusion Detection Systems (IDS). These guards watch the traffic, looking for bad drivers who are trying to crash cars, steal packages, or cause chaos. For a long time, these guards relied on rulebooks: "If a car looks red, stop it." But bad drivers are clever; they change their colors or drive in weird patterns to sneak past the rules. So, we started teaching our guards to learn from experience using Machine Learning, a type of computer brain that gets smarter the more it sees.

However, there are two big problems with these smart guards. First, the city is mostly full of good drivers, and bad drivers are rare. It's like trying to teach a student to recognize a tiger when you only show them one picture of a tiger and a million pictures of house cats. The student gets confused and thinks every cat is a tiger, or worse, misses the tiger entirely. This is called "class imbalance." Second, bad drivers are getting sneakier. They can use "adversarial attacks," which are like tiny, almost invisible nudges to their cars that trick the computer brain into thinking a tiger is just a house cat. If a guard hasn't seen these tricky nudges before, it might fail completely. Scientists are trying to build guards that are both good at spotting rare tigers and tough enough to ignore the sneaky nudges.

This paper introduces a new, super-smart guard system called the BGAN-augmented TabTransformer. Think of it as a two-in-one training program for our security guards. The first part uses a special tool called a Boundary-Seeking GAN (BGAN). Imagine a master forger who doesn't just make fake copies of rare tigers; instead, this forger creates perfectly tricky fake tigers that look almost exactly like the line between a tiger and a house cat. By showing the guard these tricky "borderline" examples, the guard learns to spot the real tigers much better, even when there are very few real ones to begin with. This solves the "rare tiger" problem.

The second part of the system is a brilliant twist: the same forger who makes the tricky training examples is also used to attack the guard during a test. It's like the forger tries to trick the guard with their own fake tigers to see if the guard is tough enough to say, "No, that's still a tiger!" If the guard can resist these attacks, it proves the guard is truly robust. The researchers tested this system on a massive dataset of network traffic called CICIDS2017, which contains millions of data "flows" representing different types of internet traffic, from harmless browsing to dangerous cyberattacks like DDoS and Web Attacks.

The results were quite impressive. When the researchers used their new BGAN training method, the guard's ability to correctly identify all types of attacks (measured by a score called Macro-F1) jumped from 82.96% to 86.50%. The biggest improvement was in spotting "Web Attacks," where the score went from a shaky 0.29 to a solid 0.61. But the real magic happened during the "toughness test." When they tried to trick the guards that hadn't been trained with the BGAN forger, those guards failed completely, with their performance dropping by 100%. In contrast, the guards trained with the BGAN forger didn't just survive the trickery; they actually got slightly better at spotting the attacks, showing a negative performance drop rate (meaning they improved under pressure).

The researchers also checked if the system would get confused by harmless noise, like static on a radio. They found that their new system stayed very calm, with a "False Triggered Rate" (accidentally shouting "Intruder!" when there was none) staying low between 1.51% and 2.92%, even when the data was noisy. Other systems, like the older "Decision Tree" guards, got very jumpy and started shouting false alarms up to 49.09% of the time when the same noise was added.

However, the paper is careful to note that this isn't a magic bullet for every single problem. The system struggled with one specific type of attack called "Infiltration" because there were only 29 examples of it in the training data—too few for the forger to learn from, so they had to use a simpler, less effective backup plan for that specific case. Also, this whole experiment was done in a controlled, offline lab setting using a fixed dataset, not on a live, moving internet network. While the results suggest that combining this "boundary-seeking" training with a smart "TabTransformer" architecture creates a much tougher and more accurate security guard, the authors suggest we need to test it on real, live traffic before we can say it's ready for the big city.

Technical Summary: Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection

Problem Statement
Machine learning-based Intrusion Detection Systems (IDS) face two critical challenges in modern network environments: severe class imbalance and vulnerability to adversarial attacks. In datasets like CICIDS2017, benign traffic vastly outnumbers attack traffic (e.g., Infiltration samples constitute a tiny fraction), leading models to bias toward the majority class. Furthermore, while models may achieve high accuracy on clean data, they often collapse when presented with subtly manipulated inputs designed to evade detection. Existing research typically addresses these issues separately: Generative Adversarial Networks (GANs) are used for data augmentation to fix imbalance, while robustness is often evaluated using distinct frameworks. No existing framework combines a self-attention tabular classifier with a single generative model that simultaneously serves as a minority-class augmentation engine and an adversarial sample generator for robustness evaluation.

Methodology
The authors propose a dual-purpose framework integrating a Boundary-Seeking Generative Adversarial Network (BGAN) with a TabTransformer classifier.

Dataset and Preprocessing: The study utilizes the CICIDS2017 dataset, comprising roughly 2.8 million flows across eight classes. The data is preprocessed to extract 78 flow-statistical features (e.g., packet counts, duration, TCP flags). The training set undergoes stratified splitting (80:20), with benign traffic undersampled to 200,000 samples to reduce dominance, while the test set retains original proportions.
BGAN Augmentation: Unlike standard GANs that generate samples across the entire distribution, BGAN is trained to generate samples near the decision boundary between benign and malicious classes. This is achieved using an importance weight $w(x) = D(x) / (1 - D(x))$ $w (x) = D (x) / (1 - D (x))$ , emphasizing ambiguous samples where the discriminator output is near 0.5.
- Dual Role: The trained BGAN generates synthetic samples to augment minority classes (Botnet, Web_Attack, Infiltration) and simultaneously generates adversarial samples to stress-test the classifier.
- Handling Extreme Imbalance: For the Infiltration class, which had only 29 training samples, the BGAN failed to converge (Wasserstein distance > 8.0). Consequently, a Gaussian noise fallback was used for this specific class in the "Mixed" scenario, while Botnet and Web_Attack were augmented with BGAN-generated samples up to 6,000 each.
TabTransformer Classifier: The classification model employs TabTransformer, which utilizes self-attention mechanisms to model relationships between tabular features directly, rather than treating them independently. The model processes 78 continuous features through embeddings and two Transformer blocks before a multilayer perceptron head produces the final classification.
Evaluation Metrics: Performance is measured using Accuracy, Precision, Recall, and Macro-F1. Adversarial robustness is quantified via:
- Performance Drop Rate (PDR): The relative degradation in F1-score when clean test samples are replaced with BGAN-generated adversarial samples.
- False Triggered Rate (FTR): The rate at which benign samples are misclassified after the addition of small Gaussian perturbations.

Key Contributions

Dual-Purpose Framework: The paper introduces a unified framework where a single BGAN model addresses both class imbalance (via augmentation) and robustness evaluation (via adversarial sample generation), a combination not previously achieved in flow-based IDS.
Extension to Multi-Class Adversarial Conditions: The work extends prior TabTransformer-based IDS research from binary classification to multi-class scenarios under adversarial conditions.
Quantified Robustness: The study provides a rigorous evaluation of robustness using PDR and FTR, demonstrating that augmentation can convert models from being completely vulnerable (100% performance drop) to resilient.

Results

Classification Performance: On the CICIDS2017 dataset, the BGAN-augmented TabTransformer improved the Macro-F1 score from 82.96% (Baseline) to 86.50%. The most significant improvement was observed in the Web_Attack class, where the F1-score rose from 0.29 to 0.61. While Random Forest and Decision Tree achieved higher overall Macro-F1 scores on clean data (approx. 96%), they did not match the robustness of the augmented TabTransformer.
Adversarial Robustness (PDR):
- Baseline Models: All models without augmentation experienced a 100% Performance Drop Rate under adversarial testing, indicating total failure against boundary-adjacent attacks.
- Augmented Models: All BGAN-augmented models (except the Mixed scenario for Infiltration) achieved negative PDR values, meaning their performance held or improved under attack. For instance, the TabTransformer achieved a PDR of -24.75% for Botnet and -9.80% for Infiltration.
Noise Resilience (FTR): The TabTransformer with Full BGAN augmentation maintained a stable and low False Triggered Rate (1.51%–2.92%) across various noise levels. In contrast, Decision Trees augmented with BGAN saw their FTR spike to 49.09% under benign perturbations, indicating that GAN data can destabilize tree-based models.

Significance and Claims
The authors claim that the proposed BGAN-TabTransformer framework provides an effective and adaptive solution for intrusion detection in adversarial network environments. The study demonstrates that:

Robustness is achievable: Exposure to boundary-seeking synthetic samples during training fundamentally changes model behavior, preventing the total collapse seen in non-augmented models.
Architecture matters: The self-attention mechanism of the TabTransformer, combined with boundary-region training data, yields superior generalization and resilience compared to tree-based models or standard MLPs, which are more susceptible to overfitting specific generator signatures or noise.
Dual utility: A single generative model can effectively serve both as a data augmentation tool for rare classes and as a rigorous stress-test mechanism for model security.

The paper concludes with modest limitations, noting that the Infiltration class remains difficult to model due to extreme scarcity (requiring few-shot learning in the future), Web_Attack precision remains low due to feature overlap, and the evaluation is currently limited to offline, controlled settings rather than live network deployment.

Technical Summary: Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection

More like this