Flow-based network traffic generation using Generative Adversarial Networks. Issue 82 (May 2019)

• Record Type: Journal Article
• Authors: Ring, Markus; Schlör, Daniel; Landes, Dieter; Hotho, Andreas
• Is Part Of: Computers & security. Issue 82(2019)
• Page Start: 156
• Page End: 172
• Publication Date: 2019-05
• Subjects: GANs -- TTUR WGAN-GP -- NetFlow -- Generation -- IDS; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2018.12.012
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.