Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Increasing cyber attacks necessitate advanced Intrusion Detection Systems (IDS).
• Machine Learning (ML) offers solutions but faces challenges with data scarcity and privacy.
• Existing Generative Adversarial Network (GAN) methods struggle to produce high-quality synthetic data for IDS training.

Purpose of the Study:

• To develop a novel, deterministic method for evaluating synthetic network traffic data quality generated by GANs.
• To propose a heuristic-based stopping criterion for GAN training to optimize generator performance.
• To enable the complete replacement of real network data with synthetic data in ML-based IDS training, ensuring data privacy.

Main Methods:

• Developed a novel metric to assess synthetic data quality against real data and ML task performance.
• Implemented a heuristic using these metrics to select the best generator during GAN training.
• Utilized an enhanced Wasserstein GAN to generate synthetic cryptomining attack and normal traffic data.

Main Results:

• Generated synthetic network traffic data that can fully substitute real data for training ML-based detectors.
• Achieved comparable performance in ML-based cryptomining detection using only synthetic data.
• Successfully avoided privacy violations by excluding real data from the ML training process.

Conclusions:

• The proposed method provides a reliable way to measure synthetic data quality for GANs in network security.
• The novel stopping criterion enhances GAN training efficiency and synthetic data utility.
• This approach effectively addresses data scarcity and privacy issues in developing ML-based IDS.