An LLM-based synthetic data generation approach for addressing class imbalance in malicious traffic detection

Area of Science:

• Cybersecurity
• Machine Learning
• Data Science

Background:

• Telecommunication network traffic growth presents challenges for detecting malicious activity.
• Class imbalance, with rare malicious events, hinders accurate detection in real-world datasets.
• Traditional oversampling methods struggle with minority class pattern diversity.

Purpose of the Study:

• To investigate large language models (LLMs) for synthetic data generation to mitigate class imbalance in network traffic classification.
• To enhance minority class representation while preserving original data characteristics.

Main Methods:

• Utilizing LLMs' generative capabilities to create diverse, statistically consistent synthetic network traffic samples.
• Applying LLM-generated data as a data-level approach to address class imbalance.
• Comparing LLM-based generation against Synthetic Minority Over-sampling Technique (SMOTE), Adaptive Synthetic Sampling (ADASYN), and Table Variational Auto-Encoder (TVAE).

Main Results:

• Incorporating LLM-generated samples improved recall for the minority malicious class from 0.78 to 0.84, maintaining precision.
• LLM-based generation showed lower variability in recall and F1-score compared to SMOTE.
• Stability of LLM-based generation was comparable to ADASYN and TVAE across multiple training runs.

Conclusions:

• LLM-based synthetic data generation effectively improves minority-class detection in network traffic classification.
• This approach enhances model reliability and stability under data imbalance conditions.
• LLMs offer a promising data-level solution for cybersecurity challenges with imbalanced datasets.