An LLM-based synthetic data generation approach for addressing class imbalance in malicious traffic detection

The rapid growth of telecommunication network traffic poses increasing challenges for reliable and timely detection of malicious activity. One of the key difficulties in this domain is class imbalance, where malicious events constitute only a minority portion of real-world datasets. Traditional oversampling techniques often struggle to capture the structural diversity of minority-class patterns in such settings. This paper investigates the use of large language models (LLMs) for synthetic data generation as a data-level approach to mitigating class imbalance in network traffic classification tasks. The proposed method leverages the generative capabilities of LLMs to produce diverse and statistically consistent synthetic samples that enhance the representation of minority classes while preserving the overall characteristics of the original data. Experimental results show that incorporating LLM-generated samples during training increases recall for the minority malicious class from approximately 0.78 to 0.84, while maintaining competitive precision. In addition, an analysis based on the coefficient of variation indicates that the proposed method exhibits lower variability of recall and F1-score compared to synthetic minority over-sampling technique (SMOTE), and demonstrates stability comparable to adaptive synthetic sampling (ADASYN) and table variational auto-encoder (TVAE) across repeated training runs. These results suggest that LLM-based synthetic data generation improves minority-class detection under constrained augmentation conditions while maintaining stable and reliable model behavior.