An LLM-based synthetic data generation approach for addressing class imbalance in malicious traffic detection

Area of Science:

• Cybersecurity
• Machine Learning
• Network Traffic Analysis

Background:

• Telecommunication network traffic growth presents challenges for detecting malicious activity.
• Class imbalance, with rare malicious events, hinders accurate detection in real-world datasets.
• Traditional oversampling methods struggle with minority class pattern diversity.

Purpose of the Study:

• Investigate large language models (LLMs) for synthetic data generation to mitigate class imbalance in network traffic classification.
• Enhance minority class representation using LLM-generated diverse and statistically consistent samples.
• Improve reliability and timeliness of malicious activity detection.

Main Methods:

• Utilized large language models (LLMs) for generating synthetic network traffic data.
• Applied LLM-generated data as a data-level approach to address class imbalance.
• Compared performance against traditional oversampling techniques like SMOTE, ADASYN, and TVAE.

Main Results:

• LLM-generated samples increased minority malicious class recall from 0.78 to 0.84, maintaining precision.
• The method showed lower variability in recall and F1-score compared to SMOTE.
• Demonstrated stability comparable to ADASYN and TVAE across multiple training runs.

Conclusions:

• LLM-based synthetic data generation effectively mitigates class imbalance in network traffic classification.
• This approach enhances minority class detection under constrained augmentation.
• LLM-generated data ensures stable and reliable model behavior for cybersecurity applications.