Towards Generating Semi-Synthetic Datasets for Network Intrusion Detection System

Abstract

We have witnessed the proliferation of machine learning and its applications, especially in network-based intrusion detection systems (NIDS). With the ability to learn complex informative systems from data, machine learning models play a crucial role in identifying and preventing network attacks. However, training these models requires a massive volume of labeled data, which is nontrivial to obtain. Moreover, public datasets are often unbalanced, outdated, and different with network traffic from the networks that need to be protected. Therefore, in this paper, we introduce a framework, namely DGIDS, for generating semi-synthetic datasets for NIDS, which combines synthetic data and regular network traffic collected from the local network. Our proposed framework is capable of producing both benign and attack network data with characteristics similar to those in real scenarios. In practical experiments, we show that the network data generated by DGIDS significantly increase the detection quality of NIDS trained by public datasets from 54% to 90.39%.