Synthetic Network Packet Data Generator With Protocol State and Arrival Timing Awareness

Abstract

Recent advances in network traffic analysis use machine learning (ML) on packet-level data, but obtaining large amount of real data for training ML is becoming a challenge. ML-based generators like Generative Adversarial Networks and Variational Autoencoders are promising candidates for generation the packet-level data but often fail to preserve TCP protocol states and packet arrival time. Without accurately reproducing these characteristics, the synthetic data may fail to reflect real network behavior, potentially leading to erroneous conclusions in the training and evaluation of machine learning models. This paper proposes a new method to synthesize realistic packet-level data with accurate protocol transitions and timing. By separating IP address and port number generation and aligning timing with handshake completion, the model avoids overfitting. Using the CIC-IDS 2017 dataset, our method better replicates headers and timing, producing synthetic data that closely resembles real data features distribution. Visual and statistical comparisons reveal that the synthetic data closely resembles real packet traces, providing a reliable alternative for training and evaluating network analysis.