SynGAN: Towards Generating Synthetic Network Attacks using GANs
This work addresses the need for better testing and improvement of NIDS to reduce false positives and increase effectiveness against cyberattacks, though it appears incremental as it builds on existing GAN methods for a specific domain.
The paper tackles the problem of improving Network Intrusion Detection Systems (NIDS) by generating synthetic network attacks using Generative Adversarial Networks (GANs), specifically creating malicious packet flow mutations from real attack traffic to enhance detection rates.
The rapid digital transformation without security considerations has resulted in the rise of global-scale cyberattacks. The first line of defense against these attacks are Network Intrusion Detection Systems (NIDS). Once deployed, however, these systems work as blackboxes with a high rate of false positives with no measurable effectiveness. There is a need to continuously test and improve these systems by emulating real-world network attack mutations. We present SynGAN, a framework that generates adversarial network attacks using the Generative Adversial Networks (GAN). SynGAN generates malicious packet flow mutations using real attack traffic, which can improve NIDS attack detection rates. As a first step, we compare two public datasets, NSL-KDD and CICIDS2017, for generating synthetic Distributed Denial of Service (DDoS) network attacks. We evaluate the attack quality (real vs. synthetic) using a gradient boosting classifier.