MAGE-ID: A Multimodal Generative Framework for Intrusion Detection Systems
This work addresses data imbalance and multimodal synthesis for cybersecurity professionals, representing a novel method for a known bottleneck rather than a foundational breakthrough.
The paper tackles the challenge of data imbalance in Intrusion Detection Systems by introducing MAGE-ID, a multimodal generative framework that synthesizes both tabular flow features and transformed images, achieving significant improvements in fidelity, diversity, and downstream detection performance over existing methods like TabSyn and TabDDPM on datasets such as CIC-IDS-2017 and NSL-KDD.
Modern Intrusion Detection Systems (IDS) face severe challenges due to heterogeneous network traffic, evolving cyber threats, and pronounced data imbalance between benign and attack flows. While generative models have shown promise in data augmentation, existing approaches are limited to single modalities and fail to capture cross-domain dependencies. This paper introduces MAGE-ID (Multimodal Attack Generator for Intrusion Detection), a diffusion-based generative framework that couples tabular flow features with their transformed images through a unified latent prior. By jointly training Transformer and CNN-based variational encoders with an EDM style denoiser, MAGE-ID achieves balanced and coherent multimodal synthesis. Evaluations on CIC-IDS-2017 and NSL-KDD demonstrate significant improvements in fidelity, diversity, and downstream detection performance over TabSyn and TabDDPM, highlighting the effectiveness of MAGE-ID for multimodal IDS augmentation.