TempoNet: Learning Realistic Communication and Timing Patterns for Network Traffic Simulation
This addresses the problem of realistic network traffic simulation for cybersecurity applications, representing a novel method for a known bottleneck.
The paper tackled the challenge of generating realistic benign background traffic for network simulation by introducing TempoNet, a generative model that captures complex temporal and communication dynamics, and showed that intrusion detection models trained on its generated traffic perform comparably to those trained on real data.
Realistic network traffic simulation is critical for evaluating intrusion detection systems, stress-testing network protocols, and constructing high-fidelity environments for cybersecurity training. While attack traffic can often be layered into training environments using red-teaming or replay methods, generating authentic benign background traffic remains a core challenge -- particularly in simulating the complex temporal and communication dynamics of real-world networks. This paper introduces TempoNet, a novel generative model that combines multi-task learning with multi-mark temporal point processes to jointly model inter-arrival times and all packet- and flow-header fields. TempoNet captures fine-grained timing patterns and higher-order correlations such as host-pair behavior and seasonal trends, addressing key limitations of GAN-, LLM-, and Bayesian-based methods that fail to reproduce structured temporal variation. TempoNet produces temporally consistent, high-fidelity traces, validated on real-world datasets. Furthermore, we show that intrusion detection models trained on TempoNet-generated background traffic perform comparably to those trained on real data, validating its utility for real-world security applications.