PaperlayerView exact revision on arXiv

Source-linked AI summary

Flow-based Network Traffic Generation using Generative Adversarial Networks

Markus Ring, Daniel Schlör, Dieter Landes, Andreas Hotho

arXiv:1810.07795v1cs.NIstat.ML

TL;DR

The paper addresses challenges in generating realistic flow-based network traffic for NIDS, including GANs' handling of continuous inputs. It proposes a GAN-based generative model with preprocessing approaches, finding that E-WGAN-GP and B-WGAN-GP achieve good results, while noting transformation limitations for required addresses.

  • Problem

    Generating realistic flow-based network data for network-based intrusion detection remains challenging, including because GANs can only process continuous input values.

  • Method

    The paper proposes a generative model for realistic flow-based traffic and three preprocessing approaches for transforming flow-based data into continuous values.

  • Results

    Two approaches, E-WGAN-GP and B-WGAN-GP, achieve similarly good results for generating realistic flow-based data.

  • Takeaways & Limitations

    The research indicates that GANs are well suited for generating flow-based network traffic.

  • Takeaways & Limitations

    E-WGAN-GP is not suitable as a transformation method when addresses are required, while typical client ports present a different situation.

Abstract

from arXiv · show

Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.

1. Introduction

The paper addresses the shortage of realistic, shareable labeled flow-based data for NIDS by using GANs to generate traffic while handling categorical attributes through preprocessing. It evaluates three transformations and introduces domain-knowledge quality checks for the generated data.

  • Problem Statement: Public NIDS datasets are often outdated or incomplete, while real traffic lacks ground truth, is difficult to label, and may be restricted by privacy concerns.Labeled datasets support both supervised training and evaluation of supervised and unsupervised algorithms.
  • Objective: The paper aims to generate realistic flow-based network traffic that preserves the underlying characteristics of collected traffic.The generated data are intended for improving training and evaluating anomaly-based intrusion detection methods.
  • Approach and Contributions: GANs generate synthetic data with a generator trained against a discriminator, but they require continuous input attributes.The generator learns from discriminator gradients until it can fool the discriminator.
  • Approach and Contributions: Because flow-based data combine continuous and categorical attributes, the paper analyzes three transformations: numerical encoding, binary attributes, and IP2Vec representations.The approaches target categorical fields such as IP addresses and ports before GAN-based generation.
  • Approach and Contributions: The study applies Improved WGAN-GP with TTUR to CIDDS-001 and evaluates generated traffic using several measures, including domain-knowledge checks.The domain-knowledge evaluation method is introduced to assess intrinsic data quality.
  • Approach and Contributions: The contributions include GAN-based flow generation, three preprocessing approaches, a domain-knowledge evaluation method, and an IP2Vec extension for bytes, packets, and duration.The IP2Vec extension learns similarities between these flow attributes.

2. Foundations

The paper introduces flow-based NetFlow traffic, GANs, and IP2Vec as foundations for generating network-flow data with mixed attribute types.

  • Flow-based Network Traffic: NetFlow aggregates packets sharing source and destination endpoints and transport protocol within a time window into flows.
  • Flow-based Network Traffic: Flow-based data combine continuous, numeric, categorical, binary, and timestamp attributes, including IP addresses, ports, duration, bytes, packets, and TCP flags.
  • GANs: GANs train a generator and discriminator iteratively until generated samples become indistinguishable from real samples.
  • GANs: Vanilla GANs require differentiable visible units, whereas WGANs can model discrete distributions over a continuous latent space.
  • IP2Vec: IP2Vec maps IP addresses into R^m using flow-context information so addresses appearing in similar contexts are close in feature space.
  • IP2Vec: IP2Vec represents categorical vocabulary values with one-hot vectors and predicts context-value probabilities using a softmax output layer.

3. Transformation Approaches

The paper presents three preprocessing strategies that convert heterogeneous flow attributes into continuous representations suitable for WGAN-GP processing.

  • Overview: The three approaches transform heterogeneous NetFlow data so they can be processed by Improved Wasserstein Generative Adversarial Networks.
  • Method 1 - Numeric Transformation: N-WGAN-GP treats IP addresses and ports as continuous numeric attributes after scaling their components to [0,1].
  • Method 2 - Binary Transformation: B-WGAN-GP represents IP addresses, ports, bytes, and packets with binary attributes while normalizing duration to [0,1].
  • Method 3 - Embedding Transformation: E-WGAN-GP extends IP2Vec by learning embeddings for IP addresses, ports, protocols, duration, bytes, and packets.
  • Method 3 - Embedding Transformation: The adapted IP2Vec training procedure extracts additional samples for bytes, packets, duration, and destination IP addresses.
  • Method 3 - Embedding Transformation: E-WGAN-GP generates flow embeddings and maps generated values back to original attributes by selecting the closest existing embeddings using cosine similarity.

4. Experiments

The experiments evaluate N-WGAN-GP, B-WGAN-GP, and E-WGAN-GP for generating synthetic flow-based network traffic.

  • Experimental Evaluation: The evaluation covers three approaches: N-WGAN-GP, B-WGAN-GP, and E-WGAN-GP.
  • Experimental Evaluation: The experiments focus on synthetic flow-based network traffic.
  • Experimental Evaluation: The section evaluates the proposed approaches rather than introducing an additional transformation method.

4.1. Data Set

The study uses the public CIDDS-001 data set, selecting traffic from an OpenStack environment and dividing it into training and reference periods. The data represent four internal subnets and include selected TCP, UDP, and ICMP flows.

  • The data include developer, office, management, and server subnets with distinct client or server configurations.
  • Domain knowledge about the simulated environment facilitates evaluation of generated data.
  • CIDDS-001 contains four weeks of network traffic captured in an OpenStack environment.
  • Week2-4 provides around 22 million flows for generative-model training, while week1 provides around 8.5 million reference flows.
  • Week1 contains normal and malicious behavior, whereas weeks 3 and 4 contain only normal behavior.
  • The experiments retain TCP, UDP, and ICMP flows and remove 895 IGMP flows.

4.2. Definition of a Baseline

The baseline generates new flows by independently sampling each attribute from its empirical probability distribution in the input data.

  • The baseline estimates each attribute’s probability distribution by counting values in the input data.
  • It generates new flows by drawing values from those empirical distributions.
  • Each attribute is sampled independently of the others.

4.3. Evaluation Methodology

Evaluation of network-traffic generators lacks a standardized methodology. The paper therefore combines distributional, visualization-based, and domain-knowledge checks to assess generated-data quality from different views.

  • Evaluation of generative models and network-traffic generators remains challenging, with no widely accepted or standardized methodology.
  • Image-oriented measures such as the Inception Score are not applicable because Inception Net v3 classifies images, not flow-based traffic.
  • Prior evaluations use anomaly scores, graph comparisons, or individual traffic distributions.
  • The paper visualizes attributes and computes Euclidean distances between generated and real flow-based network data.
  • Domain-knowledge checks evaluate content quality and relationships between attributes within a flow.

4.4. Generation of Flow-based Network Data

The experiments compare a baseline with three WGAN-GP variants trained on CIDDS-001 week2-4 data to generate week1-sized samples. Embedding and binary representations reproduce important conditional and temporal patterns better than direct numerical representation, while E-WGAN-GP performs best on average.

  • 4.4.1. Experimental Setup: The baseline and N-WGAN-GP, B-WGAN-GP, and E-WGAN-GP are evaluated using week2-4 as training data and generate 8.5 million flows each.
  • 4.4.1. Experimental Setup: The models use feed-forward generator and discriminator networks, default parameters, and five training epochs.
  • 4.4.1. Experimental Setup: Higher epoch counts neither increase quality nor reduce GAN loss values.
  • 4.4.1. Experimental Setup: 80 neurons per hidden layer suffice for B-WGAN-GP and E-WGAN-GP, while N-WGAN-GP uses 24 neurons.
  • 4.4.2. Visualization: E-WGAN-GP reflects the essential temporal distribution of flows, although its curve is smoother than the original week1 traffic.
  • 4.4.2. Visualization: B-WGAN-GP and E-WGAN-GP capture source-port distributions conditioned on source-IP subnet, while the baseline and N-WGAN-GP do not.
  • 4.4.2. Visualization: E-WGAN-GP and B-WGAN-GP capture destination-IP constraints from external sources, whereas the baseline and N-WGAN-GP fail to do so.

5. Discussion

The discussion compares three representations for GAN-based flow generation: direct numeric, binary, and embeddings. Embedded and binary representations produce good traffic, but their strengths differ for unseen categorical values and semantic structure.

  • N-GAN-WP is not suitable for generating realistic flow-based network traffic.
  • Binary encoding preserves subnet information and uses 16 binary attributes for ports instead of one continuous source-port value.These design choices support better categorical-value generation in domain-knowledge checks.
  • B-WGAN-GP generates better categorical values and captures the internal traffic structure well, while supporting previously unseen values.The discussion points to Tests 2 and 4 and Figure 8 as evidence.
  • E-WGAN-GP uses contextual embeddings, making small representation errors less consequential when nearby input values share network behavior.For example, nearby internal IP addresses can map to similar host behavior, and E-WGAN-GP achieves the best generative-model evaluation results.
  • E-WGAN-GP cannot generate previously unseen values after embedding translation, whereas B-WGAN-GP is not limited in its value range.This makes the preferred transformation depend on whether unseen IP addresses or ports are required.
  • Generating new IP addresses or service ports can imply new host or service behavior, so training-data coverage and the need for unseen values determine suitability.The discussion distinguishes unseen values for evaluation datasets from unseen service behavior such as FTP connections absent from training data.

6. Related Work

Related work spans replay, throughput, attack, and high-level generators, with different goals and levels of traffic completeness. The paper positions its GAN approach as a high-level generator that learns attribute dependencies without explicitly modeling them.

  • Network traffic generators are categorized as Replay Engines, Maximum Throughput Generators, Attack Generators, and High-Level Generators.
  • Replay Engines: Replay Engines reuse captured traffic, but concept drift limits the usefulness of replaying known traffic for IDS evaluation datasets.The paper argues that suitable generators should instead create new synthetic flow-based traffic.
  • Maximum Throughput Generators: Maximum Throughput Generators primarily evaluate bandwidth, delay jitter, and loss-ratio characteristics rather than generating complete realistic flows.
  • Attack Generators: Attack Generators combine real traffic with synthetic attacks, while some related models generate only aggregate attack statistics instead of complete flow-based data.
  • High-Level Generators: High-Level Generators create synthetic traffic using host behavior, traffic templates, graph models, or conditional attribute probabilities.Examples include statistical host models, service-port templates, and graph-based generators.
  • GAN-based approaches: Earlier GAN-based security approaches either omit categorical attributes such as IP addresses and ports or use only three continuous traffic attributes.The paper identifies handling categorical flow attributes as a key contribution.
  • Positioning: Unlike replay and attack-focused generators, this approach generates new traffic beyond malicious flows and learns dependencies among flow attributes inherently.

7. Summary

The paper addresses the need for labeled, nonstatic flow datasets by developing GAN-based generators that handle heterogeneous attributes. Experiments on CIDDS-001 indicate that embedded and binary representations generate good traffic, while direct numeric transformation is less convincing.

  • Labeled flow-based datasets are necessary for evaluating and comparing network-based intrusion detection systems, but static datasets can become obsolete through concept drift.
  • The paper proposes three synthetic flow generators based on Improved WGAN-GP and the two time scale update rule.The generators are initialized with real traffic and generate new flow-based traffic.
  • The three preprocessing methods convert categorical and numerical flow attributes into continuous-compatible representations using numeric, binary, or embedding transformations.B-WGAN-GP converts ports to 16-bit binary representations, while E-WGAN-GP learns continuous representations for categorical attributes using IP2Vec.
  • Experiments on CIDDS-001 indicate that E-WGAN-GP generates realistic data with good evaluation results, while B-WGAN-GP achieves similarly good results and can create unseen values.
  • N-WGAN-GP produces less convincing network data, indicating that straightforward numeric transformation is not appropriate.
  • The authors conclude that GANs are well suited for generating flow-based network traffic.Future work targets flow sequences rather than single flows and additional evaluation methods.
Loading 1810.07795v1…