PaperlayerView exact revision on arXiv

Source-linked AI summary

Frequency-Domain Mixing Data Augmentation for Malicious Traffic Detection

Yuhao Yan, Bo Lang, Xiangyu Li

arXiv:2609.07156v1cs.CR

TL;DR

Limited diversity in collected network traffic makes OOD generalization an important challenge for malicious-traffic detection. The paper analyzes frequency-domain mixing and adapts it to traffic sequences; experiments report improved OOD generalization and better performance than other augmentation methods. The authors note that they did not evaluate the method in specific evasion scenarios.

  • Problem

    Traffic datasets collected in small, stable environments often lack diversity, while frequency-domain mixing lacks theoretical analysis and adaptation to network traffic characteristics.

    Source: §1 · pp. 1–2

  • Method

    The method analyzes frequency-domain mixing and combines pre-augmentation, inter-class linear sample-and-label mixing, intra-class frequency mixing, and windowed Fourier transforms.

    Source: §1 · p. 2, §7 · p. 14

  • Results

    Experiments on artificial and real-world datasets show significantly improved OOD generalization and better performance than other data augmentation methods.

    Source: §7 · p. 14

  • Takeaways & Limitations

    The reported OOD gains enable models to better handle complex network traffic in real-world environments.

    Source: §7 · p. 14

    The authors did not evaluate the method in specific evasion scenarios, which they identify as beyond the paper’s primary scope.

    Source: §6 · p. 14

Abstract

from arXiv · show

The strong dynamics of network traffic often force malicious traffic detection models to handle out-of-distribution data. Typically, deep learning-based malicious traffic detection models require a large amount of high-quality training data. However, owing to challenges such as high labeling difficulty and resource consumption, existing datasets often suffer from insufficient diversity and fail to capture evolving traffic patterns, leading to poor out-of-distribution generalization ability of the trained models. Data augmentation has been widely adopted to improve data diversity and model generalization. Recently, frequency-domain mixing augmentation has shown promising performance because it effectively perturbs data while preserving key structural information. This approach shows potential for enhancing malicious traffic detection models. However, existing studies lack theoretical interpretation of the mixing mechanism, and do not adapt to the characteristics of network traffic. In this paper, we first conduct a theoretical analysis of the current frequency-domain mixing method, revealing its underlying principles and limitations. We further propose an improved frequency-domain mixing-based data augmentation method for network traffic data, which enhances the diversity of sequence features in network traffic and improves the out-of-distribution generalization of malicious traffic detection models. Extensive experiments on multiple artificial and real-world datasets demonstrate that our method substantially improves detection performance across diverse network environments and outperforms other data augmentation approaches.

1 Introduction

Network traffic datasets often lack the diversity needed for malicious-traffic models to generalize under covariate shift. The paper analyzes frequency-domain mixing and proposes traffic-specific changes, reporting improved OOD generalization across datasets and models.

1 Introduction

  • Traffic datasets collected in small, stable environments have limited diversity, and models trained on them can lose performance under covariate shift.The paper focuses on shifts in input distributions while label distributions remain unchanged.Source: §1 · p. 1
  • Frequency-domain mixing methods perturb sequences while preserving structural information, but lack theoretical analysis and do not account for network traffic’s complex feature sequences.Prior methods had shown promising results in audio processing and time-series forecasting.Source: §1 · p. 2
  • The method combines pre-augmentation with linear label mixing for inter-class samples and windowed Fourier transforms for nonstationary traffic sequences.The authors identify low data diversity, unsuitable direct mixing of inter-class labels, and distortion of nonstationary sequences as problems with existing frequency-domain mixing.Source: §1 · p. 2
  • Experiments on artificial and real-world datasets show improved OOD generalization across mainstream models and better performance than other augmentation methods.The paper’s stated contributions include introducing frequency-domain mixing augmentation for malicious traffic detection and theoretically analyzing the method.Source: §1 · p. 2

2 Related Work

Prior malicious-traffic detection work includes deep models, OOD-oriented methods, and traffic-specific augmentation, while time-series work has explored frequency-domain mixing. The paper positions its approach as data augmentation for OOD generalization and notes that prior frequency-mixing studies lacked theoretical justification.

2.1 Malicious Network Traffic Detection

  • Earlier detection methods used handcrafted rules or statistical features, while deep learning models automatically extract features but have mainly focused on in-distribution traffic.Real-world packet reordering, duplication, and aggregation can produce OOD traffic and degrade model performance.Source: §2.1 · p. 2
  • Prior OOD detection work used confidence thresholds or adaptive clustering, whereas this paper targets OOD generalization through data augmentation.Han et al. and Diallo et al. are cited as examples of the former approaches.Source: §2.1 · p. 2

2.2 Data Augmentation

  • Time-series augmentation includes time-domain operations and frequency-domain mixing, but Kim et al. and Chen et al. [5] did not provide a theoretical justification for frequency mixing.Other examples include time warping and frequency masking for audio data [40].Source: §2.2 · pp. 2–3
  • Network-traffic augmentation has included feature perturbations and environment-variation methods, with reported limits in OOD gains or applicability to packet-length sequences.Han et al. reported limited OOD improvement; Xie et al. described a method restricted to packet length sequences.Source: §2.2 · p. 3

3 Problem Analysis

The analysis links low dataset diversity to fragile shortcuts, traffic similarity, and weak OOD generalization. It motivates augmentations that preserve relatively stable low-frequency trends while varying other sequence components.

3.1 Low Diversity in Network Traffic Datasets

  • Low diversity can make fragile shortcuts key classification cues; examples were identified in CIC-IDS2017 and CIRA-CIC-DoHBrw2020.The paper calls these features shortcuts because they can support strong performance but are non-robust.Source: §3.1 · p. 3, Figure 1 · p. 3
  • In CIC-IDS2017, matching the packet-length sequence “[60, 182, 60]” achieves 88.57% recall and 93.34% precision for botnet traffic.The passage presents this conspicuous sequence as an example of a shortcut.Source: §3.1 · p. 3
  • The identified cues reflect collection biases that may not hold in real-world traffic, and perturbing or removing LUCID’s listed features drops F1 below 50% and raises FPR above 1%.The unperturbed D1 result is F1 94.89% and FPR 0.53%.Source: §3.1 · p. 3
  • Traffic similarity can arise from repetitive protocol behavior and similar services, while controlled collection settings may exacerbate low diversity and shortcut reliance linked to poor OOD generalization.An LSTM trained on 1% of CIC-DoH achieves approximately 93% F1 and 1% FPR.Source: §3.1 · p. 3

3.2 Thoughts to Solve the Problem

  • In OOD cases involving environment variations or similar services, local sequence changes can leave overall trends and low-frequency components relatively similar.Prior work cited by the paper associates focus on low-frequency features with greater robustness [43].Source: §3.2 · pp. 3–4
  • CNNs using only low-frequency features perform comparably to or sometimes better than all-frequency models, and consistently outperform high-frequency models in OOD tests.The preliminary experiment retained the first or last 50% of frequency components and excluded dataset D4 because its small malicious-sample count could introduce bias.Source: §3.2 · p. 4, Figure 2 · p. 4
  • Frequency-domain mixing combines one flow’s low-frequency components with another’s high-frequency components to perturb sequences while keeping the first flow’s low-frequency features relatively stable.The paper obtains these robust features directly via FFT rather than feature extraction or representation learning.Source: §3.2 · p. 4

4 Method

The method formalizes frequency-domain mixing by joining frequency components from two sequences and reconstructing a real-valued sample with a correspondingly mixed label. Its analysis interprets this operation as a time-domain matrix transformation and contrasts its generated distributions with Mixup.

4.1.1 Formal Definition.

  • The authors formalize prior methods by Kim et al. and Chen et al. [5], noting that their core operation is shared despite minor differences.They state that those studies described the algorithm without providing its theoretical basis.Source: §4.1.1 · pp. 4–5
  • The conventional method takes two length-N sequences, transforms them with FFT, joins frequency-domain components at a randomly selected split, and applies IFFT to reconstruct a sample.It mixes the original labels in the same proportion as the frequency components.Source: §4.1.1 · pp. 4–5

4.1.2 Theoretical Analysis.

  • The frequency-domain operation is equivalent to adding a cyclic-convolution perturbation of the difference between the two samples to the original sample.The convolution kernel is the deterministic sequence obtained by applying IFFT to the frequency mask.Source: §4.1.2 · p. 5
  • Frequency-domain mixing can be expressed as a time-domain matrix transformation; setting its matrix to a diagonal matrix with entries λ makes it equivalent to Mixup.The analysis also interprets the transformation as expanding generated-sample coverage in feature space.Source: §4.1.2 · p. 5
  • In a two-component Gaussian-mixture visualization, frequency mixing spreads samples into previously uncovered regions, while Mixup concentrates them along lines between components.The figure marks original samples in blue and augmented samples in red.Source: Figure 3 · p. 5, §4.1.2 · p. 6

4.2 Limitations of the Existing Frequency-Domain Mixing Method

The existing frequency-domain mixing method can fail to increase data diversity, uses an unclear basis for mixing inter-class labels, and can lose temporal information in nonstationary traffic.

4.2 Limitations of the Existing Frequency-Domain Mixing Method

  • Low-diversity data may yield frequency-mixed samples concentrated near existing samples, and covariance can even decrease, reducing augmentation benefit.For a multivariate Gaussian, the transformation leaves the mean unchanged; the resulting samples may be no more diverse, or more concentrated, than the original data.Source: §4.2 · p. 6
  • The frequency-domain segment-length ratio may not define an appropriate inter-class label-mixing ratio after transformation back to time-domain inputs.Because the mixing matrix is circulant rather than a simple diagonal matrix, directly applying a mixing ratio to inter-class labels may have adverse effects.Source: §4.2 · p. 6
  • Fourier transformation of nonstationary traffic loses temporal information about changing frequency components, potentially degrading model performance.Local behavior patterns can change within a network session, so the retained trend may deviate from the real trend.Source: §4.2 · p. 6

4.3 Improved Frequency-Domain Mixing-Based Method

The proposed method combines small packet-level pre-augmentations with label-dependent core augmentation, using windowed frequency-domain mixing for same-label samples. Its semantic-preservation analysis bounds the expected label-distribution discrepancy under a low-frequency robustness assumption.

4.3 Improved Frequency-Domain Mixing-Based Method

  • The improved method addresses limited data diversity, unclear inter-class label mixing, and nonstationarity with pre-augmentation, linear label mixing, and windowed Fourier mixing.Inter-class samples use Mixup-style linear mixing, while same-class samples retain their label and use frequency-domain mixing within windows.Source: §4.3.1 · p. 6

4.3.1 Framework.

  • The framework first extracts packet feature sequences and applies packet shift and packet variation, then selects a core augmentation based on whether paired labels differ.Different-label pairs and their labels are linearly mixed; same-label sequences are windowed for frequency-domain mixing with the original label preserved.Source: §4.3.1 · p. 6

4.3.2 Pre-Augmentation.

  • Packet shift and packet variation perturb selected positions by small magnitudes to simulate real-world network changes while preserving label consistency.Packet shift changes packet positions by offsets; packet variation perturbs selected packet attributes.Source: §4.3.2 · p. 7

4.3.3 Core Augmentation.

  • For same-label pairs, the method applies Fourier mixing independently to corresponding windows and inverse-transforms each window to form a new sequence.Different-label pairs instead receive linear mixing of both samples and labels.Source: §4.3.3 · p. 7

4.3.4 Semantic Preservation of Our Method.

  • Under the assumption that low-frequency features are relatively robust to high-frequency variation, the expected TV distance between augmented and original label distributions is no more than ε.The paper presents this bound as indicating that the strategy generally retains the original sample’s label distribution and largely preserves semantics.Source: §4.3.4 · p. 8

5 Experiments

The experiments compare the method across artificial and real-world OOD settings, assess component contributions, and examine its effects on in-distribution performance.

5 Experiments

  • The evaluation covers OOD performance in artificial and real-world data, component ablations, and in-distribution effects; mixing-ratio and window-size sensitivity results are in Appendix E.Source: §5 · p. 8

5.1.1 Datasets and Evaluation Metrics.

  • D1–D3 reorganize DoH browser/server combinations and tunneling-tool traffic, D4 trains on CIC-IDS2017 and tests on CIC-IDS2018, and D5–D6 use different collection dates for training and testing.The task is binary classification; training data are split 6:2:2 for training, validation, and ID testing, while test sets evaluate OOD generalization using F1 and FPR.Source: §5.1.1 · pp. 8–9, Table 1 · p. 9

5.1.2 Models and Baselines.

  • The study tests three general and seven specialized classifiers, using six augmentation baselines and NoAug across feature sequences suited to each model.Baselines include jittering, permutation, random masking, Mixup, FreqMix, and Rosetta; augmentation is applied to packet-length and, where available, IAT sequences, with additional sequences for LUCID.Source: §5.1.2 · p. 9

5.3 Evaluation in Real-World Environment

  • On real-world datasets, Ours improves F1 in most cases without significantly increasing FPR; for Whisper on D6, F1 rises from 0.255 to 0.6338 and FPR falls from 0.1052 to 0.0516.Real-world ROC curves show smaller method differences, but Ours retains advantages on SmartDetector and LSTM; adjusting the decision threshold can help meet an acceptable FPR–TPR trade-off.Source: Table 3 · p. 11, §5.3 · p. 12

5.4 Ablation Study

  • The full setting is best in most ablation cases; removing linear mixing typically substantially reduces F1, while removing pre-augmentation or windowing can also degrade performance.Windowing can affect FPR sharply, and its removal often increases FPR; the authors associate windowing with greater focus on local packet-sequence behavior.Source: Figure 6 · p. 12, §5.4 · p. 13

5.5 Impact on In-Distribution Generalization

  • ID degradation is often minor: F1 falls by less than 3% and FPR rises by less than 0.5% in many cases, though augmentation also improves ID performance in some cases.D4’s larger F1 variations are attributed to its small test set of 81 malicious samples.Source: Table 4 · p. 13, §5.5 · p. 13

6 Discussion

The discussion identifies realism, feature applicability, evasion testing, and traffic-sequence characteristics as boundaries on the method’s use.

Biases of data augmentation

  • Augmented samples may not occur in reality, although intra-class mixing preserves relative low-frequency stability and inter-class linear mixing follows Mixup.The authors say these choices aim to support robust low-frequency representations despite possible sample bias.Source: §6 · p. 14

Applicability of our method

  • The method applies to numerical sequences but not categorical features; cross-feature correlation effects remain a future-work question.The authors report that augmenting only applicable features remains effective in their experiments.Source: §6 · p. 14

Robustness against evasion attacks

  • The paper does not evaluate specific evasion scenarios because defending against such attacks is outside its primary scope.Potential evasion robustness is presented as a belief based on parallels with adversarial training, not as an evaluated result.Source: §6 · p. 14

Limitations of our method

  • Short sequences provide fewer frequency components and constrain augmentation diversity; the authors recommend sequences of at least six packets.Windowing reduces the sequence-length requirement, while severely drifted flows, especially those differing in low-frequency components, may remain difficult.Source: §6 · p. 14

7 Conclusion

The paper analyzes frequency-domain mixing and adapts it for network packet feature sequences. Experiments on artificial and real-world datasets show improved OOD generalization and performance over other augmentation methods.

7 Conclusion

  • For inter-class samples, the method linearly mixes samples and labels; for intra-class samples, it applies frequency-domain mixing.It also adds pre-augmentation and uses a windowed Fourier transform to accommodate traffic-sequence nonstationarity.Source: §7 · p. 14
  • The paper first analyzes frequency-domain mixing and identifies limitations relevant to network traffic classification.Source: §7 · p. 14
  • The method significantly improves OOD generalization across multiple artificial and real-world datasets and outperforms other data augmentation methods.The authors connect this improvement with better handling of complex traffic in real-world environments.Source: §7 · p. 14

B Ethical Considerations

The authors report that authorized data collection and experiments caused no harm to real-world systems.

B Ethical Considerations

  • The study reports no ethical concerns because its authorized data collection and experiments caused no harm to real-world systems.Source: B Ethical Considerations · p. 15

C Experimental Details

The experiments use fixed-length packet-feature sequences and specified augmentation and training settings. The section also describes pre-augmentation operations and the method’s principal parameters.

C Experimental Details

  • Packet-feature sequences are set to length 100, with shorter sequences zero-padded and longer sequences truncated.Source: C Experimental Details · p. 15
  • Pre-augmentation shifts selected packet positions by up to two places and adds Gaussian noise scaled by 0.02 times sequence standard deviation.The perturbations are kept small to avoid excessively changing sequences and violating label consistency.Source: C Experimental Details · pp. 15–16
  • FreqMix uses a pre-augmentation ratio of 0.2, window length 10, and a Beta(1, 1) mixing ratio.The method’s principal parameters are the Fourier window length and frequency-domain mixing ratio.Source: C Experimental Details · p. 16
  • The listed comparison settings include Gaussian noise scaled by 0.05 times sequence standard deviation, permutation window length 5, random masking ratio 0.2, and Mixup Beta(1, 1).Table 5 is identified as the parameter-settings table for data augmentation methods.Source: C Experimental Details · p. 16, Table 5
  • Training uses Adam with learning rate 0.0001 and early stopping after 20 epochs without validation-loss improvement.Specialized-model settings follow their original papers except for input-length adjustments; SmartDetector uses augmentation during contrastive learning, not supervised training.Source: C Experimental Details · p. 16
  • Figure 7 presents probability density curves for beta distributions with different parameters, allowing a visual comparison of the curves across the parameter settings depicted.Source: Figure 7 · p. 16

D Detailed Results of Our Method’s Augmentation Performance on Out-of-Distribution and In-Distribution Data

The method substantially improves out-of-distribution detection, generally increasing recall while keeping false positive rates relatively low. On in-distribution data, performance usually declines slightly, though some cases improve.

D Detailed Results of Our Method’s Augmentation Performance on Out-of-Distribution and In-Distribution Data

  • The method considerably improves out-of-distribution performance, generally raising recall while preserving precision and maintaining a relatively low false positive rate.The reported recall improvement is accompanied by a slight FPR increase in general.Source: D Detailed Results of Our Method’s… · p. 16
  • On in-distribution data, recall, precision, and F1 usually decline slightly and FPR rises, although some cases improve.The authors consider this trade-off worthwhile given the improvement in out-of-distribution generalization.Source: D Detailed Results of Our Method’s… · p. 16

E Parameter Sensitivity Analysis

The analysis varies the mixing ratio distribution and Fourier-transform window length. Moderate settings are generally stable, while the authors recommend a uniform mixing-ratio distribution and a window length of 10 as practical balances.

E Parameter Sensitivity Analysis

  • Performance is relatively stable under moderate settings, but Beta(8.0, 8.0) and window length 100 produce more noticeable fluctuations.Some model-specific settings perform better, possibly because their augmented samples more closely resemble out-of-distribution traffic.Source: E Parameter Sensitivity Analysis · p. 17, Figure 8 · p. 17
  • The uniform mixing-ratio distribution, Beta(1.0, 1.0), is recommended as a balance between sample diversity and plausibility.For most models, window length 10 is recommended as a balance between feature granularity and mixing diversity.Source: E Parameter Sensitivity Analysis · p. 17
  • As α increases beyond 1.0, samples deviate further from original data; LSTM, 1D-CNN, and LUCID consequently show substantial F1 drops.FPR is generally less affected, though BAPM's FPR rises rapidly for larger α and TMWF's is relatively high at α = 0.5.Source: E Parameter Sensitivity Analysis · p. 17
  • Smaller windows improve time resolution but restrict available frequencies; larger windows enable more diverse mixing but risk losing local features.FPR tends to rise with window length, which the authors link to coarser perturbations interfering with precise malicious-sample discrimination.Source: E Parameter Sensitivity Analysis · p. 17
  • For most models, window length 100 yields lower F1 and higher FPR than windowing, supporting the importance of windowing.The optimal window varies by model; DF's F1 peaks at 50, while 1D-CNN and LUCID degrade above 10 before rebounding from 20.Source: E Parameter Sensitivity Analysis · p. 17

Related papers

Loading 2609.07156v1…