PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks

Aadith Sukumar, Isha Singh, Devershika Mohane, Ankit Mukherjee, Ankush Dutta, Rahee Walambe, Ketan Kotecha

arXiv:2609.36167v1cs.CRcs.AI

TL;DR

DDoS detection faces differences between real and GAN-generated traffic that can limit performance on synthetic samples. This study combines GAN-generated data, adversarial debiasing, and Random Forest classification. After retraining on combined real and synthetic data, the model reached 99.987% testing accuracy and 72.60% accuracy on synthetic inference.

  • Problem

    Differences between real and GAN-generated traffic can leave a model biased toward real-world data and limit its generalization to synthetic traffic.

    Source: §1 · p. 3, §4.4 · p. 13

  • Method

    The study combines GAN-generated synthetic data with adversarial debiasing and Random Forest classification, then retrains using real and synthetic data.

    Source: §1 · p. 3, §4.5 · p. 13

  • Results

    After retraining on combined real and synthetic data, testing accuracy was 99.987%, and accuracy on synthetic inference was 72.60%, up from 50.00%.

    Source: §5 · p. 14

  • Takeaways & Limitations

    The framework shows promise for DDoS detection across training and evaluation phases, while providing insights into fairness-aware learning and data augmentation in cybersecurity.

    Source: §6 · p. 15

    The study used a controlled synthetic dataset and did not conduct real-time deployment or evaluation, limiting evidence about live network conditions.

    Source: §6.2 · p. 15

Abstract

from arXiv · show

Distributed Denial of Service attacks are a growing threat to network infrastructure, and new techniques, including the use of generative AI, make them harder to detect. Traditional detection systems, such as rule based firewalls, often fail to identify these evolving attack patterns. In this study, we propose a new method for detecting DDoS attacks by combining synthetic data generation using Generative Adversarial Networks with a Random Forest classifier. The GAN generated data showed 80.3 percent cosine similarity to real traffic, which helped the model learn underlying traffic patterns more effectively. To address imbalances in the data, especially in packet related features, we applied adversarial debiasing. This reduced the model's sensitivity to skewed distributions in variables such as forward and backward packet counts and total byte lengths. Our results show that models trained on a mix of synthetic and real data achieved significantly better performance: 99.98 percent accuracy on benchmark data and a 22.60 percent improvement when tested on previously unseen synthetic traffic. This suggests that the method can generalize well across different traffic scenarios and adapt quickly to new types of attacks. The proposed approach not only improves DDoS detection but also provides a scalable foundation for security models that account for bias and benefit from data augmentation. Our findings show that combining GANs with adversarial debiasing can lead to more robust and effective DDoS mitigation, supporting the further development of machine learning based cyber security.

1 Introduction

DDoS detection must contend with evolving attacks and differences between real and synthetic traffic. This study combines GAN-generated data with adversarial debiasing and Random Forest classification to address imbalance and evaluate model behavior across training, retraining, and inference.

1 Introduction

  • DDoS attacks threaten network-service availability, and volumetric, protocol, and application-layer attacks target different aspects of network systems.Examples include UDP flooding, SYN flooding, and HTTP flooding.Source: §1 · pp. 1–2
  • The study identifies limited attention to data imbalance and synthetic data generation in prior DDoS detection work as gaps motivating its approach.The related work notes that most surveyed studies do not address imbalance and that synthetic data generation is not extensively explored.Source: §1 · pp. 2–3
  • Real and synthetic traffic can have different data distributions, which the study treats as bias and investigates through comparisons of real, synthetic, and combined training data.The experiments examine the role of debiasing in DDoS detection.Source: §1 · p. 3
  • The proposed framework combines GAN-based synthetic data generation with adversarial debiasing to address imbalance and reduce bias in DDoS detection.The interventions target sensitive packet attributes and aim to improve generalization to evolving attack strategies.Source: §1 · p. 3
  • Its phase-based evaluation examines model behavior across training, retraining, and inference to inform adaptive security deployment.The paper describes this design as providing practical guidance for deploying adaptive security solutions.Source: §1 · p. 4

2 Literature Review

The reviewed work covers DDoS classification, ensembles, deep learning, imbalance handling, and adversarial approaches, while identifying data bias and augmentation as areas this study addresses.

2 Literature Review

  • Adversarial debiasing aims to reduce correlations between predictions and protected attributes, but its performance depends on data characteristics and subgroup representation.The review notes that training-data suitability and fairness–accuracy trade-offs require evaluation.Source: §2 · pp. 4–5
  • The review describes ensemble learning as a way to reduce prediction variance and improve generalization, while noting that technique choice involves computational-cost trade-offs.It also covers intrusion detection, RNN-based anomaly detection, and challenges posed by scarce public datasets that may not capture real-world behavior.Source: §2 · p. 5
  • Prior DDoS studies address imbalance through resampling or examine classifier performance, while the proposed work combines GAN-generated samples with adversarial debiasing.The cited examples include oversampling low-rate attacks and undersampling high-rate attacks, alongside benchmarks that do not address bias or imbalance.Source: §2 · pp. 5–6
  • The review contrasts prior adversarial work on robustness or broad fairness themes with this study’s focus on debiasing a DDoS classifier.It describes earlier GAN work as simulating adversarial traffic and a conceptual survey as framing adversarial ML for social good.Source: §2 · p. 7
  • Table 1 summarizes the reviewed literature by approach, datasets, and reported results.The supplied caption identifies it as a literature review summary.Source: §2 · p. 7, Table 1 · p. 8

3 System Design

The system design proceeds from a real-data baseline through GAN sample generation and retraining on a balanced real–synthetic mixture, followed by evaluation on held-out synthetic packets.

3 System Design

Phase 3: Retraining the Classification Model with Combined Datasets

  • Retraining combines 150,000 synthetic samples with an equal number of original samples, producing a 300,000-sample dataset balanced 1:1 between DDoS and BENIGN packets.The stated goal is to integrate synthetic data to minimize bias and improve generalization.Source: Phase 3: Retraining the Classification… · p. 9
  • Evaluation uses a separate 2,000-sample synthetic holdout, on which the retrained model achieved 72.60% accuracy.The design also treats preprocessing, GAN generation, training, and inference as independent modules for flexibility.Source: Phase 4: Inference and Evaluation of… · p. 9

4 Methodology

The methodology integrates real CIC-IDS2017 traffic with GAN-generated data, evaluates classification and synthetic-data inference, and applies debiasing to address bias between data sources.

4.1 Data Analysis

  • CIC-IDS2017 supplied labeled normal and DDoS traffic; its GAN training dataset had 225,745 rows and 85 features.Forward and backward packet counts were identified as key indicators of unusual network behavior.Source: §4.1 · pp. 9–10

4.2 Classification

  • StandardScaler equalized feature scales before five classifiers were compared; Random Forest led DDoS/BENIGN classification at 99.967%.The Random Forest uses multiple decision trees and voting for classification.Source: §4.2 · p. 11

4.3 Generative Adversarial Network

  • GAN training used generator-discriminator feedback, then generated DDoS data was combined with BENIGN data for analysis.The generator produced samples while the discriminator trained on real and synthetic data, giving feedback that guided generator updates.Source: §4.3 · pp. 11–12

4.4 Inferencing

  • Real-trained Random Forest inference scored only 50% on GAN data; the authors attribute poor transfer mainly to real-data bias, alongside distribution and noise differences.The study describes adversarial debiasing during synthetic-data generation and then integrates the debiased synthetic data into Random Forest training.Source: §4.4 · pp. 12–13, §4.5 · p. 13

4.5 Debiasing

  • Integrating GAN-generated debiased synthetic data into Random Forest training reduced bias and made the DDoS detector more robust and less sensitive to bias, helping it detect new attack patterns.The model’s low accuracy on unknown synthetic data was attributed mainly to its intrinsic bias toward the real-world data used for training.Source: §4.5 · pp. 13–14, §4.4 · p. 13

5 Result and Analysis

Retraining on augmented real and synthetic data improved benchmark testing accuracy and inference on synthetic packets compared with the real-only baseline.

5 Result and Analysis

  • 99.967% accuracy was achieved by Random Forest on BENIGN and DDoS packets, outperforming the other tested models.Table 2 presents testing accuracy for different machine-learning models classifying DDoS and benign packets.Source: §5 · p. 14, Table 2 · p. 14
  • 99.987% testing accuracy followed retraining on an augmented dataset combining real and synthetic data.The retrained model’s confusion matrix showed fewer false negatives and false positives than the initial baseline.Source: §5 · p. 14
  • 72.60% accuracy on synthetic packets after retraining surpassed the 50.00% achieved when the model was trained only on real data.The 50.00% inference result was reported alongside a GAN-to-real traffic cosine similarity score of 0.8031.Source: §5 · p. 14

6 Conclusion and Future Work

The conclusion presents a GAN-augmented, adversarially debiased Random Forest framework as promising for DDoS detection, while noting evaluation boundaries and proposing broader tests.

6.1 Main Contributions and Novelty of Study

  • +22.60% on unseen synthetic datasets, alongside near-perfect benchmark accuracy, is reported for the proposed system.The study also reports that the system combines GAN-generated synthetic data with adversarial debiasing.Source: §6.1 · p. 15

6.2 Limitation of Study

  • Testing centered on controlled synthetic data, used only Random Forest, debiased limited features, and omitted live evaluation, leaving real-time performance unmeasured.The authors also note distributional gaps between GAN-generated and real-world traffic.Source: §6.2 · p. 15

6.3 Recommendations for Future Research

  • Future work proposes RNN/CNN models, broader debiasing, live-stream evaluation, other cyber threats, and federated or edge deployment.Source: §6.3 · p. 16
Loading 2609.36167v1…