A Data Mining Framework for Network Intrusion Detection Using GAN-Augmented Traffic Data

In the network security domain, there are three categories of Network Intrusion Detection Systems (NIDS): Signature-based, anomaly-based, and hybrid systems. Signature-based NIDS detects malicious activities by comparing incoming traffic with previously identified attack patterns, rules, or fingerprints stored in a database. When network behavior matches a stored pattern, the system detects malicious activity and sends an alert. This approach is highly efficient for known threats with low computational overhead and fast response time. But it has a major limitation: the inability to detect zero-day attacks, evolving malware variants, or previously unseen intrusion techniques that do not yet exist in the signature database (Ahmad et al., 2021). The second category is anomaly-based NIDS. These systems learn legitimate network behavior from historical traffic patterns, then continuously monitor new traffic to identify malicious activity from normal activity. Malicious activities may indicate denial-of-service attacks, botnet behavior, or unauthorized access. Anomaly-based detection has high performance because it can identify unknown and emerging threats without depending on predefined attack signatures. Some of these systems often generate higher false-positive rates, requiring careful threshold tuning and demanding significant processing resources when deployed in real-time environments (Thakkar and Lohiya, 2022). Anomaly-based systems are similar to classification tasks. While anomaly detection focuses on determining whether traffic is suspicious, classification aims to classify that suspicious traffic into specific categories, such as DoS, reconnaissance, exploits, or brute-force attacks. Classification models such as Random Forests, Decision Trees, K-Nearest Neighbors, and Support Vector Machines are widely used for this purpose. Overall, combining anomaly detection with classification provides security administrators with more actionable intelligence, as the system not only detects abnormal behavior but also explains the likely nature of the attack (Chindove and Brown, 2021). The third category is a hybrid NIDS that integrates two systems, signature-based and anomaly-based techniques, into one centralized framework. Hybrid systems benefit from the strengths of both methods: Rapid identification of known threats via signatures and detection of unknown threats via behavioral analysis. In conclusion, this combination often enhances detection accuracy by reducing false alarms and increasing adaptability in dynamic network environments such as cloud systems, IoT networks, and cyber-physical infrastructures (Binbusayyis and Vaiyapuri, 2021). In recent years, Generative Adversarial Networks (GANs) have demonstrated a powerful machine learning approach for improving intrusion detection systems. It includes two competing neural networks: a generator that produces synthetic samples and a discriminator that distinguishes between generated and real data. Through this adversarial learning process, GANs can generate realistic synthetic network traffic records that closely match the original datasets (Injadat et al., 2020). In intrusion detection research, GANs are primarily used to address one of the most common challenges in cybersecurity datasets, such as class imbalance. Many datasets consist of many normal traffic samples but relatively few examples of rare attacks, such as reconnaissance, shellcode, or worms. This imbalance makes classifiers become biased toward majority classes. Using GANs to generate attack samples can rebalance the training dataset, enabling machine learning models to learn minority attack patterns more effectively (Tama and Lim, 2021). Also, GANs can enhance robustness by generating adversarial traffic samples that simulate real attackers; training classifiers on these adversarial samples can strengthen resilience against sophisticated cyberattacks. In addition, advanced tabular GAN models, such as CTGAN, are particularly well-suited for structured intrusion detection datasets because they preserve relationships among categorical and numerical traffic features (Yang et al., 2021). Therefore, integrating data mining classifiers with GAN-augmented traffic data provides a modern and effective direction for intrusion detection research. Machine learning models serve as classification models, while GANs enhance data quality, improve recognition of minority attacks, and increase the overall reliability of IDS performance in realistic network environments (Lee and Park, 2021).

This study proposes a data-mining-based intrusion-detection framework that leverages GAN-augmented network traffic data to improve multi-class cyberattack detection on the UNSW-NB15 dataset. The proposed model addresses class imbalance, enhances minority-attack recognition, compares multiple classifiers, and evaluates the practical effectiveness of synthetic traffic generation in modern IDS environments.

NIDS are critical cybersecurity tools used to identify malicious traffic and unauthorized activities in computer networks. There are recent studies on implementing NIDS to enhance security by detecting threats. The authors proposed a GAN-based intrusion detection framework to address the challenge of imbalanced attack classes. Their study showed that GAN-generated traffic samples improved IDS performance and outperformed traditional oversampling methods such as SMOTE (Zhang and Liu, 2022). This study introduced G-IDS, in which GAN-generated synthetic samples were merged with the NSL-KDD dataset before classifier training. The results showed that the GAN-enhanced IDS achieved higher detection rates than conventional standalone IDS models (Bourou et al., 2021) proposed multiple tabular GAN architectures, including CTGAN, CopulaGAN, and TableGAN, for generating synthetic DoS attack records using the NSL-KDD dataset. Their findings confirmed that synthetic data preserved useful statistical patterns and improved machine learning model training (Patil et al., 2022) developed a BiGAN-based anomaly detection framework combined with Principal Component Analysis (PCA) using the KDD Cup 99 dataset. The findings showed that the proposed model achieved strong detection performance compared with several deep learning baselines. Truong-Huu et al. (2020) evaluated two GAN models with customized generator and discriminator networks using CICIDS2017 and UNSW-NB15. The experiments showed that GAN-based unsupervised learning can effectively detect abnormal traffic patterns. Mustapha et al. (2023) proposed an adversarial neural network approach to generate perturbed DDoS samples that resemble benign traffic. The results showed that adversarially modified traffic significantly reduced the IDS’s detection capability. Lin et al. (2022) introduced IDSGAN, a GAN-based framework that transforms malicious traffic into benign-like traffic while preserving attack functionality. Their generated adversarial traffic successfully evaded black-box IDS models. Similarly, this study (Chauhan and Heydari, 2020) proposed a polymorphic adversarial DDoS attack generation model using a GAN, in which attack features were dynamically modified to bypass IDS detection. Liu et al. (2022) employed two augmentation approaches, namely Variational Autoencoder (VAE) and Conditional VAE (CVAE), to improve IDS classification performance. Their study confirmed that synthetic data generation enhanced minority attack recognition and overall generalization. Finally, (Tabassum et al., 2022) proposed Fed GAN-IDS, which combines federated learning with GAN-based data generation to preserve privacy while collaboratively training distributed intrusion detection systems.

As shown in Table 1, although previous studies have shown promising results in applying GANs to intrusion detection systems, several important research gaps remain. Many studies relied on outdated benchmark datasets, such as KDD Cup 99, NSL-KDD, and older traffic collections. While these datasets are useful for comparison, they do not fully represent modern network environments, including encrypted traffic, IoT devices, and recent cyberattacks. Several studies mainly evaluated GANs based on their ability to generate synthetic data, without fully measuring how much the generated samples improve downstream IDS classifier performance. Many IDS studies focused on binary classification, classifying traffic as normal or attack, rather than identifying specific attack categories such as DoS, Botnet, Port Scan, Web Attack, and DDoS. Multi-class detection is more practical for real security operations. Several previous evaluations of system performance have focused on accuracy, but in intrusion detection, metrics such as Precision, Recall, F1-score, ROC-AUC, False Positive Rate, and confusion matrix analysis are also essential.

This study designs and implements a GAN-based approach to improve the accuracy of an intrusion detection system. The main pipelines of the proposed methodology are shown in Figure 1.

Table 1: Summary of related works.

In this study, the UNSW-NB15 dataset was selected because it is considered one of the modern and realistic benchmark datasets for cybersecurity research. Dislike older datasets; UNSW-NB15 includes contemporary attack behaviors and legitimate traffic patterns, making it more suitable for evaluating machine learning and deep learning intrusion detection models. It contained 257,673 network records with 45 attributes (Kaggle, 2024).

The important features are defined as shown in Table 2. Protocol and service features help distinguish attack communication types. Packet and byte statistics reveal flooding or scanning activities. Timing and jitter features identify suspicious traffic irregularities. Connection-counting features help detect malicious repeated attempts. Attack labels are required for supervised learning classification, which is the target feature.

Table 2: Dataset samples.

In this phase, identify the different categories of network traffic represented in the target variable in the UNSW-NB15. As shown in Figure 2, 10 traffic classes were identified, including 1 normal traffic category and 9 attack categories: Normal, Reconnaissance, Backdoor, DoS, Exploits, Analysis, Fuzzers, Worms, Shellcode, and Generic. The frequency distribution for each attack appears to be class-imbalanced. This imbalance may negatively affect the learning of classification models, leading to biased predictions toward the majority classes and a weak ability to detect rare attacks. To simplify the multi-class classification task and focus on the most representative categories, six major classes were selected: Normal, Generic, Exploits, Fuzzers, DoS, and Reconnaissance (Yang et al., 2021). The six selected classes used in this study represent the most common and informative traffic categories in the UNSW-NB15 dataset. These types are Normal, which refers to legitimate network traffic generated by authorized users and standard system operations, without malicious behavior. Generic represents exploits encryption mechanisms through brute-force or hash-cracking techniques. Exploits exploit software vulnerabilities to gain unauthorized access and disrupt systems. Fuzzers sent random input data to applications or services to discover vulnerabilities and trigger failures. DoS (Denial of Service) describes attacks designed to overwhelm network resources or services, making them unavailable to legitimate users by sending huge amounts of traffic from a single source. Reconnaissance involves scanning networks to identify open ports and collect system details before launching further attacks.

To improve dataset quality and enhance model performance, several preprocessing steps are applied. Scale numerical features to normalize the feature space and improve model performance. Split the dataset into training and testing sets using an 80:20 stratified split to preserve class distribution across both sets. Train a GAN model on the minority classes to generate synthetic network traffic samples. A combination of the synthetic data with the original dataset to form an augmented dataset. The class distribution was rebalanced by applying up-sampling to ensure equal representation across all attack categories. Encode label to prepare data for machine learning models.

To address class imbalance, this study employed a GAN that focused on the minority classes in the dataset. During this stage, only underrepresented attack categories such as Fuzzers, DoS, and Reconnaissance were selected to train the GAN model. The main objective of the GAN model is to learn the underlying data distribution of these minority classes and generate realistic synthetic samples that resemble real network traffic patterns. The GAN model consists of a generator that generates synthetic data and a discriminator that distinguishes between real and synthetic samples. Through adversarial training, both components improve iteratively, enabling the generator to produce high-quality synthetic records that preserve statistical properties of the original minority data. Once training is complete, the GAN generates additional synthetic samples to improve the representation of minority classes. This approach helps reduce class imbalance, increase dataset diversity, and improve machine learning models’ ability to learn discriminative patterns from previously underrepresented attack categories (Liu et al., 2022).

In this study, several machine learning models are trained, including Random Forest, K-Nearest Neighbors (KNN), and Decision Tree. There are two scenarios for training: in the first, train models on downsampled, balanced datasets of attackers; in the second, train models on balanced, synthetic data generated using a GAN. This approach allowed the models to learn more representative decision boundaries across all attack categories (Yang et al., 2021).

The performance of the machine learning models was evaluated using several metrics, including accuracy, classification reports, and normalized confusion matrices. Accuracy is the ratio of correctly classified instances to the total number of instances in the dataset and provides an overall measure of model performance. The classification report provides a more detailed evaluation by presenting several metrics such as precision, recall, and F1-score for each class. It summarises performance across all classes equally, proportional to each class’s support. The normalized confusion matrix is a visualization tool for evaluating classification performance at the class level. Unlike a standard confusion matrix, the normalized version presents values as percentages rather than raw counts, enabling better interpretation of how well each class is correctly predicted. Each row corresponds to the actual class, while each column represents the predicted class. It benefits from identifying misclassification patterns, such as confusion between similar attack types or bias toward majority classes. Finally, comparing results between two scenarios: before GAN was used and after GAN was used, to show the enhancement and the effectiveness of applying GAN.

In this section, the study presents results for two scenarios: The first before using GAN and the second after using GAN.

Based on the normalized confusion matrix shown in Figure 3, the random forest model achieves strong classification performance with an accuracy of 87.58%. The results indicate that the model classified the normal and generic classes very effectively, with most samples correctly predicted and recall values close to 0.98. Meaning that the majority of benign traffic and generic attack records were correctly recognized with minimal confusion. On the other hand, the model achieved acceptable performance for exploits, Fuzzers, and reconnaissance classes, with diagonal values in the normalized confusion matrix ranging from 0.77 to 0.80. Suggesting that moderate consistency in identifying these attack categories, although some misclassification occurred between similar intrusion types. The main weakness in the normalized confusion matrix was the DoS class, which had the lowest diagonal value at approximately 0.39. Meaning only 39% of actual DoS samples were correctly classified, while the remaining samples were incorrectly assigned to other categories. Suggesting that the model had difficulty distinguishing DoS traffic patterns from similar attacks (Liu et al., 2022).

As shown in Figure 4, the KNN model achieved an overall accuracy of 80.82%, which is lower than that of the random forest model. The matrix indicates that most legitimate network traffic was accurately recognized. But for the exploits class, the model achieved a moderate recall of 0.70, suggesting reasonable classification capability. Also, for both Fuzzers and reconnaissance classes, the model achieved only 0.55 recall, meaning nearly half of their samples were misclassified into other categories. The weakest performance was observed in the DoS class, with a recall of 0.37 and a precision of 0.35. Meaning a large portion of DoS attacks were incorrectly predicted as other classes, while many predicted DoS samples were false positives. Overall, the results indicate that KNN struggled to learn clear decision boundaries for this minority or overlapping class (Patil et al., 2022).

Based on the normalized confusion matrix in Figure 5, the DT model achieved an overall accuracy of 87.56%, ranking among the best-performing models in the initial experiments. But for the reconnaissance class, a recall of 0.76 was achieved, while the Exploits class reached 0.74, indicating moderate detection effectiveness for these attack categories. However, the main weakness in the DoS category was the model’s lowest recall of 0.43. Meaning that less than half of the actual DoS samples were correctly classified, while the remaining records were confused with other attack types. Suggesting that DoS traffic patterns overlap with other categories (Patil et al., 2022).

As shown in Figure 6, the normalized confusion matrix for random forests after using GAN. The result shows a well-balanced classification distribution, with all diagonal values very high and off-diagonal errors minimal. Suggesting that generated synthetic samples using GANs successfully enhanced class representation, reduced imbalance effects, and improved the model’s ability to learn discriminative patterns across all attack types (Tabassum et al., 2022).

According to Figure 7, after applying GAN data augmentation, the KNN model shows a clear improvement in overall classification performance by achieving an accuracy of 88.34%. The matrix indicates a more balanced distribution of correct predictions across all classes compared to the pre-GAN results, and the DoS class improved substantially, reaching a recall of 0.84, suggesting that most DoS attacks are now correctly identified (Tabassum et al., 2022).

Based on Figure 8, the DT model after GAN is highly robust and balanced, with nearly all diagonal values close to 1 and very minimal off-diagonal errors. Suggesting that synthetic data generated with a GAN effectively improved class representation, reduced imbalance issues, and strengthened the model’s ability to generalize across all intrusion categories (Patil et al., 2022).

As shown in Figure 9, comparing model performance before and after GAN data augmentation reveals a significant improvement across all evaluated machine learning models. Before GAN enhancement, the models achieved moderate performance, with random forests and DT achieving approximately 0.87 accuracy, while KNN performed slightly worse at around 0.81. Suggesting that the original dataset suffered from limitations such as class imbalance and insufficient representation of attack patterns. After integrating GAN synthetic samples, all models have a clear performance increase. Random forest and DT achieved a near-perfect accuracy of approximately 0.99, while KNN improved to 0.88. Meaning that GAN-based data augmentation significantly enhances the learning capability of all models. In summary, the improvement is especially notable in minority attack classes, where previously misclassification was higher. The GAN helped balance the dataset distribution, allowing models to learn more representative decision boundaries and reducing bias toward dominant classes such as normal and generic traffic (Tabassum et al., 2022).

The results show a significant improvement in all evaluated models after applying GAN-based data augmentation. Random Forest achieved the highest gain of 13.11%, followed closely by Decision Tree with 12.95%. Also, KNN showed a noticeable improvement of 9.32%, although its gain was comparatively lower than that of tree-based models. Meaning that ensemble and tree-based models benefit more from GAN-generated synthetic data, as they are better able to exploit improved class balance and richer feature distributions. The enhancement ensures that GAN integration substantially improves the learning capability and generalization performance of IDS models.

The author acknowledges the support of colleagues and academic staff who provided constructive feedback and technical guidance throughout this work. Finally, the authors appreciate the efforts of the open-source machine learning and deep learning communities whose tools and frameworks facilitated the implementation and evaluation of the proposed IDS framework.

This study presents a novel intrusion detection framework that integrates advanced data mining techniques with Generative Adversarial Networks (GANs) to enhance the performance of Intrusion Detection Systems (IDS). The research systematically compares the performance of Random Forest, K-Nearest Neighbors (KNN), and Decision Tree classifiers before and after GAN-based augmentation using the UNSW-NB15 dataset. The findings demonstrate that combining data mining preprocessing with GAN augmentation significantly improves attack detection accuracy, achieving approximately 99% accuracy for Random Forest and Decision Tree models.

Zainab Zaidon Kareem: Conceptualization, methodology, formal analysis, writing original draft, and visualization. Methodology, formal analysis, data curation, review and editing, supervision, Validation, investigation, data curation, review and editing, supervision. Validation, investigation, visualization, review and editing, supervision.

The authors declare that no generative AI and AI-assisted technology were used in the creation of this manuscript.

No funding received.

The author disclosed no competing financial interests.