A Knowledge-Enhanced Dual-Generator GAN Framework for IoT Intrusion Traffic Generation

The unprecedented proliferation of Internet of Things (IoT) devices has significantly widened the cyber-attack surface, creating a critical need for diverse, scalable intrusion datasets. Traditional physical testbeds are costly and inflexible, motivating the development of synthetic alternatives. In this paper, we introduce a knowledge-enhanced Dual-Generator Generative Adversarial Network (GAN) framework capable of synthesizing high-quality IoT intrusion traffic directly from PCAP captures without physical infrastructure. Our proposed methodology encompasses a novel knowledge extraction mechanism, utilizing introduced attack-traffic-categorization mechanism and key-value (k,v) aggregation method to guide the conditional generation mechanism. Building on this foundation we introduce a conditional generation mechanism that embeds extracted knowledge into two specialized generators— one specializes in crafting realistic intrusion categories while the other focuses on synthesizing corresponding payload features, preserving temporal dependencies through residual-learning and dynamic-attention mechanism. Experimental results demonstrate optimal convergence around 3,200 epochs, with generated samples exhibiting 97% clustering around the mean. Pearson Correlation analysis confirms statistically significant (ρ < 0.05) correlations in 96% of generated features, while Spearman Rank analysis indicates both positive and negative correlations, highlighting the emergence of novel attack patterns. Machine-Learning tests on the benchmark CIC_IoT-23 [16] dataset validate that classifiers trained on our synthetic data outperforms baselines in accuracy, precision, recall, F1-score, and False Alarm Rate (FAR), underscoring the proposed model’s resource-efficiency, scalability, and effectiveness for advancing Deep-Learning-based Network Intrusion Detection System (NIDS) research.