Denoising Diffusion Implicit Models for Generating Cyber Defense Network Traffic

The lack of high-quality cyber security data is a significant barrier to the development of intrusion detection systems (IDSs). A growing body of work has shown that generative AI models provide an intuitive solution to this problem through the creation of synthetic samples of the minority classes within existing datasets. However, transforming IDS datasets into feature vectors usable with generative models is a steep challenge. Additionally, the research bridging generative models and IDS datasets has not kept pace with recent advancements in generative models. This paper addresses both of these issues with respect to network intrusion detection data specifically. In a novel approach, we use a very recent innovation in generative models known as Denoising Diffusion Implicit Models (DDIMs) to produce a hybrid synthetic/real dataset. We then evaluate its performance compared to prior work on the original dataset and compared against an approach based on Variational AutoEncoder (VAE). Our results demonstrate significant improvement in several IDS metrics when the IDS is trained on synthetic data from either model. The evaluation also highlights that the DDIM performs similarly or better than the VAE, depending on the IDS used in testing. Furthermore, we explore three different feature encoding strategies—normalized, binary, and decimal—in our evaluations and find that binary encoding has the highest performance for the NetFlow dataset NF-UQ-NIDS that we studied.