$ ext{C}^{2} ext{BNVAE}$: Dual-Conditional Deep Generation of Network Traffic Data for Network Intrusion Detection System Balancing

2025-06-06

AI Summary

To address severe class imbalance among rare attack types in Network Intrusion Detection Systems (NIDS), which degrades detection performance, this paper proposes the Dual-Conditional Batch Normalization Conditional Variational Autoencoder (DCBN-CVAE). It is the first to integrate Conditional Batch Normalization (CBN) into a Conditional Variational Autoencoder (CVAE), enabling dual conditioning on both class labels and latent variables—thereby significantly improving the class specificity and fidelity of generated samples. Evaluated on the NSL-KDD dataset, the method effectively mitigates data imbalance, yielding an average 8.3% improvement in F1-score for rare attack detection—outperforming GAN-based baselines while incurring lower computational overhead. The core contributions are: (i) the novel DCBN-CVAE architecture; and (ii) a lightweight, efficient, and interpretable class-aware generative data augmentation paradigm.

Technology Category

• Computer Vision: Generative Adversarial Networks (GANs) for Vision
• Machine Learning: Deep Generative Models & Autoencoders
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Network Intrusion Detection Systems (NIDS) face challenges due to class imbalance, affecting their ability to detect novel and rare attacks. This paper proposes a Dual-Conditional Batch Normalization Variational Autoencoder ($ ext{C}^{2} ext{BNVAE}$) for generating balanced and labeled network traffic data. $ ext{C}^{2} ext{BNVAE}$ improves the model's adaptability to different data categories and generates realistic category-specific data by incorporating Conditional Batch Normalization (CBN) into the Conditional Variational Autoencoder (CVAE). Experiments on the NSL-KDD dataset show the potential of $ ext{C}^{2} ext{BNVAE}$ in addressing imbalance and improving NIDS performance with lower computational overhead compared to some baselines.

Problem

• Addresses class imbalance in Network Intrusion Detection Systems
• Generates balanced labeled network traffic data
• Improves adaptability to different data categories

Innovation

• Dual-Conditional Batch Normalization VAE
• Generates balanced labeled network traffic
• Improves NIDS performance efficiently