Packet-Level DDoS Data Augmentation Using Dual-Stream Temporal-Field Diffusion

2025-07-26

AI Summary

To address the challenge of modeling complex spatiotemporal patterns in synthetic network traffic for DDoS attack detection—where conventional methods suffer from statistical distortion and degraded downstream detection performance—this paper proposes a diffusion-based dual-stream network traffic generation framework. The method introduces two complementary streams: a *spatial-field stream* capturing topological structure and a *spatiotemporal stream* modeling dynamic temporal dependencies, jointly regularized by a pre-trained Stable Diffusion prior to ensure multi-perspective, high-fidelity synthesis. Crucially, it couples diffusion generative mechanisms with the intrinsic time-series and graph-structural properties of network traffic, overcoming long-range dependency and sparse-event modeling limitations inherent in GANs and VAEs. Experiments demonstrate statistically significant improvements over state-of-the-art baselines in Kolmogorov–Smirnov tests and Jensen–Shannon divergence; moreover, the generated traffic boosts downstream anomaly detection and attack classification performance, yielding an average 8.2% gain in F1-score.

Technology Category

• Computer Vision: Generative Adversarial Networks (GANs) for Vision
• Natural Language Processing: Generation
• Machine Learning: Deep Generative Models & Autoencoders

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Social Networks and Social Media: Generative AI / large language models and their impact on social systems
• Web Mining and Content Analysis: Web data generation and simulation

Abstract

In response to Distributed Denial of Service (DDoS) attacks, recent research efforts increasingly rely on Machine Learning (ML)-based solutions, whose effectiveness largely depends on the quality of labeled training datasets. To address the scarcity of such datasets, data augmentation with synthetic traces is often employed. However, current synthetic trace generation methods struggle to capture the complex temporal patterns and spatial distributions exhibited in emerging DDoS attacks. This results in insufficient resemblance to real traces and unsatisfied detection accuracy when applied to ML tasks. In this paper, we propose Dual-Stream Temporal-Field Diffusion (DSTF-Diffusion), a multi-view, multi-stream network traffic generative model based on diffusion models, featuring two main streams: The field stream utilizes spatial mapping to bridge network data characteristics with pre-trained realms of stable diffusion models, effectively translating complex network interactions into formats that stable diffusion can process, while the spatial stream adopts a dynamic temporal modeling approach, meticulously capturing the intrinsic temporal patterns of network traffic. Extensive experiments demonstrate that data generated by our model exhibits higher statistical similarity to originals compared to current state-of-the-art solutions, and enhance performances on a wide range of downstream tasks.

Problem

• Address scarcity of labeled DDoS training datasets
• Improve synthetic trace generation for complex DDoS patterns
• Enhance ML detection accuracy with realistic synthetic data

Innovation

• Dual-stream diffusion model for DDoS data
• Spatial mapping integrates network characteristics
• Dynamic temporal modeling captures traffic patterns