MixGAN: A Hybrid Semi-Supervised and Generative Approach for DDoS Detection in Cloud-Integrated IoT Networks

2025-08-22

AI Summary

To address the challenges of class imbalance, label scarcity, and dynamic traffic modeling in DDoS attack detection for cloud-integrated IoT networks, this paper proposes MixGAN, a hybrid detection framework. MixGAN innovatively integrates conditional tabular GAN (CTGAN), semi-supervised learning, and a novel MixUp-Average-Sharpen strategy: a 1D WideResNet extracts temporal traffic features; a pre-trained CTGAN synthesizes high-fidelity minority-class attack samples; and data augmentation combined with prediction averaging mitigates pseudo-label noise. Extensive experiments on NSL-KDD, BoT-IoT, and CICIoT2023 datasets demonstrate that MixGAN achieves up to a 2.5% improvement in accuracy, along with 4% gains in both true positive rate (TPR) and true negative rate (TNR), significantly outperforming state-of-the-art methods.

Technology Category

• Machine Learning: Mixture of Experts (MoE)
• Computer Vision: Generative Adversarial Networks (GANs) for Vision
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

The proliferation of cloud-integrated IoT systems has intensified exposure to Distributed Denial of Service (DDoS) attacks due to the expanded attack surface, heterogeneous device behaviors, and limited edge protection. However, DDoS detection in this context remains challenging because of complex traffic dynamics, severe class imbalance, and scarce labeled data. While recent methods have explored solutions to address class imbalance, many still struggle to generalize under limited supervision and dynamic traffic conditions. To overcome these challenges, we propose MixGAN, a hybrid detection method that integrates conditional generation, semi-supervised learning, and robust feature extraction. Specifically, to handle complex temporal traffic patterns, we design a 1-D WideResNet backbone composed of temporal convolutional layers with residual connections, which effectively capture local burst patterns in traffic sequences. To alleviate class imbalance and label scarcity, we use a pretrained CTGAN to generate synthetic minority-class (DDoS attack) samples that complement unlabeled data. Furthermore, to mitigate the effect of noisy pseudo-labels, we introduce a MixUp-Average-Sharpen (MAS) strategy that constructs smoothed and sharpened targets by averaging predictions over augmented views and reweighting them towards high-confidence classes. Experiments on NSL-KDD, BoT-IoT, and CICIoT2023 demonstrate that MixGAN achieves up to 2.5% higher accuracy and 4% improvement in both TPR and TNR compared to state-of-the-art methods, confirming its robustness in large-scale IoT-cloud environments. The source code is publicly available at https://github.com/0xCavaliers/MixGAN.

Problem

• Detecting DDoS attacks in cloud-integrated IoT networks with limited labeled data
• Addressing severe class imbalance and noisy pseudo-labels in network traffic
• Handling complex temporal traffic patterns and dynamic attack behaviors

Innovation

• Hybrid method with conditional generation and semi-supervised learning
• 1-D WideResNet backbone for temporal traffic patterns
• MixUp-Average-Sharpen strategy for noisy pseudo-labels mitigation