Synthetic Network Traffic Data Generation: A Comparative Study
Dure Adan Ammara, Jianguo Ding, Kurt Tutschku
TL;DR
This work tackles the lack of direct, standardized comparisons among synthetic network traffic generation methods by benchmarking twelve approaches spanning non-AI, classical AI, and generative AI on NSL-KDD and CIC-IDS2017. It uses a unified evaluation framework focusing on fidelity, downstream utility via $TRTR$ vs $TSTR$, class balance, and scalability, with Mutual Information guiding feature selection. Results show GAN-based models, especially $CTGAN$ and $CopulaGAN$, offer superior fidelity and utility; statistical methods preserve balance but miss complex dependencies; diffusion models are costly and less scalable for tabular data. The study provides practical guidance for method selection, highlighting a structured benchmarking framework and releasing open-source code to support reproducible evaluation in network security contexts.
Abstract
The generation of synthetic network traffic data is essential for network security testing, machine learning model training, and performance analysis. However, existing methods for synthetic data generation differ significantly in their ability to maintain statistical fidelity, utility for classification tasks, and class balance. This study presents a comparative analysis of twelve synthetic network traffic data generation methods, encompassing non-AI (statistical), classical AI, and generative AI techniques. Using NSL-KDD and CIC-IDS2017 datasets, we evaluate the fidelity, utility, class balance, and scalability of these methods under standardized performance metrics. Results demonstrate that GAN-based models, particularly CTGAN and CopulaGAN, achieve superior fidelity and utility, making them ideal for high-quality synthetic data generation. Statistical methods such as SMOTE and Cluster Centroid effectively maintain class balance but fail to capture complex traffic structures. Meanwhile, diffusion models exhibit computational inefficiencies, limiting their scalability. Our findings provide a structured benchmarking framework for selecting the most suitable synthetic data generation techniques for network traffic analysis and cybersecurity applications.