A Conditional Tabular GAN-Enhanced Intrusion Detection System for Rare Attacks in IoT Networks

TL;DR

The paper addresses intrusion detection in IoT networks under severe class imbalance, focusing on rare attack types in 6G-enabled environments. It introduces CTGSM-DNN, a two-stage system that combines conditional tabular GAN (CTGAN) synthetic minority data generation with SMOTEENN data cleaning, followed by a deep neural network classifier. On the CSE-CIC-IDS2018 dataset, the method achieves an overall accuracy of 99.90% and detects rare attacks with up to 80% accuracy, outperforming several baselines in recall and F1. The approach demonstrates that fitting minority-sample generation with quality-aware balancing can substantially improve rare-event detection in tabular intrusion data, with practical implications for IoT security; future work includes exploring LLMs and NLP for log- or text-rich data.

Abstract

Internet of things (IoT) networks, boosted by 6G technology, are transforming various industries. However, their widespread adoption introduces significant security risks, particularly in detecting rare but potentially damaging cyber-attacks. This makes the development of robust IDS crucial for monitoring network traffic and ensuring their safety. Traditional IDS often struggle with detecting rare attacks due to severe class imbalances in IoT data. In this paper, we propose a novel two-stage system called conditional tabular generative synthetic minority data generation with deep neural network (CTGSM-DNN). In the first stage, a conditional tabular generative adversarial network (CTGAN) is employed to generate synthetic data for rare attack classes. In the second stage, the SMOTEENN method is applied to improve dataset quality. The full study was conducted using the CSE-CIC-IDS2018 dataset, and we assessed the performance of the proposed IDS using different evaluation metrics. The experimental results demonstrated the effectiveness of the proposed multiclass classifier, achieving an overall accuracy of 99.90% and 80% accuracy in detecting rare attacks.

Figures (7)

• Figure 1: Class distribution of the dataset.
• Figure 2: The proposed CTGSM-DNN intrusion detection system architecture.
• Figure 3: T-SNE visualization of CSE-CIC-IDS2018 training data before and after applying CTGAN and SMOTEENN methods.
• Figure 4: Confusion matrix for binary classification.
• Figure 5: Train accuracy and loss for multiclass classification.