TempoNet: Learning Realistic Communication and Timing Patterns for Network Traffic Simulation

TL;DR

TempoNet tackles the challenge of generating realistic benign network background traffic by marrying multi-task learning with multi-mark temporal point processes to jointly model inter-arrival times and full header fields. The approach employs an LSTM history encoder and a LogNormMix TPP, with dedicated predictive modules for numeric and categorical headers, enabling temporally coherent, multi-field sampling. Comprehensive evaluation across four real-world datasets shows TempoNet achieves superior realism, temporal fidelity, diversity, and user-task utility (e.g., IDS evaluation) compared with GAN, LLM, and Bayesian baselines, while remaining computationally efficient. The work underscores the importance of realistic background traffic for cyber-range training and security benchmarking, and points to future directions in rare-event modeling, privacy, and payload-inclusive extensions.

Abstract

Realistic network traffic simulation is critical for evaluating intrusion detection systems, stress-testing network protocols, and constructing high-fidelity environments for cybersecurity training. While attack traffic can often be layered into training environments using red-teaming or replay methods, generating authentic benign background traffic remains a core challenge -- particularly in simulating the complex temporal and communication dynamics of real-world networks. This paper introduces TempoNet, a novel generative model that combines multi-task learning with multi-mark temporal point processes to jointly model inter-arrival times and all packet- and flow-header fields. TempoNet captures fine-grained timing patterns and higher-order correlations such as host-pair behavior and seasonal trends, addressing key limitations of GAN-, LLM-, and Bayesian-based methods that fail to reproduce structured temporal variation. TempoNet produces temporally consistent, high-fidelity traces, validated on real-world datasets. Furthermore, we show that intrusion detection models trained on TempoNet-generated background traffic perform comparably to those trained on real data, validating its utility for real-world security applications.

Figures (11)

• Figure 1: TempoNet architecture.
• Figure 2: Q--Q plots of LANL data flow inter-arrival times: generated vs ground truth.
• Figure 3: Daily seasonality - CIDDS dataset.
• Figure 4: Weekly seasonality - LANL dataset.
• Figure 5: Host Pair Analysis - LANL dataset.