Latent Diffusion for Internet of Things Attack Data Generation in Intrusion Detection
Estela Sánchez-Carballo, Francisco M. Melgarejo-Meseguer, José Luis Rojo-Álvarez
TL;DR
This work tackles severe class imbalance in IoT intrusion detection by introducing a latent diffusion model (LDM) that operates in a learned latent space. An autoencoder handles mixed-type tabular IoT traffic, and a diffusion model learns the latent distribution to generate diverse, realistic attack samples, which are decoded back to the original feature space. Across DDoS, Mirai, and MitM scenarios on the CICIoT2023 dataset, LDM-based augmentation yields substantial downstream gains, with F1-scores reaching up to 0.99 for DDoS and Mirai and robust improvements for MitM, while offering ~25% faster sampling than diffusion in data space. The approach balances fidelity, diversity, and efficiency, outperforming SMOTE, VAE, GAN, and direct DM in several metrics and providing a scalable solution for synthetic IoT attack data generation in ML-based IDSs.
Abstract
Intrusion Detection Systems (IDSs) are a key component for protecting Internet of Things (IoT) environments. However, in Machine Learning-based (ML-based) IDSs, performance is often degraded by the strong class imbalance between benign and attack traffic. Although data augmentation has been widely explored to mitigate this issue, existing approaches typically rely on simple oversampling techniques or generative models that struggle to simultaneously achieve high sample fidelity, diversity, and computational efficiency. To address these limitations, we propose the use of a Latent Diffusion Model (LDM) for attack data augmentation in IoT intrusion detection and provide a comprehensive comparison against state-of-the-art baselines. Experiments were conducted on three representative IoT attack types, specifically Distributed Denial-of-Service (DDoS), Mirai, and Man-in-the-Middle, evaluating both downstream IDS performance and intrinsic generative quality using distributional, dependency-based, and diversity metrics. Results show that balancing the training data with LDM-generated samples substantially improves IDS performance, achieving F1-scores of up to 0.99 for DDoS and Mirai attacks and consistently outperforming competing methods. Additionally, quantitative and qualitative analyses demonstrate that LDMs effectively preserve feature dependencies while generating diverse samples and reduce sampling time by approximately 25\% compared to diffusion models operating directly in data space. These findings highlight latent diffusion as an effective and scalable solution for synthetic IoT attack data generation, substantially mitigating the impact of class imbalance in ML-based IDSs for IoT scenarios.