Lightweight GenAI for Network Traffic Synthesis: Fidelity, Augmentation, and Classification

Abstract

Accurate Network Traffic Classification (NTC) is increasingly constrained by limited labeled data and strict privacy requirements. While Network Traffic Generation (NTG) provides an effective means to mitigate data scarcity, conventional generative methods struggle to model the complex temporal dynamics of modern traffic or/and often incur significant computational cost. In this article, we address the NTG task using lightweight Generative Artificial Intelligence (GenAI) architectures, including transformer-based, state-space, and diffusion models designed for practical deployment. We conduct a systematic evaluation along four axes: (i) (synthetic) traffic fidelity, (ii) synthetic-only training, (iii) data augmentation under low-data regimes, and (iv) computational efficiency. Experiments on two heterogeneous datasets show that lightweight GenAI models preserve both static and temporal traffic characteristics, with transformer and state-space models closely matching real distributions across a complete set of fidelity metrics. Classifiers trained solely on synthetic traffic achieve up to 87% F1-score on real data. In low-data settings, GenAI-driven augmentation improves NTC performance by up to +40%, substantially reducing the gap with full-data training. Overall, transformer-based models provide the best trade-off between fidelity and efficiency, enabling high-quality, privacy-aware traffic synthesis with modest computational overhead.

Figures (3)

• Figure 1: Overview of the proposed lightweight GenAI-based network traffic generation pipeline and real-world challenges linked with our Research Questions. Training phase workflow: real network traces are segmented into biflows and mapped into canonical image- or token-based representations; these serve as inputs to train diffusion, transformer, or state-space generative models. Generation phase workflow: trained GenAI models are conditioned to generate image- or token-based representations for a given traffic class; these are then converted into traffic matrices to feed downstream network traffic classifiers; generation efficacy is assessed in terms of both model and traffic evaluation.
• Figure 2: Radar plots of $6$ fidelity metrics comparing real and synthetic traffic data across generative models for $\mathtt{Mirage}$-$\mathtt{2019}$ (left) and $\mathtt{CESNET}$-$\mathtt{TLS22}$-$\mathtt{80}$ (right). For all considered metrics, lower values indicate better performance (with $0$ being optimal). Note that the axes are scaled with $0$ at the outer edge, meaning that models producing larger polygon areas exhibit higher generative fidelity.
• Figure 3: F1-score in data augmentation scenarios under low-data regimes for $\mathtt{Mirage}$-$\mathtt{2019}$ (left) and $\mathtt{CESNET}$-$\mathtt{TLS22}$-$\mathtt{80}$ (right) using an RF classifier. Colors indicate the approach family: orange for sequence-based , green for other generative models, red for statistical techniques, violet for expert transformations, black for real-only training.