Generative AI for Encrypted Traffic Analysis: Synthetic Dataset Generation and Classifier Evaluation

This paper addresses the challenges of analyzing encrypted network traffic, specifically the limited visibility into packet contents and the imbalance in available datasets where anomalous traffic is underrepresented. The authors explore Generative AI (GAI) techniques to create realistic and balanced synthetic encrypted traffic datasets. Their methodology incorporates feature analysis, clustering-based data generation, and comprehensive classifier evaluation to ensure synthetic data quality. They demonstrate that properly generated synthetic data can effectively supplement real-world datasets, achieving up to 93% performance when training classifiers compared to those trained on real data. The proposed methodology preserves critical statistical properties and feature correlations while enabling the creation of balanced datasets, addressing the persistent challenge of anomaly underrepresentation in cybersecurity data. The paper also provides complete programming code.

The study utilized two established network traffic datasets: CICIDS2017 and darknet traffic data. The preprocessing pipeline included data cleaning, feature selection (identifying seven critical features: Flow Duration, Total Forward Packets, Total Backward Packets, Total Length of Forward Packets, Total Length of Backward Packets, Forward Packet Length Maximum, and Backward Packet Length Maximum), handling missing values with median replacement, anomaly labeling using Isolation Forest with a contamination rate of 0.1, and scaling with Standard Scaler. This resulted in 367,275 traffic flow records, and the synthetic data generator produced 734,550 synthetic records.

The feature distribution analysis revealed that most features exhibited right-skewed distributions, significant correlations existed between certain feature pairs (particularly packet counts and byte counts), and some features showed multimodal distributions. The authors applied K-means clustering separately for normal and anomalous traffic, identifying five primary clusters for normal traffic and three distinct clusters for anomalous traffic. The synthetic data generation process combined clustering information with correlation-aware adjustments, including steps such as scaling to normalized range, class-wise clustering, sample generation (selecting a cluster based on distribution, generating feature values around cluster center with controlled variance, applying correlation-aware adjustments), outlier generation for anomalous traffic, rescaling, and applying validity constraints. For normal traffic, they used cluster-based generation with 70% probability and direct sampling with small noise for the remaining 30%. For anomalous traffic, they used cluster-based generation (60%) and anomaly amplification (40%) to create varied attack patterns.

The evaluation of synthetic data quality employed multiple methods. Distribution comparison using density plots and the Kolmogorov-Smirnov test showed statistically insignificant differences between real and synthetic distributions for most features, with p-values above the typical 0.05 threshold. A synthetic data quality dashboard was developed that evaluates size ratio, class balance, and statistical similarity, achieving an overall quality score of 88.2% (grade B). PCA visualization revealed that the synthetic data successfully captures the overall structure and variance patterns of the real data. Correlation matrix comparison showed small differences (maximum difference of 0.016), indicating excellent correlation preservation.

For classifier performance evaluation, the authors used three model architectures: XGBoost, Random Forest, and a Neural Network (multi-layer perceptron with two hidden layers of 64 and 32 neurons with dropout regularization). They considered three training scenarios: Real → Real (baseline), Synthetic → Real, and Mixed → Real. Models trained on real data achieved superior performance, with XGBoost reaching 99.8% accuracy when trained and tested on real data. Models trained on synthetic data showed promising results with XGBoost achieving 93.1% accuracy when tested on real data. The confusion matrices revealed that XGBoost trained on synthetic data shows good performance for class 0 (normal traffic) but struggles more with class 1 (anomalous traffic). Tree-based models generally outperform neural networks when trained on synthetic data. ROC curves showed competitive AUC scores for models trained on synthetic data, and Precision-Recall curves revealed that models trained on synthetic data maintain good recall but experience some degradation in precision. Feature importance analysis showed consistent patterns between models trained on real and synthetic data, with Flow Duration and packet length features emerging as particularly important across all models.

Key observations from the results include: preservation of normal traffic patterns was highly effective; generating synthetic anomalies that fully capture the complexity of real network attacks remains challenging; tree-based models demonstrated greater robustness to synthetic data than neural networks; correlation-aware generation successfully maintained the relationship structure between features; and statistical properties of synthetic data closely matched real data. The slightly lower performance of models trained on synthetic data highlights the inherent tradeoff between data privacy and model performance, but the substantial performance achieved suggests synthetic data can be a valuable complement to real data, especially when real anomalous traffic samples are limited.

The paper concludes that the proposed approach successfully captures most of the patterns present in real encrypted traffic, with classifiers trained on synthetic data achieving up to 93% of the performance of those trained on real data. Key contributions include a comprehensive methodology for analyzing and preserving feature distributions and correlations, a cluster-based synthetic data generation approach, a rigorous evaluation framework combining statistical and predictive measures, and a quality assessment dashboard. Future work could explore more advanced generative models such as conditional GANs or VAEs, and investigate the transferability of synthetic data across different network environments.

Improvements to AI Systems:

1. Synthetic Data Generation for Imbalanced Cybersecurity Datasets: Implement the cluster-based, correlation-aware generation pipeline to create balanced synthetic datasets for training intrusion detection systems (IDS). This directly addresses anomaly underrepresentation, enabling AI models to learn rare attack patterns without requiring large volumes of real malicious traffic.

2. Privacy-Preserving Model Training: Use the proposed methodology to generate synthetic encrypted traffic data that preserves statistical properties and feature correlations. This allows AI systems to be trained on realistic data without exposing sensitive packet contents, enabling secure collaboration across organizations that cannot share raw network logs.

3. Robust Classifier Training via Mixed Data Augmentation: Adopt the Mixed → Real training scenario (combining synthetic and real data) to improve model generalization. The paper shows this approach can supplement limited real anomalous samples, potentially increasing recall for rare attack classes while maintaining high precision.

4. Feature Engineering and Selection for Network Traffic Models: Apply the identified seven critical features (e.g., Flow Duration, packet length statistics) as a standardized input set for network-based AI models. This reduces dimensionality, improves training efficiency, and ensures models focus on the most discriminative signals for encrypted traffic classification.

5. Quality Assurance Framework for Generative Models: Integrate the synthetic data quality dashboard (evaluating size ratio, class balance, and statistical similarity via KS tests and correlation matrices) as a validation layer in any GAN/VAE-based traffic generator. This ensures generated data meets minimum fidelity thresholds before being used for downstream AI training.

6. Cluster-Aware Anomaly Amplification: For anomaly detection models, incorporate the paper's technique of generating synthetic anomalies via cluster-based sampling (60%) and anomaly amplification (40%). This creates more diverse and realistic attack variations, improving the robustness of AI classifiers against novel or mutated attack patterns.

7. Model Selection Guidance for Synthetic-Data Training: Use the finding that tree-based models (XGBoost, Random Forest) outperform neural networks when trained on synthetic data. AI system designers can prioritize tree ensembles for initial deployments where only synthetic data is available, deferring neural networks until real data volume increases.

8. Correlation-Preserving Data Augmentation: Implement the correlation-aware adjustment step (maintaining feature pair relationships, e.g., packet counts vs. byte counts) in any data augmentation module. This prevents AI models from learning spurious independent feature distributions, improving their ability to generalize to real-world encrypted traffic.

What the Improved AI System Can Do:

• Detect rare and novel network anomalies with higher recall, even when trained on limited real samples, by leveraging balanced synthetic data.

• Operate in privacy-constrained environments (e.g., healthcare, finance) where raw traffic cannot be shared, by training on statistically equivalent synthetic copies.

• Achieve up to 93% of the performance of models trained on real data, while enabling faster iteration and stress-testing of classifiers against synthetic attack variations.

• Provide explainable feature importance (e.g., Flow Duration, packet lengths) for security analysts, improving interpretability of AI-driven threat detection.

• Automatically validate the quality of any generated traffic data before deployment, reducing the risk of model degradation due to poor synthetic samples.

• Adapt to new network environments by retraining on synthetic data that preserves cross-feature correlations, minimizing domain shift issues.

Network traffic analysis faces significant challenges with encrypted communications, primarily due to limited visibility into packet contents and the inherent imbalance in available datasets, particularly for anomalous traffic patterns. This paper addresses these challenges by exploring Generative AI (GAI) techniques to create realistic and balanced synthetic encrypted traffic datasets. Our approach incorporates feature analysis, clustering-based data generation, and comprehensive classifier evaluation to ensure synthetic data quality. We demonstrate that properly generated synthetic data can effectively supplement real- world datasets, achieving up to 93% performance when training classifiers compared to those trained on real data. The proposed methodology preserves critical statistical properties and feature correlations while enabling the creation of balanced datasets, ad- dressing the persistent challenge of anomaly underrepresentation in cybersecurity data. Along with the results we provide complete programming code designed and implemented in this work.