Enhanced Network Intrusion Detection through Conditional GAN-based Minority Class Augmentation

Abstract

Severe class imbalance makes it difficult for network intrusion detection systems to detect rare attack classes. We introduce Cyber-Synth-CGAN, a conditional Wasserstein GAN with gradient penalty for synthesizing minority attack patterns, combining signed log-transform scaling, spectral normalization, minority-focused training cycles and a sample-size-gated augmentation policy. The scaler is fitted on training rows only, and all synthetic data are generated from the training partition. On CIC-IDS-2017, recall on Web Attack: Brute Force improved from 68.77% to 98.34% in a representative run, and by 29.90 points across five seeds (95% CI of the change [27.80, 32.00], p < 0.0001), with precision rising from 0.6509 to 0.6965. Average precision rose more modestly (0.7919 to 0.8340), indicating that much of the recall gain reflects a shift of the decision boundary rather than improved ranking. The five other classes with more than 1,000 training samples were statistically unchanged, whereas Web Attack: XSS (522 samples) lost 51.69 points; SMOTE showed the opposite pattern. These results suggest, but do not establish, a sample-size boundary between 522 and 1,206 training samples on this dataset, which we report as a dataset-specific observation rather than a validated threshold.