提出两种约束生成方法，可真实合成物联网网络流量用于安全检测。
Synthetic Network Packet Generation through Statistical Learning and Genetic Algorithms
- 用统计学习与遗传算法结合异常检测边界，确保生成包物理合理。
- 在12类攻击数据上实现0.62%~1.20%异常率，提升极小样本攻击数据200倍。
- 适合快速扩增数据集或对抗鲁棒性测试，性能互补可按需选择。
构建物联网环境下的鲁棒入侵检测系统需要大量标注数据，涵盖正常与恶意流量的真实分布。现有公开数据集存在活动分布固定和类别严重失衡问题，而深度生成模型（如GAN、VAE）无法保证合成包在物理有效特征范围内。本文提出并对比两种约束生成方法：(i) 基于PCA潜空间采样，结合双一类SVM与孤立森林边界约束的统计学习法；(ii) 将包生成视为多目标优化问题的遗传算法，显式设定异常模型接受度与分布保真度的适应度指标。两种方法均在生成流程中嵌入硬约束：双重异常检测门控、特征范围钳制与独立验证。在完整ACI IoT 2023数据集（1,231,411个包，12类攻击，类别失衡达175,805:1）上的评估表明，两者在独立训练的验证器下均通过30%异常率阈值检验：统计方法平均异常率为1.20%，吞吐量约1,091包/秒；遗传算法平均异常率为0.62%，各分类保持有机方差（0.00%-2.50%），吞吐量约5.7包/秒。两者成功将仅5样本的ARP欺骗类别放大200倍至1,000个有效样本。两方法约190:1的吞吐比与互补质量特性，为从快速数据增强到对抗鲁棒性测试等场景提供可量化的部署依据。
原文摘要 · Abstract (English)
Developing robust intrusion detection systems (IDS) for IoT environments requires large, labeled datasets capturing realistic traffic distributions across both benign and malicious activity. Existing public datasets suffer from fixed activity distributions and extreme class imbalance, while deep generative models (GANs, VAEs) provide no mechanism to enforce that synthetic packets remain within physically valid feature ranges. This paper proposes and compares two constraint-enforcing approaches for synthetic IoT network packet generation: (i) a statistical learning method combining PCA-based latent space sampling with dual One-Class SVM (OCSVM) and Isolation Forest (IF) boundary enforcement, and (ii) a genetic algorithm (GA) method that treats packet generation as a multi-objective optimization problem with explicit fitness criteria for anomaly model acceptance and distributional fidelity. Both methods embed hard validity constraints -- dual anomaly-detection gating, feature-range clamping, and independent validation -- directly into the synthesis pipeline. Evaluation on the complete ACI IoT 2023 dataset (1,231,411 packets, 12 attack categories, class imbalance up to 175,805:1) demonstrates that both methods achieve PASS status across all categories under independently trained validators with a 30% anomaly rate threshold: the statistical method attains 1.20% average anomaly rate with ~1,091 packets/s throughput, while the GA attains 0.62% average anomaly rate with organic per-class variance (0.00%-2.50%) at ~5.7 packets/s. Both methods successfully amplify the 5-sample ARP Spoofing category by 200x to 1,000 validated packets. The ~190:1 throughput ratio between methods, combined with their complementary quality profiles, provides evidence-based selection criteria for deployment contexts ranging from rapid dataset augmentation to adversarial robustness testing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。