DDCTGAN: A Dual Discriminator Conditional Tabular Generative Adversarial Network for Network Intrusion Detection Systems

Network Intrusion Detection System (NIDS) is an important tool for ensuring network security and is widely used to defend against network attacks. Machine learning-based NIDS have demonstrated excellent performance in detecting attack traffic. However, there are issues: their detection accuracy drops when facing carefully designed adversarial attack traffic. Existing research shows that, to improve NIDS’ detection capability against adversarial attack traffic, more adversarial samples are needed for adversarial training to enhance the model’s robustness. However, the adversarial attack samples generated in current research are numeric, which presents two major limitations: 1) Numeric samples are inconsistent with the tabular data format commonly used in the NIDS field. Adversarial attack samples generated for one NIDS model will be incompatible with another NIDS model due to input format differences, resulting in poor generalization ability; 2) Numeric generation models are prone to excessively modify traffic features, causing the samples to no longer conform to network protocol specifications. To address these issues, we propose a Dual Discriminator Collaborative Optimization-based Tabular Data Generation Model (DDCTGAN). This model uses a dual discriminator mechanism to simultaneously learn the feature distribution of normal and attack samples, generating tabular adversarial attack samples that are consistent with the data format used in NIDS. The generated samples are more closely aligned with the original data distribution and provide more effective adversarial training for NIDS. Experimental validation: In the experimental section, the effectiveness of DDCTGAN is verified from two aspects: 1) the ability of adversarial attack samples to evade NIDS detection, and 2) the effect of using adversarial training samples to improve NIDS detection accuracy. The results show that the adversarial samples generated by DDCTGAN outperform the current state-of-the-art model, IDSGAN, in evasion rates; and NIDS retrained with adversarial attack samples generated by DDCTGAN performed better than IDSGAN in detection performance for DoS (90%) and Probe (95%) attack categories, with improvements over IDSGAN’s DoS (54.72%) and Probe (92.62%). Conclusion: In summary, DDCTGAN shows significant advantages in generating high-quality adversarial samples and enhancing NIDS robustness, providing a feasible solution for the effective detection of adversarial attack traffic in future NIDS applications.