GMA-SAWGAN-GP: A Novel Data Generative Framework to Enhance IDS Detection Performance

2026-03-30

AI Summary

This work addresses the limited generalization of existing intrusion detection systems (IDS) to unknown attacks. The authors propose the GMA-SAWGAN-GP framework, which leverages a self-attention Wasserstein GAN with gradient penalty and incorporates Gumbel-Softmax to model discrete features while preserving categorical semantics. A manifold regularizer based on an MLP autoencoder is integrated, and a lightweight entropy-regularized gated network is designed to adaptively balance adversarial and reconstruction losses, thereby mitigating mode collapse and enhancing training stability and generation quality. Evaluated on NSL-KDD, UNSW-NB15, and CICIDS2017, the approach achieves average improvements of 5.3% and 2.2% in binary and multi-class classification accuracy, respectively, and boosts AUROC by 3.9% and true positive rate at 5% FPR by 4.8% for unseen attacks.

Abstract

Intrusion Detection System (IDS) is often calibrated to known attacks and generalizes poorly to unknown threats. This paper proposes GMA-SAWGAN-GP, a novel generative augmentation framework built on a Self-Attention-enhanced Wasserstein GAN with Gradient Penalty (WGAN-GP). The generator employs Gumbel-Softmax regularization to model discrete fields, while a Multilayer Perceptron (MLP)-based AutoEncoder acts as a manifold regularizer. A lightweight gating network adaptively balances adversarial and reconstruction losses via entropy regularization, improving stability and mitigating mode collapse. The self-attention mechanism enables the generator to capture both short- and long-range dependencies among features within each record while preserving categorical semantics through Gumbel-Softmax heads. Extensive experiments on NSL-KDD, UNSW-NB15, and CICIDS2017 using five representative IDS models demonstrate that GMA-SAWGAN-GP significantly improves detection performance on known attacks and enhances generalization to unknown attacks. Leave-One-Attack-type-Out (LOAO) evaluations using Area Under the Receiver Operating Characteristic (AUROC) and True Positive Rate at a 5 percent False Positive Rate confirm that IDS models trained on augmented datasets achieve higher robustness under unseen attack scenarios. Ablation studies validate the contribution of each component to performance gains. Compared with baseline models, the proposed framework improves binary classification accuracy by an average of 5.3 percent and multi-classification accuracy by 2.2 percent, while AUROC and True Positive Rate at a 5 percent False Positive Rate for unknown attacks increase by 3.9 percent and 4.8 percent, respectively, across the three datasets. Overall, GMA-SAWGAN-GP provides an effective approach to generative augmentation for mixed-type network traffic, improving IDS accuracy and resilience.

Problem

• Intrusion Detection System
• unknown attacks
• generalization
• data augmentation
• network traffic

Innovation

• Self-Attention
• Gumbel-Softmax
• WGAN-GP
• Manifold Regularization
• Generative Augmentation