Towards generic quality assessment of synthetic traffic for evaluating intrusion detection systems

Adrien Schoen (1) , Gregory Blanc (2, 3, 4) , Pierre-François Gimenez (5) , Yufei Han (1) , Frédéric Majorczyk (6) , Ludovic Mé (1)

1 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition
2 IP Paris - Institut Polytechnique de Paris
3 TSP - RST - Département Réseaux et Services de Télécommunications
4 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité
5 CentraleSupélec [campus de Rennes]
6 DGA.MI - DGA Maîtrise de l'information

Network Intrusion Detection Systems (NIDSes) evaluation requires background traffic. However, real background traffic is hard to collect. We hence rely on synthetic traffic generated especially for this task. The quality of the generated traffic has to be evaluated according to some clearly defined criteria. In this paper, we show how to adapt the quality assessment solutions proposed for different fields of data generation such as image or text generation to network traffic. We summarize our study by discussing the criteria that evaluate the quality of a generated network traffic and by proposing functions to evaluate these criteria. This is the first contribution in the context of the Ph.D. thesis of Adrien Schoen.

Mots clés: Intrusion detection; Synthetic traffic; Evaluation; Data generation

Domaines: Cryptographie et sécurité [cs.CR]

Adrien Schoen, Gregory Blanc, Pierre-François Gimenez, Yufei Han, Frédéric Majorczyk, et al.. Towards generic quality assessment of synthetic traffic for evaluating intrusion detection systems. RESSI 2022 - Rendez-Vous de la Recherche et de l'Enseignement de la Sécurité des Systèmes d'Information, May 2022, Chambon-sur-Lac, France. pp.1-3. ⟨hal-03675359⟩