Privacy-Aware Generative Augmentation for Imbalanced Intrusion Detection Using Differential Privacy

Abstract

Machine learning-based intrusion detection systems are often constrained by severe class imbalance, while generative augmentation may memorize distinctive network-flow records and expose membership information. This study evaluates privacy-aware augmentation for CICIDS2017 by integrating differentially private stochastic gradient descent (DP-SGD) into a conditional generative adversarial network and a variational autoencoder, yielding DP-CGAN and DP-VAE. The formal record-level privacy guarantee applies to the generative component and is tracked with an RDP accountant implemented through Opacus. Experiments use five target Benign-to-Attack augmentation ratios from one-to-one to one-to-five and five target privacy budgets of 0.5, 1, 2, 4, and 8. Random forest (RF) and XGBoost are evaluated using accuracy, Macro-F1, mean minority-class recall, and per-class recall for Bot, BruteForce, and Infiltration. Synthetic-data quality is examined through t-SNE, Wasserstein distance, mean squared error, and mean absolute error, while empirical privacy is assessed through a black-box membership-inference protocol using ROC-AUC, attack accuracy, and an accuracy-derived attack advantage. DP-CGAN preserves high downstream utility across both classifiers. DP-VAE remains competitive with random forest but degrades substantially with XGBoost, particularly for BruteForce and Infiltration. Membership-inference ROC-AUC remains close to 0.5 for both private and non-private generators under the implemented attack, indicating that no reliable membership signal was detected rather than proving the absence of leakage. These results show that private generative augmentation is feasible for imbalanced IDS learning, but its utility depends strongly on the interaction between generator architecture and downstream classifier.