Campus Access Only

All rights reserved. This publication is intended for use solely by faculty, students, and staff of Nova Southeastern University. No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, now known or later developed, including but not limited to photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the author or the publisher.

Comparative Evaluation of Data Augmentation Strategies for Rare-Class Intrusion Detection: Assessing Conditional Generative Adversarial Networks Across Benchmark Datasets and Classifiers

Author

• Brogan OConnor, Nova Southeastern UniversityFollow

Date of Award

2026

Document Type

Dissertation - NSU Access Only

Degree Name

Doctor of Philosophy in Information Systems (DISS)

Advisor

Gregory Simco

Abstract

Intrusion Detection Systems (IDS) are widely used to identify malicious network activity, unauthorized access, and anomalous system behavior. Although machine learning and deep learning classifiers often achieve strong aggregate performance on IDS benchmark datasets, rare attack detection remains difficult because of severe class imbalance. Minority attack categories may contain very few training observations, which can bias classifiers toward normal traffic and more frequent attack classes. This problem is especially important because rare attacks may represent high-impact security events even when they occur infrequently. This quantitative experimental study evaluated whether conditional generative adversarial network (cGAN) augmentation improved rare attack detection in supervised IDS classification. The study compared cGAN augmentation with four alternative training conditions: no augmentation, Synthetic Minority Oversampling Technique (SMOTE), Adaptive Synthetic Sampling (ADASYN), and standard generative adversarial network (GAN) augmentation. Experiments were conducted across three IDS benchmark datasets: NSL-KDD, UNSW-NB15, and CICIDS2017. Five classifier families were evaluated for each dataset and augmentation condition: Random Forest, Support Vector Machine (SVM), XGBoost, Convolutional Neural Network (CNN), and Long Short-Term Memory (LSTM). Performance was measured using accuracy, precision, recall, F1-score, false positive rate, and area under the receiver operating characteristic curve (AUC-ROC), with emphasis on macro recall, macro F1-score, and minorityclass performance. Results showed that cGAN augmentation was competitive in selected settings but did not outperform the best overall method on any dataset. On CICIDS2017, the strongest overall result was produced by baseline XGBoost, with a macro F1-score of 0.9181. On NSL-KDD, the strongest overall result was produced by SMOTE with SVM, with a macro F1-score of 0.6125. On UNSW-NB15, the strongest overall result was produced by baseline XGBoost, with a macro F1-score of 0.5186. The best cGAN models closely matched the strongest results on CICIDS2017 and UNSW-NB15 but trailed more substantially on NSL-KDD. The findings indicate that cGAN augmentation should not be assumed to outperform traditional resampling or strong unaugmented classifiers in imbalanced IDS classification. Instead, its usefulness depends on the dataset, target class, classifier, and quality of the generated synthetic observations. This study contributes a reproducible, multi-dataset, multi-classifier evaluation of conditional generative augmentation for minority-class IDS detection and reinforces the importance of evaluating rare attack performance with macro-level and per-class metrics rather than accuracy alone.

NSUWorks Citation

Brogan OConnor. 2026. Comparative Evaluation of Data Augmentation Strategies for Rare-Class Intrusion Detection: Assessing Conditional Generative Adversarial Networks Across Benchmark Datasets and Classifiers. Doctoral dissertation. Nova Southeastern University. Retrieved from NSUWorks, . (1222)
https://nsuworks.nova.edu/gscis_etd/1222.