Generative AI for Encrypted Traffic Analysis: Synthetic Dataset Generation and Classifier Evaluation

Synthetic anomalous traffic (attack patterns) is substantially harder to reproduce than normal traffic: models trained on synthetic data showed good precision for normal traffic (class 0) but notably lower precision for anomalous traffic (class 1), with tree-based models (XGBoost, Random Forest) proving more robust to synthetic training data than neural networks.

§V.C, Fig. 11 evaluation ml-classifier generic

Traditional DPI examining payload contents is described as 'largely ineffective' against TLS/SSL-encrypted traffic, forcing modern network security systems entirely onto flow-based and statistical analysis of packet metadata — packet sizes, inter-arrival timing, flow duration, and directional characteristics — without decrypting content.

§II.A evaluation dpitraffic-shape generic

Feature importance analysis across all models identified Flow Duration and packet length features (Forward Packet Length Maximum, Backward Packet Length Maximum, Total Length of Forward/Backward Packets) as the most discriminative for separating normal from anomalous encrypted traffic — these seven flow-level metadata features suffice to classify traffic without DPI.

§III.A, §V.C, Fig. 14 detection ml-classifiertraffic-shape generic

XGBoost classifiers trained and tested on real encrypted traffic data (CICIDS2017 + darknet) achieved 99.8% accuracy; models trained only on synthetic data reached 93.1% accuracy on real-data test sets, demonstrating that ML classifiers can effectively detect anomalous encrypted traffic without inspecting payload contents.

§V.C detection ml-classifiertraffic-shape generic

Kolmogorov-Smirnov tests showed statistically insignificant differences (p-values above 0.05) between real and synthetic feature distributions, and correlation matrix comparison showed a maximum absolute difference of 0.016 across all feature pairs — achieving an overall synthetic data quality score of 88.2%, sufficient to train production-grade anomaly detectors without access to real attack traffic.

§IV.A, §IV.C, Fig. 7, Fig. 8 evaluation ml-classifiertraffic-shape generic