Paper deep dive
Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection
Raihan Sultan Pasha Basuki, Aliyah Kurniasih
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 7/21/2026, 3:01:00 AM
Summary
This study proposes a BGAN-augmented TabTransformer framework for flow-based intrusion detection using the CICIDS2017 dataset. The Boundary-Seeking GAN (BGAN) serves a dual purpose: generating synthetic minority-class samples to mitigate class imbalance and producing adversarial samples to evaluate model robustness. Experimental results show that BGAN augmentation improves the TabTransformer's Macro-F1 score from 82.96% to 86.50%, with significant improvements for Web_Attack detection. The augmented model demonstrates superior adversarial robustness, achieving negative Performance Drop Rate (PDR) values compared to a 100% drop in non-augmented models, while maintaining low False Triggered Rates.
Entities (10)
Relation Signals (8)
BGAN → usedon → CICIDS2017
confidence 98% · using the CICIDS2017 dataset
BGAN → augments → TabTransformer
confidence 95% · This study proposes a TabTransformer framework augmented by the Boundary-Seeking Generative Adversarial Network (BGAN)
BGAN → generates → Adversarial Samples
confidence 95% · producing adversarial samples to evaluate model robustness
BGAN → generates → synthetic samples
confidence 95% · BGAN serves a dual purpose by generating synthetic minority-class samples
BGAN → improves → Macro-F1
confidence 95% · BGAN augmentation improves TabTransformer's Macro-F1 score from 82.96% to 86.50%
BGAN → enhances → Adversarial Robustness
confidence 90% · These findings demonstrate that BGAN consistently enhances both class balance and adversarial robustness
BGAN → mitigates → Class Imbalance
confidence 90% · BGAN serves a dual purpose by generating synthetic minority-class samples to mitigate data imbalance
TabTransformer → outperforms → decision tree
confidence 90% · augmented TabTransformer maintained stable and low False Triggered Rate (FTR) values... compared with the BGAN-augmented Decision Tree
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Machine learning-based intrusion detection systems (IDSs) often suffer from class imbalance and vulnerability to adversarial attacks, leading to degraded detection performance and reduced robustness. This study proposes a TabTransformer framework augmented by the Boundary-Seeking Generative Adversarial Network (BGAN) for flow-based intrusion detection using the CICIDS2017 dataset. BGAN serves a dual purpose by generating synthetic minority-class samples to mitigate data imbalance and producing adversarial samples to evaluate model robustness. Experimental results demonstrate that BGAN augmentation improves TabTransformer's Macro-F1 score from 82.96% to 86.50%, with the largest class-wise improvement observed for Web_Attack (F1 score: 0.29 to 0.61). Robustness evaluation shows that all non-augmented models experienced a 100% Performance Drop Rate (PDR) under adversarial testing, whereas all BGAN-augmented models achieved negative PDR values, indicating improved resilience. Furthermore, the augmented TabTransformer maintained stable and low False Triggered Rate (FTR) values (1.51%-2.92%) across all noise levels, compared with the BGAN-augmented Decision Tree, which reached 49.09% under benign perturbations. These findings demonstrate that BGAN consistently enhances both class balance and adversarial robustness, while the proposed BGAN-TabTransformer framework provides an effective and adaptive intrusion detection solution for adversarial network environments.
Tags
Links
- Source: https://arxiv.org/abs/2607.16348v1
- Canonical: https://arxiv.org/abs/2607.16348v1
Trouble viewing inline? Open PDF directly →
Full Text
43,545 characters extracted from source content.
Expand or collapse full text
Boundary-Seeking GAN-Augmented TabTransformer for Adversarially Robust Intrusion Detection Raihan Sultan Pasha Basuki raihansultan.pashabasuki@students.uag.ac.id Aliyah Kurniasih aliyah.kurniasih@uag.ac.id Abstract Machine learning-based intrusion detection systems (IDSs) often suffer from class imbalance and vulnerability to adversarial attacks, leading to degraded detection performance and reduced robustness. This study proposes a TabTransformer framework augmented by the Boundary-Seeking Generative Adversarial Network (BGAN) for flow-based intrusion detection using the CICIDS2017 dataset. BGAN serves a dual purpose by generating synthetic minority-class samples to mitigate data imbalance and producing adversarial samples to evaluate model robustness. Experimental results demonstrate that BGAN augmentation improves TabTransformer’s Macro-F1 score from 82.96% to 86.50%, with the largest class-wise improvement observed for Web_Attack (F1 score: 0.29 to 0.61). Robustness evaluation shows that all non-augmented models experienced a 100% Performance Drop Rate (PDR) under adversarial testing, whereas all BGAN-augmented models achieved negative PDR values, indicating improved resilience. Furthermore, the augmented TabTransformer maintained stable and low FTR values (1.51%–2.92%) across all noise levels, compared with Decision Tree augmented with BGAN which reached 49.09% under benign perturbations. These findings demonstrate that BGAN consistently enhances both class balance and adversarial robustness, while the proposed BGAN-TabTransformer framework provides an effective and adaptive intrusion detection solution for adversarial network environments. keywords: Intrusion Detection Systems , Boundary-Seeking GAN , TabTransformer , Class Imbalance , Adversarial Robustness †journal: Kuwait Journal of Science [ua]organization=Department of Computer Science, Universitas Ary Ginanjar, addressline=Menara 165, Cilandak No.kav 1 Lt 2 & 18, city=Jakarta Selatan, postcode=12560, state=DKI Jakarta, country=Indonesia highlights A BGAN-augmented TabTransformer is proposed for flow-based intrusion detection. BGAN mitigates class imbalance and generates adversarial evaluation samples. Macro-F1 improves from 82.96% to 86.50% on CICIDS2017. BGAN augmentation substantially improves adversarial robustness. 1 Introduction The Internet has become the backbone of modern digital services, connecting education, finance, healthcare, and government infrastructure through open, high-speed data exchange. This openness, however, has made networks an attractive target for cyberattacks such as malware propagation, phishing, distributed denial-of-service (DDoS), data breaches, and network intrusion [10], all of which can cause service disruption, sensitive data leakage, and substantial financial loss. Conventional network defenses – firewalls, VPNs, and encryption – remain largely reactive: firewalls block only traffic that violates predefined rules, and encryption cannot determine whether the traffic it protects is itself malicious [3]. Intrusion Detection Systems (IDS) address this gap by passively monitoring and analyzing traffic patterns to flag anomalies without interrupting legitimate communication, making out-of-band deployment possible and enabling deeper post-hoc analysis of attack behavior. While rule-based IDS are effective against known attack signatures, the constantly evolving threat landscape demands more adaptive detection. Machine learning (ML) and deep learning (DL) have consequently become the dominant paradigm for building IDS capable of recognizing previously unseen attack patterns [10]. This shift, however, introduces a new class of vulnerability: adversarial attacks. Alshahrani et al. [2] showed that GAN-based evasion and poisoning attacks can substantially degrade the accuracy of Decision Tree and Logistic Regression IDS models on the CICIDS2017 dataset, and more recent work has reported evasion rates against ML-based IDS as high as 99.9% when adversarial examples are explicitly optimized to bypass detection. These findings expose a fundamental weakness: models that achieve high accuracy on clean data can collapse almost entirely when presented with subtly manipulated input, motivating IDS research that targets robustness alongside accuracy. Prior work has advanced IDS design along two largely separate tracks. The first focuses on detection architecture. FlowLens [5] classifies traffic using flow-marker distributions for fast anomaly detection, while pForest [6] performs in-network inference with Random Forest for real-time classification; both, however, assume a stable traffic environment and do not account for deliberately manipulated adversarial traffic. More recently, Wang et al. [16] applied a TabTransformer architecture to intrusion detection and reported an F1-score of 98.45%, outperforming SVM, Logistic Regression, MLP, and voting ensembles by exploiting self-attention over tabular network features – statistical flow attributes such as duration, packet size, byte counts, and TCP flags that carry meaning only in relation to one another rather than through spatial adjacency. That study, however, was limited to binary classification and did not evaluate performance under class imbalance or adversarial manipulation, both of which are characteristic of realistic network environments. The second track uses Generative Adversarial Networks (GANs) either to synthesize minority-class samples for imbalance mitigation or to simulate adversarial traffic for robustness testing, but rarely both. IDSGAN [13] uses a Wasserstein-based generator to craft synthetic attack traffic that evades ML-based IDS; DRCGAN [17] adds residual connections to improve the stability of synthetic DDoS traffic under severe imbalance; and FR-GAN [12] incorporates a Soft Nearest Neighbor Loss to align synthetic and real feature distributions, improving minority-class F1-score without degrading majority-class performance. Complementary architectural advances, such as the multi-view heterogeneous graph model MH-Net [18] for encrypted traffic classification and deep neural network-based DDoS detection in software-defined networks [10], demonstrate the growing adoption of deep learning for network intrusion detection. Nevertheless, the increasing complexity of these models also enlarges the attack surface, as adversarial perturbations can significantly degrade detection performance [3]. Consequently, modern IDS should be both adaptive to evolving traffic patterns and resilient against adversarial manipulation. Four limitations persist across this body of work. First, ML/DL-based IDS remain vulnerable to small-scale evasion perturbations of network features. Second, most GAN-assisted IDS research focuses primarily on offline model training rather than deployment in dynamic real-time detection environments. Third, class imbalance remains a fundamental obstacle: attack samples are vastly outnumbered by benign traffic, biasing models toward the majority class [4]. Fourth, accurately modeling increasingly complex and encrypted network traffic remains a challenging task, motivating more expressive deep learning architectures such as MH-Net [18]. No existing framework combines a self-attention tabular classifier with a single generative model that serves both as a minority-class augmentation engine and as an adversarial sample generator for robustness evaluation. This study addresses that gap using a Boundary-Seeking GAN (BGAN), a GAN variant explicitly trained to generate samples near the decision boundary between benign and malicious classes [1]. BGAN is applied for a dual purpose: (i) enriching minority-class samples to improve detection of rare attack types, and (i) generating boundary-adjacent adversarial samples to stress-test model robustness – a combination not addressed by augmentation-only frameworks such as FR-GAN or DRCGAN. For classification, we adopt TabTransformer [11], whose self-attention mechanism is well suited to tabular flow features because it models feature-to-feature relationships directly. We evaluate on CICIDS2017 [15], a widely used IDS benchmark comprising roughly 2.8 million labeled flows across eight classes (Benign, Botnet, Brute Force, DDoS, DoS, Infiltration, Probe, and Web Attack) with severe class imbalance – Infiltration accounts for only 36 samples, while Benign traffic makes up roughly 80% of the dataset – making it a suitable testbed for evaluating BGAN-based augmentation. Flow-statistical features were extracted using a flow-based representation consisting of packet counts, duration, inter-arrival times, packet-size statistics, and TCP flag information, consistent with flow-level IDS approaches such as FlowLens [5]. The main contributions of this paper are as follows: 1. We propose a dual-purpose BGAN-augmented TabTransformer framework for flow-based intrusion detection that simultaneously mitigates class imbalance and improves adversarial robustness, extending prior TabTransformer-based IDS work [16] from binary to multi-class classification under adversarial conditions. 2. We quantify the effect of BGAN augmentation on minority-class detection performance on CICIDS2017, with particular attention to the Botnet, Infiltration, and Web Attack classes. 3. We evaluate model robustness using Performance Drop Rate (PDR) under BGAN-generated adversarial samples and False Triggered Rate (FTR) under benign Gaussian perturbation, integrating augmentation and robustness evaluation within a single TabTransformer-based framework. 4. We show that BGAN augmentation improves Macro-F1 from 82.96% to 86.50% and converts a 100% performance drop rate under adversarial testing into negative PDR values, indicating measurable robustness gains alongside improved class balance. The overall framework is illustrated in Figure 1. This study is scoped to model- and data-level evaluation in a controlled offline setting; in-network or on-switch deployment and evaluation on live real-time traffic are outside its scope. The remainder of this paper is organized as follows. Section 2 reviews related work on GAN-based augmentation and Transformer-based intrusion detection. Section 3 describes the CICIDS2017 dataset, preprocessing pipeline, BGAN augmentation procedure, and TabTransformer architecture. Section 4 presents classification and robustness results. Section 5 discusses the implications and limitations of the findings, and Section 6 concludes the paper. 2 Related Work Prior research relevant to this study clusters around four themes: class-imbalance mitigation, adversarial robustness evaluation, GAN-based data augmentation for IDS, and Transformer-based intrusion detection architectures. This section reviews representative studies in each theme and positions the present work relative to them. Class-imbalance mitigation. [4] addressed the severe class imbalance present in benchmark IDS datasets such as KDD99 and UNSW-NB15 by applying resampling techniques – random oversampling, random undersampling, their combination (RURO), SMOTE, and ADASYN – prior to training an artificial neural network (ANN) classifier. Oversampling-based methods improved minority-class recall and Macro-F1 substantially (e.g., Macro-F1 on KDD99 fell from 0.843 without resampling to as low as 0.618–0.761 under several resampling variants, while recall rose from 0.833 to as high as 0.961), but at the cost of increased training time and a higher risk of overfitting. This illustrates a persistent trade-off in resampling-only approaches: minority-class sensitivity improves, but generalization and computational cost both suffer – a trade-off that GAN-based synthetic augmentation aims to avoid by generating novel samples rather than duplicating or removing existing ones. Adversarial robustness evaluation. [2] were among the first to systematically evaluate ML-based IDS under GAN-generated adversarial conditions, testing Decision Tree (DT) and Logistic Regression (LR) classifiers on CICIDS2017 against both evasion and poisoning attacks crafted with a DCGAN. Evasion attacks reduced DT test accuracy, while poisoning attacks destabilized LR training; DT’s F1-score fell from 60% on clean data to 52% under poisoning, showing that tree-based models are more susceptible to adversarial manipulation than linear models. This study established the CICIDS2017 adversarial-evaluation protocol adopted in the present work, but evaluated only binary classification with classical ML models, leaving open how a self-attention tabular architecture such as TabTransformer behaves under equivalent adversarial pressure. GAN-based augmentation for IDS. Two studies motivate the specific choice of BGAN in this work. [1] applied Boundary-Seeking GAN augmentation to classical ML models (Random Forest, Decision Tree, and ANN), reporting consistent gains: ANN F1-score rose from 79.78% to 85.71%, Decision Tree F1-score from 72.22% to 84.86%, and Random Forest precision from 72.43% to 88.43%. These results demonstrate that generating synthetic samples near the decision boundary – rather than uniformly across the minority-class distribution – is particularly effective for sharpening classifier discrimination, motivating BGAN’s dual role in the present framework as both an augmentation and an adversarial-sample generator. [12] instead addressed a different failure mode of GAN augmentation: feature misalignment between synthetic and real samples. Their Feature-Regularized GAN (FR-GAN) adds a Soft Nearest Neighbor Loss to a WGAN backbone, improving Macro-F1 on CSE-CIC-IDS2018 from 75.9% (SMOTE) to 84.6% (WGAN-GP+SNNL) and on CICIDS2017 from 85.9% (SMOTE) to 88.0% (WGAN-GP+SNNL) while keeping accuracy unchanged. Neither study, however, uses the generator to construct adversarial test samples for robustness evaluation – both treat augmentation and robustness as separate concerns, which is precisely the gap this paper addresses by using BGAN for both purposes within a single framework. Transformer-based intrusion detection. [16] showed that TabTransformer’s self-attention mechanism outperforms SVM, LR, MLP, and voting ensembles on tabular flow features, reaching an F1-score of 98.45% versus 96.52% for the next-best model (MLP), but the evaluation was restricted to binary classification on a military network traffic simulation without adversarial or imbalance testing. Related hybrid architectures illustrate the broader trend toward combining Transformers with GANs: [14] proposed a Transformer–GAN–Autoencoder pipeline optimized with a Chimp Optimization Algorithm for edge and IIoT intrusion detection, achieving up to 98.92% accuracy across three IIoT datasets (WUSTL-IIoT-2021, EdgeIIoTset, TON_IoT), and [7] combined a BERT Transformer with WGAN-GP augmentation to defend against USB keystroke-injection attacks, improving detection accuracy from 86.20% to 90.02%. Both confirm that Transformer–GAN combinations are effective, but neither targets flow-based network intrusion detection with an explicit, quantified robustness evaluation against adversarial perturbation – the combination this paper provides. Collectively, prior work shows that resampling and GAN-based augmentation each improve minority-class detection in isolation, that adversarial vulnerability has been demonstrated for classical ML-based IDS [2], and that Transformer architectures outperform prior classifiers on clean, balanced, binary-classification tasks [16]. No prior study, however, combines a self-attention tabular classifier with a single dual-purpose generative model that both augments minority classes and generates adversarial test samples for quantified robustness evaluation under multi-class conditions – the gap this paper addresses. 3 Methodology Dual-Purpose BGANCICIDS2017PreprocessingCleaning, EncodingNormalizationTrain/TestSplitTraining SetHeld-outTest SetBoundary-Seeking GANSyntheticSamplesAdversarialSamplesAugmentedTraining SetTabTransformerClassificationPerformance(Acc., Recall, F1)RobustnessEvaluation(PDR, FTR)Stage 1Stage 2Stage 3Stage 4 Figure 1: Overview of the proposed BGAN-augmented TabTransformer framework. After preprocessing and dataset partitioning, the training set is used to train a Boundary-Seeking GAN (BGAN). The trained BGAN serves a dual purpose by generating synthetic minority-class samples for data augmentation and adversarial samples for robustness evaluation. The augmented dataset is then used to train the TabTransformer classifier, while the held-out test set and adversarial samples are employed to evaluate classification performance and adversarial robustness, respectively. 3.1 Dataset and Preprocessing The proposed framework is shown in Figure 1. This study uses CICIDS2017 [15], a network traffic dataset capturing five days of realistic traffic containing benign flows alongside DoS, DDoS, brute force, web attack, botnet, and infiltration activity, each flow described by 78 statistical features. The original 15 fine grained labels were regrouped into eight classes (Benign, DoS, DDoS, Probe, Brute_Force, Botnet, Web_Attack, Infiltration), and Benign traffic was undersampled to 200,000 samples to reduce majority class dominance, following [14]. The dataset was split into training and test sets using a stratified 80:20 ratio, so that minority classes such as Infiltration (29 training, 7 test samples) and Botnet (1,565 training, 391 test samples) remain proportionally represented. The test set was held out before augmentation and was not used to train any model or generator. Features were scaled with a StandardScaler fitted only on the training partition. Note that Benign undersampling was applied to the training partition only; the test set retains the original class proportions, yielding 454,265 Benign test samples. Table 1 summarizes the class distribution of the training set before and after augmentation under each scenario. Only the three targeted minority classes receive synthetic samples; all other classes remain unchanged. Table 1: Training set class distribution before and after augmentation. Δ Full = change under Full BGAN. Class Original Full BGAN Mixed Δ Full Benign 200,000 200,000 200,000 0 Botnet 1,565 6,000 6,000 +4,435 Brute_Force 11,066 11,066 11,066 0 DDoS 102,420 102,420 102,420 0 DoS 201,378 201,378 201,378 0 Infiltration 29 6,000 500 +5,971 Probe 127,043 127,043 127,043 0 Web_Attack 1,744 6,000 6,000 +4,256 Total 645,245 659,907 654,407 +14,662 The severity of class imbalance is evident: Infiltration comprises only 29 training samples against 201,378 DoS samples, a ratio exceeding 6,900:1. Botnet and Web_Attack, with 1,565 and 1,744 samples respectively, are less extreme but still substantially underrepresented relative to Benign traffic. Full BGAN augmentation increases the total training set by 14,662 samples (2.27%), a modest absolute increase that nonetheless has a disproportionate effect on minority-class detection, as shown in Table 5. 3.2 BGAN-Based Data Augmentation A standard GAN trains a generator G and discriminator D adversarially, but this objective is prone to vanishing gradients and is poorly suited to tabular data, where small perturbations near class boundaries matter more than overall realism. Boundary-Seeking GAN (BGAN) [1] addresses this by steering the generator toward samples that lie near the discriminator’s decision boundary rather than toward the bulk of the class distribution, using an importance weight derived from the discriminator output: w(x)=D(x)1−D(x)w(x)= D(x)1-D(x) (1) Samples the discriminator finds ambiguous (D(x)≈0.5D(x)≈ 0.5) are emphasized during training, which improves training stability and makes BGAN suitable both for augmenting rare attack classes and for generating adversarial samples that probe the decision boundary directly, its dual role in this study. The generator and discriminator are simple feedforward networks (two hidden layers of 128 units, trained with Adam for 200 epochs). BGAN was trained separately on the three minority classes, Botnet, Web_Attack, and Infiltration. Because Infiltration has only 29 training samples, the generator could not learn its distribution (Wasserstein distance of 8.62 between real and synthetic samples), so a Gaussian noise fallback (σ=0.05σ=0.05) was used for this class instead. Three scenarios were evaluated: Baseline (no augmentation), Full BGAN (all three minority classes augmented with BGAN to 6,000 synthetic samples each), and Mixed (BGAN for Botnet and Web_Attack, Gaussian fallback for Infiltration). Synthetic samples were used only in training and never entered the test set. Table 2 reports the Wasserstein distance between real and synthetic feature distributions for each class and scenario, used to assess the quality of generated samples. Table 2: Synthetic data quality by class and augmentation mode. Wasserstein << 1.5: OK; ≥ 3.0: BAD. Class Mode Method Wasserstein Status Botnet Full BGAN BGAN 0.921 OK Botnet Mixed BGAN 0.923 OK Web_Attack Full BGAN BGAN 0.905 OK Web_Attack Mixed BGAN 0.574 OK Infiltration Full BGAN BGAN 8.619 BAD Infiltration Mixed Gaussian 0.033 OK Botnet and Web_Attack generators converge well under both scenarios (Wasserstein << 1.0), confirming that BGAN successfully models the boundary region for these classes. Infiltration’s BGAN generator fails to produce a useful distribution (Wasserstein == 8.619), directly confirming that 29 training samples are insufficient for stable GAN convergence. The Gaussian fallback in the Mixed scenario reduces this to 0.033, validating its use as a replacement for this class specifically. 3.3 TabTransformer Classifier Classification uses TabTransformer [11], which applies self-attention across tabular features so that each feature is represented in context of every other feature, rather than independently as in a standard feedforward network. Since all 78 CICIDS2017 features are continuous, each is projected directly into a 32-dimensional embedding, following the adaptation used by [16]. These embeddings pass through two Transformer blocks of multi-head self-attention, Attention(Q,K,V)=softmax(QKTdk)VAttention(Q,K,V)=softmax ( QK^T d_k )V (2) followed by a feedforward sublayer, before a multilayer perceptron head produces the final classification. The model was trained with AdamW (learning rate 0.001, batch size 256) and early stopping on a held-out validation split, separately for each of the three augmentation scenarios. 3.4 Baseline Models Four baselines were trained under the same Baseline and Full BGAN scenarios for comparison: Random Forest and Decision Tree (both with balanced class weighting, matching the comparison models used in [12] and [1]), a shallow ANN following [1]’s configuration, and a deeper MLP that, unlike TabTransformer, processes features independently, serving as an ablation control for the effect of self-attention. 3.5 Evaluation Metrics Classification performance is evaluated using Accuracy, Precision, Recall, per-class F1-score, and Macro-F1 on the held-out test set. These metrics are computed from the confusion matrix, where True Positive (TP), True Negative (TN), False Positive (FP), and False Negative (FN) denote the numbers of correctly and incorrectly classified samples. Accuracy=TP+TNTP+TN+FP+FNAccuracy= TP+TNTP+TN+FP+FN (3) Precision=TPTP+FPPrecision= TPTP+FP (4) Recall=TPTP+FNRecall= TPTP+FN (5) F1=2⋅Precision×RecallPrecision+RecallF_1=2· Precision×RecallPrecision+Recall (6) For multi-class classification, the overall performance is summarized using the Macro-F1 score, which is defined as the arithmetic mean of the class-wise F1-scores: Macro-F1=1C∑i=1CF1,iMacro-F1= 1C _i=1^CF_1,i (7) where C denotes the total number of classes. In addition to conventional classification metrics, adversarial robustness is evaluated using two complementary measures. Performance Drop Rate (PDR) quantifies the relative degradation in F1-score when clean test samples are replaced with BGAN-generated adversarial samples of the same class: PDR=F1clean−F1adversarialF1clean×100%PDR= F1_clean-F1_adversarialF1_clean× 100\% (8) A positive PDR means performance degrades under attack; a negative PDR means it holds or improves. False Triggered Rate (FTR) measures how often correctly classified Benign samples are misclassified after small Gaussian perturbations (σ∈0.01,0.05,0.10σ∈\0.01,0.05,0.10\) are added, i.e. the false alarm rate under harmless noise: FTR=FPperturbedNBenign×100%FTR= FP_perturbedN_Benign× 100\% (9) All models were implemented in Python with PyTorch and scikit-learn, and trained on a GPU-equipped server. 4 Results All results below are computed on the held-out test set from Section 3.1. 4.1 Overall Classification Performance Table 3 reports accuracy and Macro-F1 for TabTransformer under all three scenarios and the four baselines under Baseline and Full BGAN. Table 3: Overall classification performance on CICIDS2017. Model Augmentation Accuracy Macro-F1 TabTransformer Baseline 99.26% 82.96% TabTransformer Full BGAN 99.61% 86.50% TabTransformer Mixed 99.51% 85.04% Random Forest No Aug 99.88% 96.08% Random Forest Full BGAN 99.88% 96.14% Decision Tree No Aug 99.87% 95.91% Decision Tree Full BGAN 99.86% 95.79% ANN No Aug 99.24% 75.23% ANN Full BGAN 98.99% 75.25% MLP No Aug 97.45% 72.70% MLP Full BGAN 97.49% 73.40% BGAN augmentation raised TabTransformer’s Macro-F1 from 82.96% to 86.50%, driven mainly by the Web_Attack class (Section 4.2). Random Forest and Decision Tree reach a higher overall Macro-F1, likely because CICIDS2017’s classes are fairly linearly separable, a condition that favors tree-structured boundaries, and because both baselines use balanced class weighting while TabTransformer does not. TabTransformer’s advantage instead appears in the robustness results in Section 4.3. 4.2 Per-Class and Minority-Class Performance Table 4 reports per-class performance for the proposed Full BGAN model. Majority classes all reach F1-scores at or above 0.99; the three minority classes targeted by augmentation are more variable. Table 4: Per-class results, TabTransformer Full BGAN. Class Precision Recall F1 Benign 1.00 0.99 1.00 Botnet 0.50 0.72 0.59 Brute_Force 0.99 1.00 0.99 DDoS 1.00 1.00 1.00 DoS 0.98 1.00 0.99 Infiltration 0.67 0.86 0.75 Probe 0.99 1.00 1.00 Web_Attack 0.45 0.95 0.61 Botnet shows low precision (0.50) despite reasonable recall (0.72), meaning other classes are often misclassified as Botnet; Web_Attack shows the opposite pattern, high recall (0.95) but low precision (0.45). Table 5 compares F1-scores for these three classes across all three augmentation scenarios. Table 5: F1-score by augmentation scenario, minority classes. Class Baseline Full BGAN Mixed Botnet 0.5209 0.5897 0.5794 Infiltration 0.8571 0.7500 0.7500 Web_Attack 0.2934 0.6105 0.5020 BGAN augmentation gives the largest gain on Web_Attack (0.29 to 0.61), confirming its value for classes with many training samples but heavy feature overlap with other classes. Infiltration instead performs best without augmentation, since only 29 training samples were available and the generator could not learn a useful distribution for that class, as noted in Section 3.2. 4.3 Adversarial Robustness: PDR and FTR Table 6 reports PDR under BGAN-generated adversarial samples, and Table 7 reports FTR under benign Gaussian noise, for all models and scenarios. Table 6: Performance Drop Rate (PDR) by class. Model Aug. Botnet Web_Attack Infilt. TabTransformer None 100% 100% 100% TabTransformer Full BGAN −-24.75% −-3.80% −-9.80% TabTransformer Mixed −-24.97% −-0.87% 100% Random Forest None 100% 100% 100% Random Forest Full BGAN −-3.02% −-1.30% −-8.33% Decision Tree None 100% 100% 100% Decision Tree Full BGAN −-3.52% −-1.22% 0.00% ANN None 100% 100% 100% ANN Full BGAN −-26.36% −-5.43% −-94.44% MLP None 100% 100% 100% MLP Full BGAN −-39.57% −-10.84% −-337.50% Table 7: False Triggered Rate (FTR), Benign traffic under noise. Model Aug. σ=0.01σ=0.01 σ=0.05σ=0.05 σ=0.10σ=0.10 TabTransformer None 1.60% 1.90% 2.39% TabTransformer Full BGAN 1.51% 2.19% 2.92% TabTransformer Mixed 1.95% 9.28% 8.22% Random Forest None 0.00% 0.00% 0.00% Random Forest Full BGAN 0.00% 0.00% 0.00% Decision Tree None 11.94% 10.05% 11.13% Decision Tree Full BGAN 39.13% 37.28% 49.09% ANN None 4.40% 27.14% 38.35% ANN Full BGAN 2.70% 17.80% 31.03% MLP None 3.17% 3.64% 4.34% MLP Full BGAN 3.09% 3.79% 4.41% Every model without augmentation collapses completely under adversarial samples (PDR = 100% on all three classes), confirming that no architecture is inherently robust without prior exposure to boundary-region samples. After Full BGAN augmentation, every model except Mixed on Infiltration reaches negative PDR, meaning performance holds or improves under attack. Mixed on Infiltration remains at PDR = 100% because that scenario substituted Gaussian perturbation for BGAN on this class, so the model was never exposed to the BGAN generator’s boundary distribution for Infiltration – a direct consequence of the Gaussian fallback rather than a failure of the augmentation strategy itself. Among augmented models, MLP Full BGAN shows the most extreme negative PDR values (−-39.57% for Botnet, −-337.50% for Infiltration). These values should be interpreted with caution: [11] showed that MLP processes each feature independently through context-free embeddings, making it susceptible to memorizing the generator’s specific distributional signature rather than learning genuinely generalizable representations. TabTransformer’s more moderate negative PDR (−-24.75% for Botnet, −-9.80% for Infiltration) reflects contextual generalization across features rather than generator-specific memorization, and is therefore a more meaningful indicator of genuine robustness. On FTR, Random Forest reaches 0% because its threshold-based decision boundaries do not shift under small Gaussian noise – a property that also means it cannot detect gradual distributional drift characteristic of stealthy adversarial manipulation. Decision Tree’s FTR rises sharply after Full BGAN augmentation (up to 49.09%), indicating that GAN-generated training data can destabilize tree-based models rather than improve them. ANN Full BGAN reduces FTR compared to ANN without augmentation (from 38.35% to 31.03% at σ=0.10σ=0.10), but values remain substantially elevated. TabTransformer Full BGAN maintains the most stable FTR profile (1.51% to 2.92%) across all noise levels. Although TabTransformer Full BGAN FTR is marginally higher than the unaugmented baseline (1.60% to 2.39%), the difference is negligible and the augmented model remains consistently low – in contrast to Mixed, which exhibits a non-monotonic anomaly at σ=0.05σ=0.05 (9.28%) caused by its Infiltration Gaussian fallback using the same σ value as the FTR evaluation noise, leading the model to associate Benign-plus-noise samples with the Infiltration class. This stability is consistent with [11]’s finding that attention-based contextual embeddings are more resilient to noisy tabular input than architectures that process features independently. 5 Discussion 5.1 Comparison with Prior Work Table 8 compares this study against prior GAN-based and resampling-based IDS work. Table 8: Comparison with prior GAN-based and resampling-based IDS studies. n/r = not reported. Study Dataset Method Acc. MF1 [2] CICIDS2017 GAN (evasion) 98.0% 60.0% [1] KDDCUP BGAN n/r ≈ 79.9% [12] CICIDS2017 SMOTE 99.5% 85.9% [12] CICIDS2017 WGAN-GP+SNNL 99.7% 88.0% [12] CICIDS2018 WGAN-GP+SNNL 98.8% 84.6% This study CICIDS2017 None (baseline) 99.3% 83.0% This study CICIDS2017 Full BGAN 99.6% 86.5% On CICIDS2017, Full BGAN surpasses SMOTE-based augmentation (86.50% versus 85.90%) but falls below Li et al.’s WGAN-GP+SNNL (88.00%) [12], the strongest single-dataset result in that study. This gap is expected: WGAN-GP+SNNL employs a more complex multi-loss objective with Soft Nearest Neighbor Loss specifically tuned for feature alignment, while BGAN uses a simpler importance-weighted objective. However, unlike FR-GAN [12], this study evaluates the same generator as both an augmentation tool and an adversarial attack source, yielding measurable robustness results (PDR and FTR) that are absent from the FR-GAN study. Against [1], who also applies BGAN but with classical classifiers on KDDCUP, the Macro-F1 here is substantially higher (86.50% versus approximately 79.90%), consistent with self-attention providing an advantage over tree-based and shallow neural classifiers under the same augmentation strategy. On CICIDS2018, Li et al.’s best method achieves 84.60%, below this study’s 86.50% on CICIDS2017; however, since the datasets differ in class distribution and traffic composition, this cross-dataset comparison is not direct. 5.2 Architectural Robustness of TabTransformer The robustness advantage of TabTransformer observed in this study is supported by independent benchmarking results from the tabular adversarial learning literature. He et al. [9] systematically evaluated adversarial attacks across multiple tabular classifiers using their TabAttackBench framework and found that Transformer-based models require substantially larger perturbation budgets to reach attack success rates comparable to those against MLP or Logistic Regression. They attribute this to the attention mechanism’s global feature contextualization: because each feature’s embedding is conditioned on all other features, perturbing a single feature has a smaller marginal effect on the final representation than it would in a context-free architecture such as MLP. This is consistent with the FTR results in Table 7, where TabTransformer Full BGAN maintains a stable false alarm rate (1.51%–2.92%) while MLP and ANN exhibit substantially higher sensitivity to Gaussian noise (up to 4.34% and 38.35%, respectively). Djilani et al. [8] further showed that adversarial samples generated from one model transfer least effectively to TabTransformer compared to Random Forest, XGBoost, and other tabular classifiers, suggesting an inherent cross-model robustness property tied to the attention architecture. This finding is independently consistent with the PDR results in Table 6: Decision Tree Full BGAN reaches PDR values of −-3.52%, while TabTransformer Full BGAN reaches −-24.75% for the same adversarial generator, suggesting that TabTransformer extracts more generalizable boundary-region representations from the BGAN-augmented training data. Taken together, these results indicate that the BGAN augmentation strategy and the TabTransformer architecture are mutually reinforcing: BGAN supplies boundary-region training samples that the attention mechanism is particularly well suited to leverage, yielding a combination whose robustness exceeds what either component would provide alone. 5.3 Limitations Three limitations are worth noting. First, the Infiltration class remains largely unresolved: with only 29 training samples, BGAN could not model its distribution, and the Gaussian fallback used instead does not capture genuine infiltration behavior; few-shot or transfer-learning approaches may be needed. Second, Web_Attack shows persistently low precision despite high recall, likely due to feature overlap with other HTTP-based traffic; additional protocol-aware features may help beyond augmentation alone. Third, this evaluation is entirely offline on a fixed dataset; validation on live, dynamically shifting network traffic would be needed before production deployment. 6 Conclusion This study proposed a BGAN-augmented TabTransformer framework for flow-based intrusion detection, in which a single BGAN generator both augments minority attack classes during training and generates adversarial samples for robustness evaluation. TabTransformer with Full BGAN augmentation reached 99.61% accuracy and 86.50% Macro-F1 on CICIDS2017, a 3.54 point Macro-F1 gain over the same architecture without augmentation, driven mainly by the Web_Attack class. The clearest evidence for the dual-purpose design comes from the robustness results: every model tested without augmentation collapsed completely (PDR = 100%) under BGAN-generated adversarial samples, while nearly every augmented model held or improved performance, with the exception of Mixed on Infiltration (PDR = 100%), because that scenario used Gaussian fallback rather than BGAN, with TabTransformer additionally maintaining a low, stable false alarm rate (1.51% to 2.92%) that tree-based baselines could not match after augmentation. Random Forest and Decision Tree reached higher Macro-F1 on clean data, but both showed an unfavorable robustness trade-off, underscoring that clean-data accuracy alone does not indicate adversarial resilience. Future work should evaluate PDR against an independent generator or a standard attack method (e.g. FGSM, PGD) rather than each model’s own generator, address extremely small classes such as Infiltration with few-shot or transfer-learning approaches, validate on additional datasets and live network traffic, and directly compare BGAN against SMOTE, ADASYN, and CTGAN under identical experimental conditions. CRediT authorship contribution statement Raihan Sultan Pasha Basuki: Conceptualization, Methodology, Software, Formal analysis, Investigation, Data curation, Writing original draft, Visualization. Aliyah Kurniasih: Supervision, Validation, Writing review and editing. Declaration of competing interest The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper. Acknowledgements The authors sincerely thank the Editor and reviewers for their time and valuable feedback, which significantly improved our paper. Funding This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors. Data availability The CICIDS2017 dataset used in this study is publicly available from the Canadian Institute for Cybersecurity at https://w.unb.ca/cic/datasets/ids-2017.html. Declaration of generative AI use During the preparation of this work, the authors used Claude (Anthropic) to assist with language editing and improving readability. After using this tool, the authors reviewed and edited the content as needed and take full responsibility for the content of the published article. References [1] Ahmad, R., Li, L. H., Sharma, A. K., & Tanone, R. (2023). Boundary-seeking GAN approach to improve classification of intrusion detection systems based on machine learning model. Proceedings of the 2023 17th International Conference on Ubiquitous Information Management and Communication (IMCOM). https://doi.org/10.1109/IMCOM56909.2023.10035580 Alshahrani et al. [2022] Alshahrani, E., Alghazzawi, D., Alotaibi, R., & Rabie, O. (2022). Adversarial attacks against supervised machine learning based network intrusion detection systems. PLoS ONE, 17(10). https://doi.org/10.1371/journal.pone.0275971 [3] Alzaidy, S., & Binsalleeh, H. (2024). Adversarial attacks with defense mechanisms on convolutional neural networks and recurrent neural networks for malware classification. Applied Sciences, 14(4). https://doi.org/10.3390/app14041673 [4] Bagui, S., & Li, K. (2021). Resampling imbalanced data for network intrusion detection datasets. Journal of Big Data, 8(1). https://doi.org/10.1186/s40537-020-00390-x [5] Barradas, D., Santos, N., Rodrigues, L., Signorello, S., Ramos, F. M. V., & Madeira, A. (2021). FlowLens: Enabling efficient flow classification for ML-based network security applications. 28th Annual Network and Distributed System Security Symposium (NDSS 2021). https://doi.org/10.14722/ndss.2021.24067 [6] Busse-Grawitz, C., Meier, R., Dietmüller, A., Bühler, T., & Vanbever, L. (2019). pForest: In-network inference with random forests. arXiv preprint arXiv:1909.05680. https://arxiv.org/abs/1909.05680 Chillara et al. [2025] Chillara, A. K., Saxena, P., & Maiti, R. R. (2025). Transformer-based GAN-augmented defender for adversarial USB keystroke injection attacks. Proceedings of the 26th International Conference on Distributed Computing and Networking (ICDCN 2025), 94–103. https://doi.org/10.1145/3700838.3700871 [8] Djilani, M., Simonetto, T., Tit, K., Tambon, F., Ghamizi, S., Cordy, M., & Papadakis, M. (2026). On the robustness of tabular foundation models: Test-time attacks and in-context defenses. arXiv preprint arXiv:2506.02978 https://arxiv.org/abs/2506.02978 [9] He, Z., Ouyang, C., Wen, L., Liu, C., & Moreira, C. (2026). TabAttackBench: A benchmark for adversarial attacks on tabular data. Expert Systems with Applications, 301, 130491. https://doi.org/10.1016/j.eswa.2025.130491 [10] Hnamte, V., Najar, A. A., Nhung-Nguyen, H., Hussain, J., & Sugali, M. N. (2024). DDoS attack detection and mitigation using deep neural network in SDN environment. Computers & Security, 138. https://doi.org/10.1016/j.cose.2023.103661 [11] Huang, X., Khetan, A., Cvitkovic, M., & Karnin, Z. (2020). TabTransformer: Tabular data modeling using contextual embeddings. arXiv preprint https://arxiv.org/abs/2012.06678 [12] Li, J., Zong, W., Chow, Y. W., & Susilo, W. (2025). Mitigating class imbalance in network intrusion detection with feature-regularized GANs. Future Internet, 17(5). https://doi.org/10.3390/fi17050216 [13] Lin, Z., Shi, Y., & Xue, Z. (2022). IDSGAN: Generative adversarial networks for attack generation against intrusion detection.In Advances in Knowledge Discovery and Data Mining (PAKDD 2022), Lecture Notes in Computer Science, vol. 13280, p. 79–91. Springer. https://doi.org/10.1007/978-3-031-05981-0_7 Salehiyan et al. [2025] Salehiyan, A., Moghaddam, P. S., & Kaveh, M. (2025). An optimized Transformer–GAN–AE for intrusion detection in edge and IIoT systems: Experimental insights from WUSTL-IIoT-2021, EdgeIIoTset, and TON_IoT datasets. Future Internet, 17(7). https://doi.org/10.3390/fi17070279 [15] Sharafaldin, I., Lashkari, A. H., & Ghorbani, A. A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018), 108–116. https://doi.org/10.5220/0006639801080116 Wang et al. [2024] Wang, X., Qiao, Y., Xiong, J., Zhao, Z., Zhang, N., Feng, M., & Jiang, C. (2024). Advanced network intrusion detection with TabTransformer. Journal of Theory and Practice of Engineering Science, 4(03), 191–198. https://doi.org/10.53469/jtpes.2024.04(03).18 [17] Yue, M., Yan, H., Han, R., & Wu, Z. (2025). DAD: Enhancing multi-class DDoS attack classification using data augmentation with DRCGAN. In Proceedings of the 2025 4th International Conference on Big Data, Information and Computer Network (BDICN 2025), p. 669–675. https://doi.org/10.1145/3727353.3727461 [18] Zhang, H., Yue, H., Xiao, X., Yu, L., Li, Q., Ling, Z., & Zhang, Y. (2025). Revolutionizing encrypted traffic classification with MH-Net: A multi-view heterogeneous graph model. Proceedings of the AAAI Conference on Artificial Intelligence, 39(1). DOI: https://doi.org/10.1609/aaai.v39i1.32091