Paper deep dive

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks

Aadith Sukumar, Isha Singh, Devershika Mohane, Ankit Mukherjee, Ankush Dutta, Rahee Walambe, Ketan Kotecha

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 55

Intelligence

Status: not_run | Model: - | Prompt: - | Confidence: 0%

Entities (0)

No extracted entities yet.

Relation Signals (0)

No relation signals yet.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Distributed Denial of Service attacks are a growing threat to network infrastructure, and new techniques, including the use of generative AI, make them harder to detect. Traditional detection systems, such as rule based firewalls, often fail to identify these evolving attack patterns. In this study, we propose a new method for detecting DDoS attacks by combining synthetic data generation using Generative Adversarial Networks with a Random Forest classifier. The GAN generated data showed 80.3 percent cosine similarity to real traffic, which helped the model learn underlying traffic patterns more effectively. To address imbalances in the data, especially in packet related features, we applied adversarial debiasing. This reduced the model's sensitivity to skewed distributions in variables such as forward and backward packet counts and total byte lengths. Our results show that models trained on a mix of synthetic and real data achieved significantly better performance: 99.98 percent accuracy on benchmark data and a 22.60 percent improvement when tested on previously unseen synthetic traffic. This suggests that the method can generalize well across different traffic scenarios and adapt quickly to new types of attacks. The proposed approach not only improves DDoS detection but also provides a scalable foundation for security models that account for bias and benefit from data augmentation. Our findings show that combining GANs with adversarial debiasing can lead to more robust and effective DDoS mitigation, supporting the further development of machine learning based cyber security.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

51,941 characters extracted from source content.

Expand or collapse full text

Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks Aadith Sukumar 1 , Isha Singh 1 , Devershika Mohane 1 , Ankit Mukherjee 1 , Ankush Dutta 1 , Rahee Walambe* 1,2 , and Ketan Kotecha 1,2,3 1 Symbiosis Institute of Technology Pune, India 2 Symbiosis Center for Applied Artificial Intelligence, Pune, India 3 Peoples’ Friendship University of Russia Moscow, Russian Federation Abstract. Distributed Denial of Service (DDoS) attacks are a growing threat to network infrastructure, and new techniques, including the use of generative AI, make them harder to detect. Traditional detection sys- tems, such as rule-based firewalls, often fail to identify these evolving attack patterns. In this study, we propose a new method for detecting DDoS attacks by combining synthetic data generation using Genera- tive Adversarial Networks (GANs) with a Random Forest classifier. The GAN-generated data showed 80.3% cosine similarity to real traffic, which helped the model learn underlying traffic patterns more effectively. To address imbalances in the data, especially in packet-related features, we applied adversarial debiasing. This reduced the model’s sensitivity to skewed distributions in variables such as forward and backward packet counts and total byte lengths. Our results show that models trained on a mix of synthetic and real data achieved significantly better per- formance: 99.98% accuracy on benchmark data and a 22.60% improve- ment when tested on previously unseen synthetic traffic. This suggests that the method can generalize well across different traffic scenarios and adapt quickly to new types of attacks. The proposed approach not only improves DDoS detection but also provides a scalable foundation for se- curity models that account for bias and benefit from data augmentation. Our findings show that combining GANs with adversarial debiasing can lead to more robust and effective DDoS mitigation, supporting the fur- ther development of machine learning–based cyber security. Keywords: DDoS Detection· Generative Adversarial Networks (GANs) · Synthetic Data Augmentation· Adversarial Debiasing· Ensemble Ma- chine Learning· Network Traffic Classification. 1 Introduction In the current digital era, Distributed Denial of Service (DDoS) attacks have emerged as one of the most formidable threats to network security. DDoS at- tacks target to interfere with the availability of network services by flooding arXiv:2609.36167v1 [cs.CR] 28 Sep 2026 2A. Sukumar et al. systems with malicious traffic. These attacks are typically launched from a large network of compromised devices, known as a botnet, which simultaneously sends massive requests to the target. DDoS can also be used as a justification for many malicious activities, such as turning off security measures and breaking through the target’s boundary [1]. This results in restricting access to its resources until the service is severely compromised. DDoS attacks are broadly classified into three main types: volumetric at- tacks, protocol attacks, and application layer attacks. These attacks include the User Datagram Protocol flooding, where a large volume of data is sent into a network to fill up the available bandwidth, hence denying other traffic. Vulnera- bilities in network protocols are exploited in protocol attacks e.g., SYN Flooding. The application layer attacks, such as HTTP flooding, are more sophisticated. They mimic legitimate traffic at the application level [2]. These attacks differ from legitimate attacks, making it hard to detect. Each of these attacks targets different aspects of the network, requiring unique detection methods. The study and solutions for these attacks are of interest to the research community for last few years. A number of studies and methods have been proposed for various environments. Classification techniques, especially those belonging to the category of machine learning algorithms, are widely used for the detection of DDoS attacks since they sort network traffic according to previously defined classes. Random Forest is one of the effective and robust ensemble-learning meth- ods for distinguishing between legitimate and malicious traffic [2]. Various ap- proaches [[2-4]] employing multiple AI models for attack detection are reported in the literature. In [3], a hybrid, incremental-learning framework for DDoS de- tection using supervised classifiers is discussed. The proposed system splits pro- cessing between client and proxy and applies multiple learners (e.g. Naïve Bayes, decision trees, MLP, k-N) to detect attacks, with Random Forest emerging as the strongest performer. This confirms that ensemble methods like RF are effec- tive in DDoS classification. However, this hybrid approach focuses on accuracy and processing speed in streaming data rather than on data imbalance or bias. The paper does not employ any generative data augmentation or adversarial training; it relies solely on the original (often imbalanced) samples. The data imbalance problem is explicitly tackled in [5] for IoT-driven DDoS detection. They identify two extreme scenarios – low-rate versus high-rate DDoS attacks – and show that classifiers suffer when cross-evaluated across such varied datasets. To counter this, they experiment with preprocessing techniques and conclude that oversampling should be used for low-rate (rare) attacks and undersam- pling for high-rate attacks, even suggesting optimized SMOTE oversamplers per model. In essence, they recognize that two distinct scenarios of data imbalance exist and that addressing both is crucial. Agrawal et al. [2] conduct a broad benchmarking of ML classifiers for DDoS detection. Using four diverse public datasets (e.g. CICDDoS19, backscatter TCP/ICMP, SDN logs) they compare algorithms like CatBoost, logistic regression, gradient boosting and Naïve Bayes on accuracy, precision, recall and F1 score. However, this work does not ad- Adversarial Debiasing for Enhanced Network Security3 dress data bias or imbalance. An adversarial deep-learning system for DDoS detection is proposed in [6,7)]. Novaes et al [6], employ a Generative Adversarial Network (GAN) framework to not only detect DDoS flows but also to simu- late adversarial DDoS traffic for training. Through adversarial training, their model becomes “less sensitive to adversarial attacks” on the network, improving robustness against evasion. In recent times, generative AI techniques have also been proposed [8, 9]. Genetic algorithms and a fuzzy logic-based approach are reported in [10]. For cloud-based environments, various methods and techniques for intrusion and attack detection are proposed in literature [11-15]. For the SDN environment, multiple ML and Deep learning based methods are reported [16-22]. The data bias issue for deploying machine learning models for such tasks are reported in [23], where a data mislabelling problem in real-network traffic datasets is identified. The model for ensuring fairness and transparency in intru- sion detection systems is reported in [24]. Although a limited number of papers [23,24], discuss the data-specific issues, in the majority of work reported in the literature does not address the problem of data imbalance. More importantly, the use of Generative AI for generating synthetic data is not explored extensively. To that end, in this work, the machine learning is employed for experimen- tation with real data and synthetic data (created using GANs). GANs consist of two neural networks, a generator and a discriminator, that work against each other and, in the process, generate synthetic data that closely resembles real data [25]. However, there is significant difference the data distributions in both real and synthetic data. This can be considered as bias. In this work, we pro- pose the adversarial debiasing techniques to mitigate and minimize bias in the training process, improving the model’s accuracy and adaptability to changing attack patterns. Experiments comparing models trained on real, synthetic, and combined datasets emphasize the important role of debiasing in improving DDoS detection. In summary, this study makes the following key contributions: 1. A novel, bias-aware detection framework that integrates adversarial debias- ing with synthetic data generation using Generative Adversarial Networks (GANs) to significantly improve DDoS detection is introduced. By identi- fying and neutralizing the influence of sensitive attributes - such as packet direction and size - our approach reduces systemic bias in model predictions. This ensures improved fairness, enhances model generalization, and equips the detection system to adapt to evolving attack strategies in dynamic net- work environments. 2. The value of GAN-generated synthetic data in overcoming inherent chal- lenges of real-world datasets, including class imbalance, data sparsity, and the limited representation of rare attack scenarios is clearly demonstrated. The fusion of real and synthetic data in model training substantially boosts robustness and accuracy, while also improving performance on unseen traf- fic patterns. This work establishes a scalable, adaptable baseline for future research into intelligent, fair, and resilient cybersecurity systems. 4A. Sukumar et al. 3. This study pioneers the integration of an end-to-end adversarial debiasing pipeline in DDoS detection, combining data-level and model-level interven- tions to systematically minimize bias from both synthetic and real network traffic sources - a methodological enhancement rarely explored in existing literature. 4. A phase-based evaluation design that allows for a detailed analysis of model behavior across training, retraining, and inference stages is adopted. This structure reveals critical insights into how synthetic data and debiasing in- fluence generalization, offering practical guidance for deploying adaptive se- curity solutions in real-world settings. The structure of this paper is as follows: Section 1 provides a brief intro- duction to the problem statement and relevant information about the related domains. Section 2 presents the literature review of existing work and challenges in DDoS attack detection, machine learning models, and synthetic data genera- tion. Section 3 explains the system design, including the integration of real and synthetic data, the use of adversarial debiasing, and the Random Forest model. Section 4 describes the methodology, outlines the formation of the dataset, the process of synthetic data generation using GANs, the implementation of adver- sarial debiasing, and the approach followed in the model’s training and testing phases. The results and analysis are presented in Section 5, comparing the per- formance of models trained on real, synthetic, and the mix of the datasets, as well as discussing the effects of different steps of adversarial debiasing on de- tection accuracy, false positive rates, and adaptability. Section 6 concludes the manuscript with a summary of the findings, limitations, and challenges and of- fers future research directions. This is followed by the list of statements and declarations, and the list of references. 2 Literature Review This section presents the related work reported in the literature. Sambangi et al [26] considered the problem of identifying DDoS attacks as a classification problem in machine learning (ML). Detecting DDoS attacks presents significant challenges, especially in cloud computing environments, due to the computa- tional complexity involved. A notable challenge in evaluating detection and dis- tinguishing them from Flash Events (FEs) stems from the limited availability of real-world traffic traces suitable for comprehensive assessment. The CICIDS 2017, a popular benchmark dataset, is commonly employed to study and address the challenges of DDoS attack detection in cloud environments [27]. Götte et al. [28] have reported the importance of addressing bias in ML models for ensur- ing fairness and generalizability [29]. Adversarial debiasing offers a promising approach to mitigate bias by incorporating an adversary that seeks to predict sensitive attributes from the model’s output. By training the model to minimize the adversary’s performance, the aim is to remove or reduce correlations between the model’s predictions and protected attributes. While this can be effective, its Adversarial Debiasing for Enhanced Network Security5 impact on performance depends on the characteristics of the data, like measure- ment accuracy and the representation of relevant subgroups. Hence, carefully evaluating the suitability of the training data and the potential trade-offs be- tween fairness and accuracy is essential when applying adversarial debiasing Elsayed, et al. [29] have reported the effectiveness of ensemble learning im- proves the performance and robustness of ML models, particularly neural net- works, which are known for their high variance [29]. By combining predictions from multiple models, ensemble methods reduce the prediction variance and en- hance the generalization capability, mitigating the risk of overfitting. Methods like bagging, boosting, and model averaging present us with different mechanisms for creating diverse ensembles that contribute to improved predictive accuracy. The choice of ensemble technique depends on certain specific characteristics of the problem and the desired trade-offs between computational cost and perfor- mance enhancement. Kumar and Sinha [30] discussed how the development of systems utilizing ML and data mining techniques offers an approach to addressing the issue of network intrusion detection [30]. However, numerous Intrusion Detection Systems (IDS) grapple with a high frequency of false alarms and fail to identify intrusions. Brownlee [31] wrote about how deep learning, particularly Recurrent Neural Networks (RNNs), holds promise in enhancing the accuracy and effectiveness of anomaly detection systems. RNNs hold the ability to process sequential data, and therefore are well-suited for analyzing network traffic patterns and identi- fying anomalies that may indicate DDoS attacks [31]. The scarcity of publicly available datasets has led researchers to simulate their data for experimentation, but such datasets miss out on encompassing the intricacies of real-world net- work behavior. Despite these challenges, the use of DL and RNNs in the form of RNN-autoencoders demonstrates the potential for improving attack detection in SDN or IoT environments by learning features from network traffic data and achieving higher accuracy compared to traditional ML methods [32,33]. In [3] a hybrid, incremental-learning framework for DDoS detection using su- pervised classifiers is discussed. The proposed system splits processing between client and proxy and applies multiple learners (e.g. Naïve Bayes, decision trees, MLP, k-N) to detect attacks, with Random Forest emerging as the strongest performer. This confirms that ensemble methods like RF are effective in DDoS classification. However, this hybrid approach focuses on accuracy and processing speed in streaming data rather than on data imbalance or bias. The paper does not employ any generative data augmentation or adversarial training; it relies solely on the original (often imbalanced) samples. In contrast, our work explic- itly generates synthetic benign/attack samples with GANs to balance the data and applies adversarial debiasing to mitigate feature biases – aspects not ad- dressed by Hosseini and Azizia’s traditional hybrid model. Qing et al. (2024)[5] explicitly tackle the data imbalance problem in IoT-driven DDoS detection. They identify two extreme scenarios – low-rate versus high-rate DDoS attacks – and show that classifiers suffer when cross-evaluated across such varied datasets. To counter this, they experiment with preprocessing techniques and conclude that 6A. Sukumar et al. oversampling should be used for low-rate (rare) attacks and undersampling for high-rate attacks, even suggesting optimized SMOTE oversamplers per model. In essence, they recognize that “two distinct scenarios of data imbalance” exist and that addressing both is crucial. This finding supports our premise that im- balanced attack flows must be mitigated for generalization. However, Qing et al. use conventional resampling (SMOTE variants) rather than generative models, and they do not consider adversarial methods or fairness. In this proposed work, GAN-based synthetic data strategy is employed. This offers a more flexible way to bolster rare classes without discarding real data, and the adversarial debi- asing approach proposed here specifically targets bias in packet features. These innovations go beyond the traditional oversampling solutions of Qing et al. and aim to improve both performance and model fairness. In [2], a broad benchmark- ing of ML classifiers for DDoS detection is conducted. Using four diverse public datasets (e.g. CICDDoS19, backscatter TCP/ICMP, SDN logs) they compare algorithms like CatBoost, logistic regression, gradient boosting and Naïve Bayes on accuracy, precision, recall and F1 score. Their comparative study identifies which classifiers perform best overall, providing a useful overview of detection accuracy across data sources, however, they do not address data bias or imbal- ance at all. They focus on raw performance metrics and do not include Random Forests in their comparison (despite ensemble methods being strong in liter- ature). Importantly, no synthetic data augmentation or adversarial robustness techniques are used. Our work complements this by not just evaluating a model’s accuracy, but actively improving generalization through GAN-augmented data and reducing bias via adversarial training. Thus, whereas Agrawal et al. report on which off-the-shelf algorithms do well, we introduce methodological novel- ties to overcome challenges (imbalance and bias) that their evaluation assumes. Novaes et al. (2021)[6] propose an adversarial deep-learning system for DDoS detection in software-defined networks. They employ a Generative Adversarial Network (GAN) framework to not only detect DDoS flows but also to simulate adversarial DDoS traffic for training. Through adversarial training, their model becomes “less sensitive to adversarial attacks” on the network, improving ro- bustness against evasion. This work is closely related to our use of GANs, as it shows that generative models can enhance NIDS performance. The difference is in the goal: Novaes et al. use adversarial examples to harden a deep model, whereas we use adversarial networks to debias a Random Forest. Furthermore, Novaes et al. do not address class imbalance explicitly and focus on robustness to malicious perturbations rather than fairness. Our method, by contrast, in- tegrates GAN-generated benign/attack samples to rebalance training data, and uses adversarial debiasing to remove unwanted correlations in features, which is an aspect absent in the SDN-focused, adversarial-robust design of Novaes et al. In [7] a conceptual survey reframing adversarial ML as a tool for “social good” is presented. They introduce the notion of AdvML4G (Adversarial ML for Social Good), where the “adversary” acts as an ally to produce fairer, safer systems. Their taxonomy explicitly highlights fairness, transparency and trustworthiness as desirable outcomes of repurposed adversarial attacks. This perspective pro- Adversarial Debiasing for Enhanced Network Security7 vides valuable motivation for our adversarial debiasing approach: it aligns with the idea that adversarial training can be used to mitigate biases rather than just to attack models. However, Al-Maliki et al. remain high-level and do not tackle any specific domain; they offer no concrete algorithms for DDoS detection or handling imbalanced security data. In other words, while they champion the philosophy of using adversarial methods to improve fairness, our work imple- ments this philosophy in the concrete setting of network security. We translate their broad vision into practical debiasing of a DDoS classifier, whereas their paper primarily justifies why such an approach would be worthwhile. Huang et al. (2024)[8] provide a broad framework on security considerations for generative AI. Their compendium covers threats to generative models (inversion, adversar- ial, backdoors) and also includes sections on “Model Debiasing and Fairness”. This underscores that even in generative AI, ensuring fairness is a recognized concern. While this work is not about DDoS, it situates our research within the larger context that generative models and adversarial techniques are increas- ingly studied for security tasks. The book’s coverage of debiasing indicates that mitigating algorithmic bias is timely, but it lacks concrete methods for DDoS or network traffic data. In particular, Huang et al. do not discuss using GANs to synthesize traffic or employing adversarial networks to remove packet-feature bias. Thus, our research can be seen as a domain-specific realization of themes raised by Huang et al.: we apply the book’s general insights about generative models and fairness to the practical problem of DDoS detection, filling the gap between theory and applied cyber security practice. [4] explore DDoS detection with a simple feedforward deep neural network trained on packet-level data. They show that such a DNN can learn to classify flows as benign or attack, achieving high accuracy on their chosen dataset. This confirms that even stan- dard deep models can be effective for DDoS recognition. However, their setup uses relatively “small samples” of data and does not attempt any data augmenta- tion or balancing; the issue of class imbalance is not addressed. They also do not consider adversarial robustness or fairness at all. Compared to this work, [4] rep- resent a baseline deep-learning approach: it lacks the synthetic-data generation and adversarial debiasing that we use to improve generalization. In summary, Cil et al.[4] demonstrate the feasibility of machine learning for DDoS detection, but they do not incorporate any of the bias- or imbalance-mitigation strategies that are novel in our method. Table 1 shows the summary of the literature review with a specific focus on the approach, the datasets used, and the results obtained. 8A. Sukumar et al. Table 1. Literature Review Summary ApproachDatasetPerformanceKey Findings and Limitations Feed-forward deep neural network [4] CICDDoS-2019Accuracy improve- ment (+) Higher accuracy (-) Small imbalanced dataset Multiple Linear Re- gression [26] CIC-IDS 201773.79%(+) Feature selection via info gain (-) Single day analy- sis MLP + Debiasing [27] Simulated data0.005 mean improve- ment (+) Tested multiple scenarios (-) Convergence is- sues RNN + AutoEn- coder [28] CICDDoS-201999%(+) High accuracy (-) Single dataset evaluation WCGAN + XG- Boost [29] NSL-KDD, UNSW- NB15, BoT-IoT Outperformed DGM baseline (+) Tackles data im- balance (-) Risk of GAN overfitting GP-WGAN [30]NSL-KDD,CI- CIDS2017 MSE: 0.10, AUC: 75% (+) Generates syn- thetic attacks (-) Limited sample size (2000) Adversarial Debias- ing [33] Not availableNot available(+) Improves model reliability (-) Limited to static analysis Various ML ap- proaches (ANN, RF, etc.) [35] CIC-IDS 2017ANN had the best performance (+) Comprehensive method comparison (-) Limited dataset scope EMCSVMCustom (14 attributes) Outperformed the standard SVM (+) Real-time detec- tion (-) High computa- tion needs 3 System Design The proposed framework is divided into 4 phases, as illustrated in Fig. 1 and Fig. 2 Phase 1: Training the Initial Classification Model The process began by training the baseline classification model using the original real-world dataset. This data set contained distributed denial of Service (DDoS) and benign network packets and served as a reference for subsequent stages. Adversarial Debiasing for Enhanced Network Security9 Phase 2: Generating Synthetic Data with GANs A GAN model was trained and used to generate synthetic data samples. The GAN was trained on the real dataset to produce synthetic packets, which were divided into three sub- sets. Subsequently, 75,000 DDoS and 75,000 BENIGN packets were generated, merged, and saved into a single CSV file, which had a total of 150,000 synthetic samples. Phase 3: Retraining the Classification Model with Combined Datasets The original classification model was retrained on a combination of the synthetic dataset, which had 150,000 samples, and an equal number of samples from the original dataset. This created a balanced dataset with a ratio of 1:1 of DDoS to BENIGN packets, resulting in a total of 300,000 samples for model training. The goal of this step was to integrate synthetic data to minimize bias and enhance the model’s ability to generalize effectively. Phase 4: Inference and Evaluation of the Debiased Model A separate holdout dataset, consisting of 2,000 samples generated in Phase 2, was used to assess the performance of the retrained model. The model achieved an accu- racy of 72.60%, indicating that incorporating synthetic data and debiasing has improved its predictive effectiveness. In this study, each phase of data prepro- cessing, GAN-based synthetic data generation, model training, and inference was developed as an independent module to ensure flexibility. Distributed computing frameworks such as TensorFlow were used to train the model on a dataset of 300,000 samples, which efficiently optimized the process. 4 Methodology This section outlines the methodology followed in data preprocessing, model training, and evaluation to rigorously assess the effectiveness of our proposed framework. It describes how real-world and GAN-generated synthetic data were integrated to improve detection capabilities and how adversarial debiasing was implemented to reduce systemic bias. The methodology is structured into sev- eral key phases, beginning with data analysis and culminating in performance evaluation, providing a comprehensive approach to building a resilient DDoS detection model. 4.1 Data Analysis This study integrates real and synthetic data to improve the accuracy and ro- bustness of a DDoS detection model. The real dataset used is the CIC-IDS2017 dataset [27]. This dataset includes labeled instances of both normal traffic and DDoS attacks. The dataset used for training the GAN had 85 features and 225,745 rows. Important features were selected by analyzing the network-related columns to prepare the data. Since DDoS attacks affect network traffic, features 10A. Sukumar et al. Fig. 1. Project system design for Phase 1 and 2 Fig. 2. Project system design for Phase 3 and 4 like high forward (FWD) and backward (BWD) packet counts were identified as key indicators of unusual network behavior. After calculating the FWD and BWD packet counts on a cumulative sum graph against the flow of the packets, as seen in Fig. 3. Adversarial Debiasing for Enhanced Network Security11 It has been observed that the spikes in the graphs of the blue line indicate the sudden increment in the number of packet counts. Ideally, over a TCP hand- shake, the FWD packets should be almost equal to the BWD packet counts. The columns that had an effect on the network were as follows: Flow Duration, Total Fwd Packets, Total Backward Packets, Total Length of Fwd Packets, Total Length of Bwd Packets, Fwd Packet Length Max, Fwd Packet Length Min, Fwd Packet Length Std, Bwd Packet Length Min, Flow Bytes/s, Flow Packets/s, Flow IAT Mean, Flow IAT Std, Flow IAT Max, Flow IAT Min, Fwd IAT Total, Fwd IAT Max, Fwd IAT Min, Bwd IAT Total, Bwd IAT Max, Bwd IAT Min, Min Packet Length, Max Packet Length, Packet Length Mean, Packet Length Std, Packet Length Variance, FIN Flag Count, SYN Flag Count, RST Flag Count, PSH Flag Count, ACK Flag Count, URG Flag Count, CWE Flag Count, ECE Flag Count, Down/Up Ratio, Average Packet Size, Avg Fwd Segment Size, Avg Bwd Segment Size, Fwd Header Length.1, Subflow Fwd Bytes, Subflow Bwd Bytes, Active Mean, Active Std, Active Max, Active Min, Idle Mean, Idle Std, Idle Max, Idle Min, Label. The above parameters (features) were used to train the classification model and the GAN. The cleaned dataset had 225745 rows and 50 columns, ready for model training. 4.2 Classification A key aspect of this study involves accurately predicting whether network pack- ets are instances of a DDoS attack or BENIGN packets. ML models were em- ployed to accomplish this. StandardScaler was used to preprocess the data before inputting it into a machine-learning model that ensures that all features are on an equal scale, preventing any single feature from overshadowing the learning process because of its larger magnitude. Here, the performance of five distinct machine-learning algorithms, namely Logistic Regression, Decision Tree, Support Vector Machine (SVM), Random Forest, and K-Nearest Neighbors (KNN), which are predictive models engineered to handle network traffic classification, were evaluated using real baseline data. This analysis aims to provide insights into the relative efficacy of these algorithms in the context of the specified dataset. After testing all of the above models, the Random Forest Classifier achieved the highest accuracy of 99.967% in classifying DDoS and BENIGN network pack- ets. This is because it constructs an ensemble of multiple Decision Trees during the training phase and uses voting for cooperative decision-making, leading to precise outcomes [37]. 4.3 Generative Adversarial Network To generate synthetic packets that resemble the DDoS or BENIGN packets that the original dataset had, generative adversarial networks (GANs) were used. They are composed of a generator and a discriminator. The goal is to estimate 12A. Sukumar et al. the potential distribution of real data samples and generate new samples from that distribution [38]. The generator model is trained on the cleaned data’s dimensions and consists of Dense layers with Leaky ReLU activations to prevent dead neurons [39]. Batch Normalization stabilizes training by normalizing activations. The model starts with 128 neurons, increasing to 512 to capture complex patterns, and ends with a tanh activation to map outputs to [-1, 1], aligning with real data scaling. This design enables the generator to produce realistic synthetic samples [40]. The discriminator model uses the same input dimensions and processes data through Dense layers that reduce feature representation. It starts with 512 neu- rons for complex pattern detection, followed by 256 neurons for refinement. Leaky ReLU is applied after each layer for maintaining gradients and addressing inactive neurons. This architecture ensures the discriminator effectively distin- guishes real from generated data, pushing the generator to improve over time. The discriminator is compiled with a binary cross-entropy loss and Adam optimizer, stabilizing training with low learning rates and momentum settings [41]. During each epoch, the generator creates synthetic data using random noise as input, and the discriminator is trained on both real and synthetic data, re- inforcing its ability to identify genuine samples. Simultaneously, the generator learns from the feedback to improve its outputs to fool the discriminator. Train- ing losses and accuracy are tracked, and checkpoints are used to save the models at intervals. After training, the generator produces synthetic DDoS data, which is combined with BENIGN data and converted into a final dataset that is saved for analysis. 4.4 Inferencing The Random Forest model, trained on real-world network traffic data, served as a baseline to evaluate the ability of a model trained on authentic data to classify synthetic samples (DDoS or BENIGN) generated by the GAN. This inference aimed to assess the quality of GAN-generated data and detect potential biases in the model towards real data. In contrast to poor performance which suggests shortcomings in the GANs capacity to replicate the complexity and diversity of real data, high performance on synthetic data shows that the GAN successfully captured the underlying patterns of real-world traffic. The model’s accuracy on synthetic data was only 50% which was much worse than its performance on real data. This brought to light the difficulties in producing high-quality synthetic data that accurately captures the complexities of actual network traffic. The model performed poorly on synthetic data for several reasons. Even though the GAN was created to produce realistic-looking synthetic network packets the predictive accuracy of the model may be impacted by minute varia- tions in the data distribution between the real and synthetic datasets. Further- more, synthetic data is frequently less noisy and cleaner than real-world data. Because it might not be strong enough to cope with the lack of noise in the Adversarial Debiasing for Enhanced Network Security13 synthetic dataset a model trained on real data might have trouble with this discrepancy. The model’s intrinsic bias towards the real-world data it was trained on however is the main cause of this subpar performance. This bias results from the unique properties of real data which the GAN might not be able to fully replicate. As a result, the model’s capacity to generalize to unknown synthetic data is restricted and its accuracy is consequently low. De-biasing the model was necessary to overcome these obstacles and make it function well on both synthetic and real network traffic. To develop a more robust and dependable model for identifying DDoS attacks across various data sources debiasing techniques were used. Fig. 3. Cumulative forward and backward packet count 4.5 Debiasing Biases resulting from imbalances or insufficiencies in the training data can affect machine learning models causing skewed predictions and affecting the model’s generalizability [42]. Inaccurate attack patterns and unequal volumes of mali- cious and legitimate traffic are examples of biases in DDoS attack detection that can make it difficult to detect attacks. During the GAN synthetic data gen- eration process adversarial debiasing was used to address these problems. By lowering bias in the synthetic dataset this method gave attacks a more balanced portrayal. The Random Forest model was then enhanced and improved by in- tegrating the debiased synthetic data produced by the GAN into the training procedure. This method reduced biases and enabled the model to detect new 14A. Sukumar et al. attack patterns, making the proposed DDoS detection model more robust and less sensitive to biases. 5 Result and Analysis An ensemble of five models was trained and tested with the results observed in Table 2. The Random Forest classifier outperformed all the others in classifying be- tween BENIGN and DDoS network packets, achieving an accuracy of 99.967%. The confusion matrix (Fig. 3) visualizes the robustness of the model. In the sub- sequent phase of the study, the generated synthetic network data had a cosine similarity score of 0.8031, which is similar to real network traffic data. How- ever, when the synthetic data was inference with the classification model, a poor accuracy of 50.00% proved that inherent bias exists. The model was then retrained on an augmented dataset combining both real and synthetic data, resulting in an increased testing accuracy of 99.987%. The confusion matrix for the retrained Random Forest model (Fig. 5) shows a decrease in false negatives and false positives compared to the initial baseline model (Fig. 4), highlighting enhanced robustness by the model in the results. The retrained model, with its inference done using synthetic packets, achieved an increased accuracy of 72.60%, surpassing the previous metric where the model was only trained on real data. This highlights the effectiveness of debiasing in improving a model’s ability to handle unseen data. Fig. 6 demonstrates graphically throughout the phases how the models have improved in their accuracy. Phase 1 and Phase 2 highlights the baseline model where the model had an accuracy of 99.967% when tested on real baseline data, while it performed poorly to just 50% accuracy when inferenced with synthetic unseen data. Conversely, when retraining the model with a mix of real and synthetic data, the testing accuracy improved to 99.987% in Phase 3 and inferencing it with unseen synthetic data in Phase 4 indicated an observable increase to 72.6% in accuracy. Table 2. A table representing the testing accuracy achieved by different ML models in classifying between DDoS and benign network packets No.Machine Learning ModelTesting Accuracy (%) 1.Logistic Regression99.84 2.Decision Tree99.96 3.Support Vector Machine99.84 4.Random Forest99.96 5.K-Nearest Neighbors99.93 Adversarial Debiasing for Enhanced Network Security15 6 Conclusion and Future Work The proposed framework combining synthetic data generation using GANs with adversarial debiasing and ensemble learning has shown significant promise in enhancing the detection of DDoS attacks. By examining the performance across various phases of model training and evaluation, this study provides insights into the role of fairness-aware learning and data augmentation in cyber security. The subsections that follow outline the major contributions of this study, acknowledge its current limitations, and propose actionable directions for future research and development. 6.1 Main Contributions and Novelty of Study 1. This study introduces a novel framework that combines GAN-generated syn- thetic data with adversarial debiasing techniques to improve the detection of DDoS attacks. 2. It demonstrates that retraining a Random Forest classifier with a mixture of synthetic and real-world data significantly enhances detection accuracy and robustness. 3. The approach effectively mitigates model bias by focusing on sensitive at- tributes such as packet counts and byte lengths, leading to fairer and more generalized predictions. 4. The proposed system achieved near-perfect accuracy on benchmark data and a notable performance gain (+22.60%) on unseen synthetic datasets. 5. This research validates the use of GANs for realistic traffic data simulation and emphasizes adversarial debiasing as a powerful tool for cyber security applications. 6.2 Limitation of Study 1. The model was primarily tested on a controlled synthetic dataset, which may not fully represent real-time network complexity. 2. The GAN-generated data, while similar, still exhibited distributional gaps compared to real-world traffic, affecting baseline performance before retrain- ing. 3. The study focused only on Random Forest and did not compare performance against advanced deep learning models such as CNNs or RNNs. 4. Adversarial debiasing was applied to a limited set of features, potentially overlooking biases in other parts of the data. 5. Real-time deployment and evaluation were not conducted, limiting insight into how the model would perform under live network conditions. 16A. Sukumar et al. Fig. 4. Confusion matrix for the baseline Random Forest model 6.3 Recommendations for Future Research 1. Future work should include experimentation with advanced deep learning architectures like RNNs and CNNs to capture spatial and temporal dynamics in traffic data. 2. Expanding adversarial debiasing to a broader set of features may further improve model fairness and robustness. 3. Evaluation should be extended to real-time environments with live data streams to test adaptability under real-world attack conditions. 4. Applying the framework to other types of cyber threats, such as ransomware or phishing, can assess its generalizability across the cybersecurity spectrum. 5. Incorporating federated learning or edge-computing capabilities could help build scalable and privacy-preserving DDoS detection systems. 7 Acknowledgment This article does not contain any studies with human participants or animals per- formed by any of the authors. This manuscript is the authors’ original work, and the content of this paper has not been copied from elsewhere. All authors have checked the manuscript and have agreed to this submission. Availability of data Adversarial Debiasing for Enhanced Network Security17 Fig. 5. Confusion matrix for the baseline Random Forest model and materials: This study uses CICDDoS-2017 dataset which is publicly avail- able and can be accessed at https://w.unb.ca/cic/datasets/ids-2017.html. The second dataset used is the synthetic dataset developed as part of this work that will be available upon request. During the preparation of this work the author(s) used ChatGPT in order to improve grammar and sentence structure. After using this tool/service, the author(s) reviewed and edited the content as needed and take(s) full responsibility for the content of the published article. References 1. K. Kumari & M. Mrunalini. (2022). Detecting Denial of Service at- tacks using machine learning algorithms. Journal of Big Data, 9, 56. https://doi.org/10.1186/s40537-022-00616-0 2. S. Agrawal, A. Ingle, S.S. Vanarase, S. Chippalkatti, N.M. Shinde & A.V. Desh- pande. (2025). Performance evaluation of machine learning algorithms for DDoS attack detection: A comparative study. In: Rajagopal, S., Popat, K., Meva, D., Bajeja, S., Mudholkar, P. (eds) Artificial Intelligence Based Smart and Secured Ap- plications. ASCIS 2024. Communications in Computer and Information Science, vol 2426. Springer, Cham. https://doi.org/10.1007/978-3-031-86296-0_1 18A. Sukumar et al. 3. Hosseini, S., & Azizi, M. (2019). The hybrid technique for DDoS detec- tion with supervised learning algorithms. Computer Networks, 158, 35-45. https://doi.org/10.1016/j.comnet.2019.04.027 4. Cil, A. E., Yildiz, K., & Buldu, A. (2021). Detection of DDoS attacks with feed forward based deep neural network model. Expert Systems with Applications, 169, 114520. https://doi.org/10.1016/j.eswa.2020.114520 5. Qing, Y., Liu, X., & Du, Y. (2024). Mitigating data imbalance to improve the generalizability in IoT DDoS detection tasks. The Journal of Supercomputing, 80(7), 9935-9960. https://doi.org/10.1007/s11227-023-05829-5 6. Novaes, M. P., Carvalho, L. F., Lloret, J., & Proença Jr, M. L. (2021). Adversarial Deep Learning approach detection and defense against DDoS at- tacks in SDN environments. Future Generation Computer Systems, 125, 156-167 https://doi.org/10.1016/j.future.2021.06.047 7. Al-Maliki, S., Qayyum, A., Ali, H., Abdallah, M., Qadir, J., Hoang, D. T., ... & Al-Fuqaha, A. (2024). Adversarial machine learning for social good: Refram- ing the adversary as an ally. IEEE Transactions on Artificial Intelligence. DOI 10.1109/TAI.2024.3383407 8. Huang, K., Wang, Y., Goertzel, B., Li, Y., Wright, S., & Ponnapalli, J. (Eds.). (2024). Generative AI Security: Theories and Practices (p. 61-98). Springer. https://doi.org/10.1007/978-3-031-54252-7 9. Dong, H., & Kotenko, I. V. (2024). Convolutional Variational Autoencoders and Resampling Techniques with Generative Adversarial Network for Enhancing Inter- net of Thing Security. Pattern Recognition and Image Analysis, 34(3), 562-569. https://doi.org/10.1134/S1054661824700366 10. Hamamoto, A. H., Carvalho, L. F., Sampaio, L. D. H., Abrão, T., & Proença Jr, M. L. (2018). Network anomaly detection system using genetic algorithm and fuzzy logic. Expert Systems with Applications, 92, 390-402. https://doi.org/10.1016/j.eswa.2017.09.013 11. Shang, Y. (2024). Prevention and detection of DDOS attack in virtual cloud com- puting environment using Naive Bayes algorithm of machine learning. Measurement: Sensors, 31, 100991.https://doi.org/10.1016/j.measen.2023.100991 12. Landman, T., & Nissim, N. (2021). Deep-Hook: A trusted deep learning-based framework for unknown malware detection and classi- fication in Linux cloud environments. Neural Networks, 144, 648-685. https://doi.org/10.1016/j.neunet.2021.09.019 13. Kushwah, G. S., & Ranga, V. (2020). Voting extreme learning ma- chine based distributed denial of service attack detection in cloud com- puting. Journal of Information Security and Applications, 53, 102532. https://doi.org/10.1016/j.jisa.2020.102532 14. Rabbani, M., Wang, Y. L., Khoshkangini, R., Jelodar, H., Zhao, R., & Hu, P. (2020). A hybrid machine learning approach for malicious behaviour detection and recognition in cloud computing. Journal of Network and Computer Applications, 151, 102507. https://doi.org/10.1016/j.jnca.2019.102507 15. Kumar, S., Dwivedi, M., Kumar, M., & Gill, S. S. (2024). A com- prehensive review of vulnerabilities and AI-enabled defense against DDoS attacks for securing cloud services. Computer Science Review, 53, 100661.https://doi.org/10.1016/j.cosrev.2024.100661 16. Hnamte, V., Najar, A. A., Nhung-Nguyen, H., Hussain, J., & Sugali, M. N. (2024). DDoS attack detection and mitigation using deep neu- ral network in SDN environment. Computers & Security, 138, 103661. https://doi.org/10.1016/j.cose.2023.103661 Adversarial Debiasing for Enhanced Network Security19 17. Maheshwari, A., Mehraj, B., Khan, M. S., & Idrisi, M. S. (2022). An opti- mized weighted voting based ensemble model for DDoS attack detection and mitigation in SDN environment. Microprocessors and Microsystems, 89, 104412. https://doi.org/10.1016/j.micpro.2021.104412 18. Aslam, N., Srivastava, S., & Gore, M. M. (2024). Ddos sourcetracer: An intelligent application for ddos attack mitigation in sdn. Computers and Electrical Engineering, 117, 109282. https://doi.org/10.1016/j.compeleceng.2024.109282 19. Gadallah, W. G., Ibrahim, H. M., & Omar, N. M. (2024). A deep learning tech- nique to detect distributed denial of service attacks in software-defined networks. Computers & Security, 137, 103588. https://doi.org/10.1016/j.cose.2023.103588 20. Abdulqadder, I. H., Zhou, S., Zou, D., Aziz, I. T., & Akber, S. M. A. (2020). Multi-layered intrusion detection and prevention in the SDN/NFV enabled cloud of 5G networks using AI-based defense mechanisms. Computer Networks, 179, 107364. https://doi.org/10.1016/j.comnet.2020.107364 21. El Kamel, A., Eltaief, H., & Youssef, H. (2022). On-the-fly (D) DoS attack miti- gation in SDN using Deep Neural Network-based rate limiting. Computer Commu- nications, 182, 153-169. https://doi.org/10.1016/j.comcom.2021.11.003 22. Priyadarshini, R., & Barik, R. K. (2022). A deep learning based intel- ligent framework to mitigate DDoS attack in fog environment. Journal of King Saud University-Computer and Information Sciences, 34(3), 825-831. https://doi.org/10.1016/j.jksuci.2019.04.010 23. Medina-Arco, J. G., Magán-Carrión, R., Rodríguez-Gómez, R. A., & García- Teodoro, P. (2024). Methodology for the detection of contaminated training datasets for machine learning-based network intrusion-detection systems. Sensors, 24(2), 479. https://doi.org/10.3390/s24020479 24. Chinu, & Bansal, U. (2024). Fair XIDS: Ensuring fairness and transparency in in- trusion detection models. Concurrency and Computation: Practice and Experience, 36(25), e8268. https://doi.org/10.1002/cpe.8268 25. S. Rahman, S. Pal, S. Mittal, T. Chawla & C. Karmakar. (2024). SYN-GAN: A robust intrusion detection system using GAN-based synthetic data for IoT security. Internet of Things, 26, 101212. https://doi.org/10.1016/j.iot.2024.101212 26. Sambangi, S. & Gondi, L. (2020). A machine learning approach for DDoS (Dis- tributed Denial of Service) attack detection using multiple linear regression. Pro- ceedings, 63(1), 51. https://doi.org/10.3390/proceedings2020063051 27. Sharafaldin, I., Lashkari, A. & Ghorbani, A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018), p. 108-116. https://doi.org/10.5220/0006639801080116 28. G. Götte. (2023). The effect of adversarial debiasing on model performance. IN- FORMATIK 2023 - Designing Futures: Zukünfte gestalten. Bonn: Gesellschaft für Informatik e.V., p. 39-44. Young Scientists and Early-Stage Research in Data Sci- ence Workshop (YSDS-23), Berlin. https://doi.org/10.18420/inf2023_01 29. M.S. Elsayed, N.-A. Le-Khac, S. Dev & A.D. Jurcut. (2020). DDoSNet: A deep- learning model for detecting network attacks. 2020 IEEE 21st International Sympo- sium on A World of Wireless, Mobile and Multimedia Networks (WoWMoM), Cork, Ireland, p. 391-396. https://doi.org/10.1109/WoWMoM49955.2020.00072 30. V. Kumar & D. Sinha. (2023). Synthetic attack data generation model applying generative adversarial network for intrusion detection. Computers & Security, 125, 103054. https://doi.org/10.1016/j.cose.2022.103054 20A. Sukumar et al. 31. Brownlee, J. (2019, August 6). Ensemble learning methods for deep learning neural networks. Machine Learning Mastery. Retrieved from: https://machinelearningmastery.com/ensemble-methods-for-deep-learning-neural- networks/ 32. J. Charlier, A. Singh, G. Ormazabal, R. State & H. Schulzrinne. (2019). Syn- GAN: Towards generating synthetic network attacks using GANs. arXiv:1908.09899 [cs.LG]. https://doi.org/10.48550/arXiv.1908.09899 33. Almiani, M., AbuGhazleh, A., Al-Rahayfeh, A., Atiewi, S., & Razaque, A. (2020). Deep recurrent neural network for IoT intrusion detec- tion system. Simulation Modelling Practice and Theory, 101, 102031. https://doi.org/10.1016/j.simpat.2019.102031 34. T.C. Miranda, P.-F. Gimenez, J.-F. Lalande, V.V.T. Tong & P. Wilke. (2022). Debiasing Android malware datasets: How can I trust your results if your dataset is biased? IEEE Transactions on Information Forensics and Security, 17, 2182-2197. https://doi.org/10.1109/TIFS.2022.3180184 35. K.S. Sahoo, A. Iqbal, P. Maiti & B. Sahoo. (2018). A machine learning ap- proach for predicting DDOS traffic in software defined networks. 2018 International Conference on Information Technology (ICIT), Bhubaneswar, India, p. 199-203. https://doi.org/10.1109/ICIT.2018.00049 36. T. Subbulakshmi, K. BalaKrishnan, S.M. Shalinie, D. Anand Kumar, V. Gana- pathi Subramanian & K. Kannathal. (2011). Detection of DDoS attacks using enhanced support vector machines with real time generated dataset. 2011 Third International Conference on Advanced Computing, Chennai, India, p. 17-22. https://doi.org/10.1109/ICoAC.2011.6165212 37. M. Hossain, S. Rafi, S. Hossain. (2020). An optimized decision tree based An- droid malware detection approach using machine learning. NSysS ’20: Proceedings of the 7th International Conference on Networking, Systems and Security, Dhaka, Bangladesh, p. 115-125. https://doi.org/10.1145/3428363.3428375 38. Y. Fang. (2024). APIB-GAN: A generative adversarial networks based approach for anomaly prediction of internet behavior. Physical Communication, 64, 102315. https://doi.org/10.1016/j.phycom.2024.102315 39. C. Wang, C. Xu, X. Yao & D. Tao. (2019). Evolutionary generative adversar- ial networks. IEEE Transactions on Evolutionary Computation, 23(6), 921-934. https://doi.org/10.1109/TEVC.2019.2895748 40. K.K. Babu & S.R. Dubey. (2021). CSGAN: Cyclic-Synthesized Generative Adver- sarial Networks for image-to-image transformation. Expert Systems with Applica- tions, 169, 114431. https://doi.org/10.1016/j.eswa.2020.114431 41. A. Al-Adwan. (2024). Evaluating the effectiveness of brain tumor image gen- eration using generative adversarial network with Adam optimizer. Interna- tional Journal of Advanced Computer Science and Applications, 15(6), 2024. https://dx.doi.org/10.14569/IJACSA.2024.0150653 42. B. van Giffen, D. Herhausen & T. Fahse. (2022). Overcoming the pit- falls and perils of algorithms: A classification of machine learning bi- ases and mitigation methods. Journal of Business Research, 144, 93-106. https://doi.org/10.1016/j.jbusres.2022.01.076

Instant research discovery