A bayesian VAE based framework for synthetic data generation and false-alarm reduction in multi-class intrusion detection systems

Abstract

Intrusion detection systems (IDS) are constantly evolving in the field of network security to safeguard critical data assets against a growing array of sophisticated cyber threats, such as malevolent botnets, massive Distributed Denial of Service (DDoS) attacks, slow-rate DDoS attacks, advanced persistent threats (APTs), and zero-day exploits. Moreover, any organization’s network infrastructure remains vulnerable to different types of attacks, such as system abuse, security lapses, and break-ins. The Network Intrusion Detection System (NIDS) used in a network identifies such penetration attempts and intrusions. Researchers using deep learning (DL) have proposed increasingly capable IDS to protect critical networks; however, IDS are difficult to deploy in such environments because of high false-alarm rates (FAR). In this paper, we propose a hybrid framework that combines conditional variational autoencoder (CVAE)–based synthetic data generation with a Bayesian VAE model to reduce false-alarm rates in multi-class intrusion detection. This approach aims to lower FAR while maintaining strong detection performance by augmenting minority classes with class-consistent synthetic samples and leveraging calibrated Bayesian decisions.