A Hybrid Deep Learning Framework for IoT Traffic Generation Based on Channel–Spatial Residual Attention and VAE-WGAN

Data paucity in IoT attack/anomaly traffic samples inhibits accurate threat identification, limiting defensive modeling capabilities. Existing generative models, such as WGAN-GP and CTGAN, often fail to preserve fine-grained temporal dynamics and multi-dimensional feature correlations in packet-level traffic, leading to low fidelity in synthesized data and poor generalization in downstream tasks. To address these limitations, this paper proposes VWRAM, a novel traffic generation framework combining Variational Autoencoder (VAE) with Wasserstein generative adversarial network (WGAN) and residual attention mechanism. It first utilizes Gramian Angular Summation Field (GASF) to transform one-dimensional time-series network traffic data into two-dimensional images, and then performs gamma correction using a power-law expression to enhance image quality. The framework employs a hybrid architecture combining VAE and WGAN to synthesize network traffic feature maps. To enhance the extraction of channel and spatial characteristics, a bidirectional multi-scale channel fusion residual module and a dual attention mechanism (accounting for both channel and spatial dimensions) are incorporated into the generator of GAN. This design effectively bridges the gap in modeling complex, multi-scale IoT traffic patterns with high structural and statistical fidelity.Finally, theoretical analysis and experimental results on the MedBIoT dataset demonstrate that the proposed framework exhibits significant advantages over representative generative models. Specifically, VWRAM achieves an anomaly detection accuracy of 93%, outperforming state-of-the-art models like SyNIG and CTGAN by 6% and 15%, respectively. Furthermore, it demonstrates superior distributional fidelity, achieving the lowest Jensen-Shannon Divergence of 0.0918 in key traffic features.