PAACGAN : Protocol‐Aware Generative Augmentation for Robust Imbalanced Network Intrusion Detection

ABSTRACT Class imbalance remains a major challenge in network intrusion detection because rare attack classes are substantially underrepresented relative to benign traffic and frequent attack categories. This imbalance biases learning algorithms towards majority classes and reduces detection performance on critical minority attacks. To address this problem, we propose PAACGAN, a Protocol‐Aware Auxiliary Classifier Generative Adversarial Network for minority‐class augmentation in intrusion detection. The proposed model incorporates protocol‐aware conditioning based on TCP/UDP characteristics, destination port distributions, and class‐specific traffic statistics so that generated samples preserve both class identity and protocol‐level consistency. The augmented training data are then used to train an XGBoost classifier for intrusion detection. Experiments on the NSL‐KDD and CICIDS2017 benchmark datasets show that the proposed framework improves recall and F1‐score for minority classes. On the rarest CICIDS2017 attack categories, including Infiltration and Heartbleed , the proposed method achieves an F1‐score improvement of up to 12.57 percentage points. These results show that protocol‐aware generative augmentation is effective for improving rare‐attack detection under severe data imbalance.