Scholarlink

<p>The rapid growth of telecommunication network traffic poses increasing challenges for reliable and timely detection of malicious activity. One of the key difficulties in this domain is class imbalance, where malicious events constitute only a minority portion of real-world datasets. Traditional oversampling techniques often struggle to capture the structural diversity of minority-class patterns in such settings. This paper investigates the use of large language models (LLMs) for synthetic data generation as a data-level approach to mitigating class imbalance in network traffic classification tasks. The proposed method leverages the generative capabilities of LLMs to produce diverse and statistically consistent synthetic samples that enhance the representation of minority classes while preserving the overall characteristics of the original data. Experimental results show that incorporating LLM-generated samples during training increases recall for the minority malicious class from approximately 0.78 to 0.84, while maintaining competitive precision. In addition, an analysis based on the coefficient of variation indicates that the proposed method exhibits lower variability of recall and F1-score compared to synthetic minority over-sampling technique (SMOTE), and demonstrates stability comparable to adaptive synthetic sampling (ADASYN) and table variational auto-encoder (TVAE) across repeated training runs. These results suggest that LLM-based synthetic data generation improves minority-class detection under constrained augmentation conditions while maintaining stable and reliable model behavior.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

An LLM-based synthetic data generation approach for addressing class imbalance in malicious traffic detection

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年7月23日

查看全文
  • Krzysztof Przystupa,
  • Michał Majka,
  • Andrii Lutsiuk,
  • Orest Lavriv,
  • Mykola Beshley,
  • Ihor Kahalo

摘要

The rapid growth of telecommunication network traffic poses increasing challenges for reliable and timely detection of malicious activity. One of the key difficulties in this domain is class imbalance, where malicious events constitute only a minority portion of real-world datasets. Traditional oversampling techniques often struggle to capture the structural diversity of minority-class patterns in such settings. This paper investigates the use of large language models (LLMs) for synthetic data generation as a data-level approach to mitigating class imbalance in network traffic classification tasks. The proposed method leverages the generative capabilities of LLMs to produce diverse and statistically consistent synthetic samples that enhance the representation of minority classes while preserving the overall characteristics of the original data. Experimental results show that incorporating LLM-generated samples during training increases recall for the minority malicious class from approximately 0.78 to 0.84, while maintaining competitive precision. In addition, an analysis based on the coefficient of variation indicates that the proposed method exhibits lower variability of recall and F1-score compared to synthetic minority over-sampling technique (SMOTE), and demonstrates stability comparable to adaptive synthetic sampling (ADASYN) and table variational auto-encoder (TVAE) across repeated training runs. These results suggest that LLM-based synthetic data generation improves minority-class detection under constrained augmentation conditions while maintaining stable and reliable model behavior.