Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins

In the context of cybersecurity digital twin environments, the ability to simulate realistic network traffic is critical for validating and training intrusion detection systems. However, generating synthetic data that accurately reflects the complex, time-dependent nature of network flows remains a...

Descripción completa

Detalles Bibliográficos
Autores: Iturbe, Eider, Arcas, Javier, Gaminde, Gabriel, Ríos Velasco, Erkuden, Toledo Gandarias, Nerea
Tipo de recurso: artículo
Fecha de publicación:2025
País:España
Institución:Universidad del País Vasco
Repositorio:Addi. Archivo Digital para la Docencia y la Investigación
OAI Identifier:oai:addi.ehu.eus:10810/77621
Acceso en línea:http://hdl.handle.net/10810/77621
Access Level:acceso abierto
Palabra clave:synthetic data generation
cybersecurity
digital twin
AI-based simulation
network flow data
id ES_31ec01976ae4e99123aa5aae53156eae
oai_identifier_str oai:addi.ehu.eus:10810/77621
network_acronym_str ES
network_name_str España
repository_id_str
spelling Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital TwinsIturbe, EiderArcas, JavierGaminde, GabrielRíos Velasco, ErkudenToledo Gandarias, Nereasynthetic data generationcybersecuritydigital twinAI-based simulationnetwork flow dataIn the context of cybersecurity digital twin environments, the ability to simulate realistic network traffic is critical for validating and training intrusion detection systems. However, generating synthetic data that accurately reflects the complex, time-dependent nature of network flows remains a significant challenge. This paper presents an AI-based data generation approach designed to generate multivariate temporal network flow data that accurately reflects adversarial scenarios. The proposed method integrates a Long Short-Term Memory (LSTM) architecture trained to capture the temporal dynamics of both normal and attack traffic, ensuring the synthetic data preserves realistic, sequence-aware behavioral patterns. To further enhance data fidelity, a combination of deep learning-based generative models and statistical techniques is employed to synthesize both numerical and categorical features while maintaining the correct proportions and temporal relationships between attack and normal traffic. A key contribution of the framework is its ability to generate high-fidelity synthetic data that supports the simulation of realistic, production-like cybersecurity scenarios. Experimental results demonstrate the effectiveness of the approach in generating data that supports robust machine learning-based detection systems, making it a valuable tool for cybersecurity validation and training in digital twin environments.This work has received funding from the European Union’s Horizon Europe research and innovation program under grant agreement No 101070455 (DYNABIC).MDPIEuropean Commission202620262025info:eu-repo/semantics/articleapplication/pdfhttp://hdl.handle.net/10810/77621reponame:Addi. Archivo Digital para la Docencia y la Investigacióninstname:Universidad del País VascoInglésinfo:eu-repo/grantAgreement/EC/H2020/101182827https://www.mdpi.com/2076-3417/15/21/11574info:eu-repo/semantics/openAccesshttp://creativecommons.org/licenses/by/4.0/© 2025 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) licenseoai:addi.ehu.eus:10810/776212026-06-18T09:23:17Z
dc.title.none.fl_str_mv Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins
title Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins
spellingShingle Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins
Iturbe, Eider
synthetic data generation
cybersecurity
digital twin
AI-based simulation
network flow data
title_short Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins
title_full Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins
title_fullStr Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins
title_full_unstemmed Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins
title_sort Hybrid AI-Based Framework for Generating Realistic Attack-Related Network Flow Data for Cybersecurity Digital Twins
dc.creator.none.fl_str_mv Iturbe, Eider
Arcas, Javier
Gaminde, Gabriel
Ríos Velasco, Erkuden
Toledo Gandarias, Nerea
author Iturbe, Eider
author_facet Iturbe, Eider
Arcas, Javier
Gaminde, Gabriel
Ríos Velasco, Erkuden
Toledo Gandarias, Nerea
author_role author
author2 Arcas, Javier
Gaminde, Gabriel
Ríos Velasco, Erkuden
Toledo Gandarias, Nerea
author2_role author
author
author
author
dc.contributor.none.fl_str_mv European Commission
dc.subject.none.fl_str_mv synthetic data generation
cybersecurity
digital twin
AI-based simulation
network flow data
topic synthetic data generation
cybersecurity
digital twin
AI-based simulation
network flow data
description In the context of cybersecurity digital twin environments, the ability to simulate realistic network traffic is critical for validating and training intrusion detection systems. However, generating synthetic data that accurately reflects the complex, time-dependent nature of network flows remains a significant challenge. This paper presents an AI-based data generation approach designed to generate multivariate temporal network flow data that accurately reflects adversarial scenarios. The proposed method integrates a Long Short-Term Memory (LSTM) architecture trained to capture the temporal dynamics of both normal and attack traffic, ensuring the synthetic data preserves realistic, sequence-aware behavioral patterns. To further enhance data fidelity, a combination of deep learning-based generative models and statistical techniques is employed to synthesize both numerical and categorical features while maintaining the correct proportions and temporal relationships between attack and normal traffic. A key contribution of the framework is its ability to generate high-fidelity synthetic data that supports the simulation of realistic, production-like cybersecurity scenarios. Experimental results demonstrate the effectiveness of the approach in generating data that supports robust machine learning-based detection systems, making it a valuable tool for cybersecurity validation and training in digital twin environments.
publishDate 2025
dc.date.none.fl_str_mv 2025
2026
2026
dc.type.none.fl_str_mv info:eu-repo/semantics/article
format article
dc.identifier.none.fl_str_mv http://hdl.handle.net/10810/77621
url http://hdl.handle.net/10810/77621
dc.language.none.fl_str_mv Inglés
language_invalid_str_mv Inglés
dc.relation.none.fl_str_mv info:eu-repo/grantAgreement/EC/H2020/101182827
https://www.mdpi.com/2076-3417/15/21/11574
dc.rights.none.fl_str_mv info:eu-repo/semantics/openAccess
http://creativecommons.org/licenses/by/4.0/
eu_rights_str_mv openAccess
rights_invalid_str_mv http://creativecommons.org/licenses/by/4.0/
dc.format.none.fl_str_mv application/pdf
dc.publisher.none.fl_str_mv MDPI
publisher.none.fl_str_mv MDPI
dc.source.none.fl_str_mv reponame:Addi. Archivo Digital para la Docencia y la Investigación
instname:Universidad del País Vasco
instname_str Universidad del País Vasco
reponame_str Addi. Archivo Digital para la Docencia y la Investigación
collection Addi. Archivo Digital para la Docencia y la Investigación
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869405642004889600
score 15,811543

Similares en LA Referencia