Holistic generative and discriminative models for intrusion detection: A GAN-assisted multiclass classification mechanism

Abstract

Traditional intrusion detection systems often struggle with the complexity of modern, multi-dimensional cyber threats. This study proposes a hybrid four-phase methodology that integrates unsupervised Generative Adversarial Network (GAN)-based anomaly scoring with supervised multiclass classification for attack type and severity. Utilizing a dataset of 40,000 network records, the framework employs domain-specific feature engineering, including payload analysis and z-score normalization. A GAN trained on 11,934 normal samples generated discriminator-based anomaly scores to serve as probabilistic inputs for subsequent models. While the GAN alone showed limited binary detection performance (AUC-ROC=0.4983), it provided valuable features for the hybrid architecture. In the multiclass classification phase, BiLSTM achieved the highest overall accuracy (34.3%), while Random Forest demonstrated superior binary performance (AUC-ROC=1.0000). The results highlight the inherent challenges of threat categorization in imbalanced, real-world datasets. The study concludes that while GANs are ineffective as standalone classifiers, their discriminator outputs function effectively as probabilistic features within a unified framework. This approach bridges a gap in IDS research by combining generative modeling with dual-task classification for more robust network security.