Protocol-Aware Traffic Representation with Conditional Diffusion Transformer for Imbalanced Network Intrusion Detection

Abstract

Network intrusion detection systems face severe class imbalance in real-world traffic, where rare attack types such as Shellcode, Worms, and Infiltration are vastly outnumbered by benign flows, causing deep learning models to perform poorly on minority classes. Existing data augmentation methods including SMOTE, VAE, and GAN suffer from low sample diversity, training instability, or blurry reconstructions that limit their effectiveness in security-critical scenarios. To address these issues, this paper proposes a Protocol-Aware traffic Representation with Conditional Diffusion Transformer (PA-CDiT) framework. First, a Protocol-Aware Representation (PAR) encodes the protocol stack into separate RGB channels—red for full-packet bytes, green for transport-layer headers, and blue for application-layer payload—preserving the natural hierarchy of network communication. Second, a conditional diffusion Transformer incorporating Decoupled Temporal Embedding, Interval-Aware Attention, and Conditional Adaptive Modulation enables high-quality minority-class sample generation in only 64 denoising steps. Experiments on the CIC-IDS2017 dataset demonstrate that PAR improves detection F1-score by up to 1.0 percentage point over grayscale representations, and PA-CDiT achieves 88.9% minority-class F1-score, outperforming the 100-step DDPM baseline (86.3%) while reducing inference steps by 1.56×. Ablation studies confirm that each module contributes independently to generation quality. Additionally, PA-CDiT trains 2.3× faster than DDPM with 37% less GPU memory; sensitivity analysis validates key hyperparameters; the classifier resists adversarial examples; and IP/MAC anonymization is shown to benefit generalization.