# Deep Adversarial Learning in Intrusion Detection: A Data Augmentation Enhanced Framework

arXiv: https://arxiv.org/abs/1901.07949 · HTML: https://mlsanity.com/paper/1901.07949/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Jan 2019.

## Built on by (most cited first, 5 of 5)

- [Adversarial Machine Learning In Network Intrusion Detection Domain: A Systematic Review](https://mlsanity.com/paper/2112.03315/) (2021)
- [OMNISEC: LLM-Driven Provenance-based Intrusion Detection via Retrieval-Augmented Behavior Prompting](https://mlsanity.com/paper/2503.03108/) (2025)
- [Effective Intrusion Detection in Highly Imbalanced IoT Networks with Lightweight S2CGAN-IDS](https://mlsanity.com/paper/2306.03707/) (2023)
- [Hybrid LLM-Enhanced Intrusion Detection for Zero-Day Threats in IoT Networks](https://mlsanity.com/paper/2507.07413/) (2025)
- [Adaptive Intrusion Detection System Leveraging Dynamic Neural Models with Adversarial Learning for 5G/6G Networks](https://mlsanity.com/paper/2512.10637/) (2025)

## Abstract (arXiv)

Intrusion detection systems (IDSs) play an important role in identifying malicious attacks and threats in networking systems. As fundamental tools of IDSs, learning based classification methods have been widely employed. When it comes to detecting network intrusions in small sample sizes (e.g., emerging intrusions), the limited number and imbalanced proportion of training samples usually cause significant challenges in training supervised and semi-supervised classifiers. In this paper, we propose a general network intrusion detection framework to address the challenges of both data scarcity and data imbalance. The novelty of the proposed framework focuses on incorporating deep adversarial learning with statistical learning and exploiting learning based data augmentation. Given a small set of network intrusion samples, it first derives a Poisson-Gamma joint probabilistic generative model to generate synthesised intrusion data using Monte Carlo methods. Those synthesised data are then augmented by deep generative neural networks through adversarial learning. Finally, it adopts the augmented intrusion data to train supervised models for detecting network intrusions. Comprehensive experimental validations on KDD Cup 99 dataset show that the proposed framework outperforms the existing learning based IDSs in terms of improved accuracy, precision, recall, and F1-score.