# TempoNet: Learning Realistic Communication and Timing Patterns for Network Traffic Simulation

arXiv: https://arxiv.org/abs/2601.15663 · HTML: https://mlsanity.com/paper/2601.15663/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 43 references that are in the map.
- First posted on arXiv 22 Jan 2026.

## Builds on (most cited first, 11 of 11)

- [Language Models are Realistic Tabular Data Generators](https://mlsanity.com/paper/2210.06280/) (2022)
- [Transformer Hawkes Process](https://mlsanity.com/paper/2002.09291/) (2020)
- [Intensity-Free Learning of Temporal Point Processes](https://mlsanity.com/paper/1909.12127/) (2019)
- [Neural Temporal Point Processes: A Review](https://mlsanity.com/paper/2104.03528/) (2021)
- [Neural Spatio-Temporal Point Processes](https://mlsanity.com/paper/2011.04583/) (2020)
- [Neural Point Process for Learning Spatiotemporal Event Dynamics](https://mlsanity.com/paper/2112.06351/) (2021)
- [NetDiffus: Network Traffic Generation by Diffusion Models through Time-Series Imaging](https://mlsanity.com/paper/2310.04429/) (2023)
- [Using GANs for Sharing Networked Time Series Data: Challenges, Initial Promise, and Open Questions](https://mlsanity.com/paper/1909.13403/) (2019)
- [Unified Host and Network Data Set](https://mlsanity.com/paper/1708.07518/) (2017)
- [STAN: Synthetic Network Traffic Generation with Generative Neural Models](https://mlsanity.com/paper/2009.12740/) (2020)
- [Modelling Direct Messaging Networks with Multiple Recipients for Cyber Deception](https://mlsanity.com/paper/2111.11932/) (2021)

## Abstract (arXiv)

Realistic network traffic simulation is critical for evaluating intrusion detection systems, stress-testing network protocols, and constructing high-fidelity environments for cybersecurity training. While attack traffic can often be layered into training environments using red-teaming or replay methods, generating authentic benign background traffic remains a core challenge -- particularly in simulating the complex temporal and communication dynamics of real-world networks. This paper introduces TempoNet, a novel generative model that combines multi-task learning with multi-mark temporal point processes to jointly model inter-arrival times and all packet- and flow-header fields. TempoNet captures fine-grained timing patterns and higher-order correlations such as host-pair behavior and seasonal trends, addressing key limitations of GAN-, LLM-, and Bayesian-based methods that fail to reproduce structured temporal variation. TempoNet produces temporally consistent, high-fidelity traces, validated on real-world datasets. Furthermore, we show that intrusion detection models trained on TempoNet-generated background traffic perform comparably to those trained on real data, validating its utility for real-world security applications.