STAN: Synthetic Network Traffic Generation with Generative Neural Models

Manish Marwah; Martin Arlitt; Naren Ramakrishnan; Shengzhe Xu

REVIEW 2 major objections 6 minor 34 references

STAN: Synthetic Network Traffic Generation with Generative Neural Models

T0 review · 2 major / 6 minor · reviewed 2026-08-27 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read STAN claims synthetic netflow can replace real traffic in training anomaly detectors, retaining 98% of F1.

desk verdict Solid synthetic netflow generator with an honest substitution test on forecasting proxies; the anomaly-detection framing overshoots the evidence. read the letter →

arxiv 2009.12740 v2 pith:62PAYVJ2 submitted 2020-09-27 cs.LG cs.CR

Shengzhe Xu , Manish Marwah , Martin Arlitt , Naren Ramakrishnan This is my paper · ORCID

classification cs.LGcs.CR

keywords syntheticdatagenerationnetworktrafficnetflowautoregressivegenerativemodelmixturedensityanomalydetectioncybersecuritymultivariatetimeseries

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that realistic synthetic network traffic can stand in for real, privacy-sensitive traffic when training machine-learning models for cybersecurity. The authors build STAN, an autoregressive neural generator that models both dependencies across time and dependencies between attributes in each netflow record, and train it on the public UGR'16 dataset. They then train two anomaly detectors — protocol classification and byte-count forecasting — on synthetic data alone and report that performance stays close to models trained on real data: F1 drops from 99% to 97% and forecasting MSE rises about 13%. The point of the claim is practical: if it holds, organizations could share and train on generated traffic instead of exposing real user behavior. The paper explicitly leaves privacy-attack validation and long-dependency testing as future work.

What carries the argument

The load-bearing object is a k-row sliding context window fed through a stack of convolutional layers (the 'window CNN'), whose representation feeds either a mixture density network for continuous attributes or softmax classifiers for discrete attributes. An autoregressive loop draws a row from the conditional distribution, appends it to the window, and repeats, so the generator can start from an all-zero marginal and produce a stream of arbitrary length. The convolution mask is the part that controls attribute dependence: mask A assumes attributes in a row are independent given past rows, while mask B lets later attributes in a row condition on earlier ones, and experiments show mask B recovers the within-row correlation R=0.9 that mask A misses (0.7).

What would settle it

Take a netflow trace with known daily periodicity, train STAN with a small window, and compare autocorrelation of a target attribute such as bytes or flow count in real versus synthetic data at lags k+1, k+5, and k+24; if real data shows significant autocorrelation there while synthetic data is flat, the k-order Markov claim fails.

Watch

Extended reading notes

Core claim

STAN's central discovery is that a convolutional autoregressive model with mixture-density and softmax output heads can learn the joint distribution of a multivariate netflow stream well enough that the generated stream is fungible for downstream model training. The generator factorizes the joint distribution as a product of conditional distributions given the previous k rows, with a mask selecting whether attributes within a row are conditionally independent or explicitly conditioned on earlier attributes in the same row. It models IP addresses as four 256-category variables, treats well-known ports individually and higher ports in bins, and predicts continuous fields such as bytes, duration, and inter-arrival time from a Gaussian mixture. On the UGR'16 week, synthetic data passes domain sanity checks at rates close to real data, and models trained with 0% real data retain about 98% of the all-real-data F1 score.

Load-bearing premise

The generator assumes that rows separated by more than k time steps are conditionally independent, so if real netflow has dependencies spanning more than k steps, STAN will not reproduce them and downstream models trained on its output will degrade.

Editorial extensions

If this is right

Synthetic data from STAN can substitute for real data in training a Random Forest protocol classifier with F1 0.97 rather than 0.99.
A neural regression model trained only on STAN-generated data forecasts byte counts with about 13% higher MSE than one trained on real data.
STAN captures IP, port, protocol, and flag marginal distributions without a separately trained embedding, matching UGR'16 power-law behaviors and top-port distributions better than GMM, BN, WPGAN, and CTGAN.
Because generation is autoregressive from the learned marginal, STAN can produce any desired amount of synthetic traffic without needing a real seed.
Domain constraint tests such as byte/packet bounds, TCP flags only on TCP flows, and HTTP using TCP are satisfied by STAN-generated data at rates comparable to real data (93-100%).

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the k-window Markov assumption is the bottleneck, a natural extension is to make k adaptive or add a latent state that carries information beyond k; the paper's own future-work item on longer temporal dependencies points in that direction.
The privacy promise is only as strong as the absence-of-leakage claim; a membership-inference or memorization test on the generator, which the paper lists as future work, would determine whether replacing real data actually removes exposure.
The same architecture should transfer to other multivariate event streams such as authentication logs or database audit trails, but the netflow-specific IP and port handling would need to be generalized to those data types.
Evaluating on adjacent days in the same week may underestimate non-stationarity; the fungibility claim would be stronger if tested across months or under concept drift.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Request a human review

A listed scientist reviews the paper for a fee and the review publishes here regardless of verdict. See the reviewers or get listed.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

STAN is a solid engineering contribution. The new thing is an autoregressive architecture for multivariate netflow-style time series that combines convolutional context windows with mixture density outputs for continuous attributes and softmax for discrete, plus a sensible way to model IP addresses as four 256-way categoricals and ports as 1670 categories. The causal masks are a clean adaptation of PixelCNN-style masking to rows and columns. The paper ships code, trains on Monday, tests on Tuesday, compares against GMM, BN, WPGAN, CTGAN, and runs both marginal-distribution checks and downstream substitution tests. For the two tasks it actually evaluates—protocol prediction and byte forecasting—the claim holds: fully synthetic training loses only 2% F1 and adds 13% MSE. That is an honest result and likely useful.

Where the paper overreaches is the phrase 'anomaly detection models.' Section 4.5 describes the two tasks as self-supervision for anomaly detection, but the evaluation never uses a labeled attack interval, never defines a detection threshold, and never reports precision/recall/AUC. The UGR'16 week was chosen because it had 'events marked,' but those events are not exploited. So the paper establishes substitutability for two forecasting proxies, not for the downstream security application it claims. A model can predict normal bytes well and still mis-calibrate prediction error under attack. This is a real gap, but it is a framing-and-evidence gap, not a flaw in the architecture. The authors do list attack-data generation and privacy attacks as future work, so they know the limits.

The two things that bother me most as a reader are smaller and fixable: (1) the window size k is never reported, even though Equation 2's Markov assumption is load-bearing for the model's ability to capture long-term dependencies; the paper explicitly defers validating long-term dependencies to future work. (2) Privacy is asserted only as 'no obvious data leakage' with actual membership inference deferred. That is fair as a limitation statement, but it means the privacy motivation remains unverified.

The stress-test note is right. I don't think it sinks the paper. The architecture, the domain-specific attribute modeling, and the clean temporal holdout are worth referee time. The right outcome is conditional acceptance with the authors required to either add a detection-based evaluation or retitle the application section as forecasting/regression proxies.

I'd bring this to a reading group focused on synthetic data for systems/networking, and I'd cite it if I were working on mixed-type time-series generation. For peer review: yes, send it out. A serious referee should engage with it.

Referee Report

2 major / 6 minor

Summary. STAN is an autoregressive generative model for multivariate time-series network traffic data. It factorizes the joint distribution over rows using a k-window conditional assumption and over attributes using either conditional independence (mask A) or explicit conditioning (mask B). The architecture combines convolutional layers with mixture density networks for continuous attributes and softmax layers for discrete attributes, and it includes specialized encodings for IP addresses and port numbers. The paper evaluates STAN on a simulated two-variable process and on one week of UGR'16 netflow data (Monday for training, Tuesday for test), comparing against GMM, Bayesian networks, WPGAN, and CTGAN using NLL, JS divergence, domain-knowledge checks, and two downstream self-supervised tasks: transport-protocol forecasting and byte-value forecasting. The headline results are a 2% F1 drop and a 13% MSE increase when models are trained on synthetic instead of real data.

Significance. If the results hold, STAN is a useful contribution to synthetic network-traffic generation: it explicitly models both temporal and attribute dependencies, handles mixed continuous and categorical attributes, and demonstrates a genuine substitution test in which models are trained on synthetic data and evaluated on held-out real data. The temporal holdout, the multiple baselines, the domain-knowledge sanity checks, and the public code are all strengths. However, the paper's central anomaly-detection claim is not directly supported by the experiments, the window size k is unreported, and privacy guarantees are explicitly deferred to future work. The contribution is therefore best understood as a promising generative model for netflow-like data with preliminary evidence of downstream utility in two self-supervised prediction tasks.

major comments (2)

[Section 4.5 and Section 5.2 (Fig. 11)] The manuscript's headline claim—that models trained on synthetic data can substitute for real data in anomaly detection—is not directly tested. Section 4.5 frames protocol prediction and byte forecasting as self-supervised anomaly-detection tasks, but Section 5.2 reports only macro-F1 for protocol classification and MSE for byte forecasting on normal UGR'16 traffic. No labeled attack intervals from UGR'16 are used, no anomaly threshold is defined, and no detection metric (precision, recall, or AUC) is reported. The observed 2% F1 drop and 13% MSE increase therefore establish substitutability for two self-supervised prediction proxies, not for anomaly-detection performance. A predictive model can be accurate on normal traffic yet miscalibrate its prediction error under attack, which is precisely the sensitivity that the substitution claim requires. Please either add an anomaly-detection evaluation using UGR'16 attack labels or revise the abstract, introduction, and conclusion to claim substitutability for self-supervised prediction tasks only.
[Section 4.1, Eq. (2); Section 5.2] The window size k governs the k-th order Markov assumption in Eq. (2), where rows separated by more than k time steps are treated as conditionally independent. The paper never reports the k used for the UGR'16 experiments, nor does it provide a sensitivity analysis, and Section 6 lists 'validating capture of long term dependencies' as future work. Without k or a sensitivity analysis, the central temporal-dependency claim is not fully reproducible, and it is unknown whether dependencies beyond k steps matter for downstream performance. Please report k and study its effect on synthetic data quality and downstream task metrics.

minor comments (6)

[Section 5.2] There is a repeated phrase: 'We selected this week this week since it looked interesting'; one copy should be removed.
[Section 5.2, Table 5] The text says 'We highlight five tests here' but then states 'STAN performs well in all three'; the count should be corrected to five, or the set of tests should be reconciled.
[Section 4.4, Eq. (8)] The Bayesian-network factorization appears garbled: the right-hand side contains terms such as P(xi,j1)P(xi−1,j1|xi,j1)P(xi,j2|xi,j2) that do not follow from the stated conditional P(xi,j1|xi,j2,xi−1,j1). Please rewrite the equation or clarify the derivation.
[Section 5.1, Table 2] The MSE values in Table 2 are reported without variance; since both the synthetic data generation and the downstream model training are stochastic, standard deviations over repeated runs should be provided.
[Section 4.2 and Figure 2] The architecture description gives filter counts but not the number of convolutional layers or the output dimensions of each layer; please include a fuller description or a specific pointer to the released code for reproducibility.
[Section 4.5] The sentence about marking anomalies 'when the actual value significantly differs from the real one' should say 'from the predicted value' or 'from the model's expectation'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the substitution test is genuine and the evaluation is not reducible to STAN's training objective.

full rationale

STAN's central claim is that machine-learning models trained on synthetic data perform comparably to models trained on real data. The evaluation in Section 5.2 trains RandomForest and neural-network models on either real Dtest or STAN-generated Dsynth and evaluates them on real held-out data via cross-validation; Dtest was not used to train STAN, and no fitted constant from the synthetic data is fed back into the evaluation metric. The protocol-forecasting and byte-forecasting tasks are related to STAN's autoregressive conditional distributions, but that is the intended property under test rather than an identity: the downstream models are a different model class and are scored on real data, so the reported 2% F1 drop and 13% MSE increase are empirical outcomes. Hyperparameter selection on Dhistorical is standard practice and does not make the prediction forced. The paper contains no load-bearing self-citations and invokes no uniqueness theorem from the authors' prior work. The paper's own future-work statements—validating long-term dependencies, privacy attacks, and generating attack data—are acknowledged limitations, not circular steps. The gap between the self-supervised proxies and a direct anomaly-detection metric is a validity concern, not a circularity concern, because no equation or fitted parameter reduces the claimed result to its input by construction.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The model rests on standard probability factorization, a k-window Markov assumption whose length is unreported, and parametric distributional assumptions (GMM and softmax). The main free parameters are hyperparameters chosen by hand or validation; none are fitted to the test data.

free parameters (5)

window size k
Conditional independence distance in Equation 2; chosen by 'empirical evidence or domain knowledge' but not specified for the real data experiments.
number of Gaussian components = 10
Selected based on cross-validation on Dvalidation for mixture density layers.
learning rates = 0.001 (MDN), 0.01 (softmax)
Manually set to highest values that allowed fast convergence.
batch size = 512
Manually set for quick convergence on UGR'16.
port bin size for ports > 1024 = 100
Ports above 1024 are grouped into bins of 100 to reduce the categorical space; a design choice affecting granularity.

assumptions (4)

standard math Product rule of probability (Equation 1)
Used to factorize joint distribution into conditionals.
domain assumption k-th order Markov property (Equation 2)
Assumes rows beyond k steps are conditionally independent; central to model tractability and generation quality.
domain assumption Initialization by marginal P(x1) approximated as P(x1|0)
Generation starts from an all-zero context, which may not match the true marginal distribution.
domain assumption Gaussian mixture for continuous attributes, softmax for discrete attributes
Assumes these parametric forms sufficiently capture attribute distributions.

how reviews work

0 comments

Cite this review

Pith. "Pith review of STAN: Synthetic Network Traffic Generation with Generative Neural Models." pith.science (2026). https://pith.science/paper/62PAYVJ2

@misc{pith2026200912740,
  author       = {Pith},
  title        = {Pith review of: STAN: Synthetic Network Traffic Generation with Generative Neural Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/62PAYVJ2}},
  note         = {Machine review of arXiv:2009.12740}
}

read the original abstract

Deep learning models have achieved great success in recent years but progress in some domains like cybersecurity is stymied due to a paucity of realistic datasets. Organizations are reluctant to share such data, even internally, due to privacy reasons. An alternative is to use synthetically generated data but existing methods are limited in their ability to capture complex dependency structures, between attributes and across time. This paper presents STAN (Synthetic network Traffic generation with Autoregressive Neural models), a tool to generate realistic synthetic network traffic datasets for subsequent downstream applications. Our novel neural architecture captures both temporal dependencies and dependence between attributes at any given time. It integrates convolutional neural layers with mixture density neural layers and softmax layers, and models both continuous and discrete variables. We evaluate the performance of STAN in terms of the quality of data generated, by training it on both a simulated dataset and a real network traffic data set. Finally, to answer the question - can real network traffic data be substituted with synthetic data to train models of comparable accuracy? We train two anomaly detection models based on self-supervision. The results show only a small decline in the accuracy of models trained solely on synthetic data. While current results are encouraging in terms of quality of data generated and absence of any obvious data leakage from training data, in the future we plan to further validate this fact by conducting privacy attacks on the generated data. Other future work includes validating capture of long term dependencies and making model training

Figures

Figures reproduced from arXiv: 2009.12740 by the authors.

**Figure 2.** STAN components: (a) window CNN, which crops the context based on a sliding window and extracts features from context; The CNN architecture includes 14 layers where numeric values notes are the number of 3*3 convolutional filters; B notes batch normalization layers; ReLU notes activation layers; and M notes max pooling layers. (b) mixture density neural layers and softmax layers learn to predict the distributions … view at source ↗

**Figure 3.** Masks for context window convolution Mixture density neural layer (mdn). learns a conditional Gaussian mixture distribution. It consists of three parallel fully connected layers, modeling αi , σi , µi separately, where the parameter αi represents for the component weights of an Gaussian mixture model, and the µi and σ 2 i are the mean and variance parameters of the Gaussian distribution components. The αi paramete… view at source ↗

Figures from the paper (8 more)

**Figure 4.** Figure 4: With the benefit of flexible STAN continuous and discrete generator architecture, special domain attributes (such as IP address, port, protocol, and TCP flags), can be learned by purely modifying the configure parameters. from experts. For example, if xi,j1 is dependen…

**Figure 5.** Figure 5: Temporal dependence: (Xt, Xt−1) scatter plot of the simulated data and synthetic data with Correlation Coefficients R. traffic connection or flow. We selected a netflow data set for our experiments since it is a good representative format for network traffic data in ge…

**Figure 6.** Figure 6: Attribute dependence: (Xt, Yt) scatter plot of the simulated data and synthetic data with Correlation Coefficients R. provider. First, we selected a week of data (April week3) data to focus on. We selected this week this week since it looked interesting in terms of vol…

**Figure 7.** Figure 7: JS divergence between attribute marginal distribution between [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]

**Figure 8.** Figure 8: IP address characteristics. The x-axis (log-scale) represents unique user [PITH_FULL_IMAGE:figures/full_fig_p021_8.png]

**Figure 9.** Figure 9: Port number characteristics. Cybersecurity application tasks. Finally, we test our synthetic data on two cybersecurity machine learning applications, to detect anomalies using selfsupervision. One of the tasks is a classification problem, and the other is a regressio…

**Figure 10.** Figure 10: Transport protocol and TCP flags characteristics. [PITH_FULL_IMAGE:figures/full_fig_p023_10.png]

**Figure 11.** Figure 11: Real application task performance. model. When we substitute real data with that generated by the baselines, the performance drops even quicker, because they do a poor job of capturing the temporal and attribute dependence. Even in the absence of any real data, data g…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 31 canonical work pages

[1]

https://en.wikipedia.org/wiki/QUIC, accessed: 2020-11-20

Quic. https://en.wikipedia.org/wiki/QUIC, accessed: 2020-11-20

work page 2020
[2]

Aggarwal, C.C., Yu, P.S.: A General Survey of Privacy-Preserving Data Mining Models and Algorithms, pp. 11–52. Springer US, Boston, MA (2008)

work page 2008
[3]

IEEE Security & Privacy 17(2), 49–58 (2019) 26 Shengzhe Xu, Manish Marwah, Martin Arlitt, and Naren Ramakrishnan

Al-Rubaie, M., Chang, J.M.: Privacy-preserving machine learning: Threats and solutions. IEEE Security & Privacy 17(2), 49–58 (2019) 26 Shengzhe Xu, Manish Marwah, Martin Arlitt, and Naren Ramakrishnan

work page 2019
[4]

Generating Synthetic but Plausible Healthcare Record Datasets

Avi˜ n´ o, L., Ruﬃni, M., Gavald` a, R.: Generating synthetic but plausible healthcare record datasets. arXiv preprint arXiv:1807.01514 (2018)

work page Pith review arXiv 2018
[5]

Information 10(4), 122 (2019)

Berman, D.S., Buczak, A.L., Chavis, J.S., Corbett, C.L.: A survey of deep learning methods for cyber security. Information 10(4), 122 (2019)

work page 2019
[6]

Bishop, C.M.: Mixture density networks (1994)

1994
[7]

IEEE Communications surveys & tutorials 18(2), 1153–1176 (2015)

Buczak, A.L., Guven, E.: A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications surveys & tutorials 18(2), 1153–1176 (2015)

2015
[8]

In: IEEE INFOCOM 2004

Cao, J., Cleveland, W.S., Gao, Y., Jeﬀay, K., Smith, F.D., Weigle, M.: Stochastic models for generating synthetic http source traﬃc. In: IEEE INFOCOM 2004. vol. 3, pp. 1546–1557. IEEE (2004)

work page 2004

Show all 34 references

[9]

In: 28th {USENIX} Security Symposium ( {USENIX} Security 19)

Carlini, N., Liu, C., Erlingsson, ´U., Kos, J., Song, D.: The secret sharer: Evaluat- ing and testing unintended memorization in neural networks. In: 28th {USENIX} Security Symposium ( {USENIX} Security 19). pp. 267–284 (2019)

2019
[10]

Computers & Electrical Engineering 38(5), 1062–1072 (2012)

Catania, C.A., Garino, C.G.: Automatic network intrusion detection: Current tech- niques and open issues. Computers & Electrical Engineering 38(5), 1062–1072 (2012)

2012
[11]

In: 2018 European Conference on Optical Commu- nication (ECOC)

Chen, X., Li, B., Shamsabardeh, M., Proietti, R., Zhu, Z., Yoo, S.: On real- time and self-taught anomaly detection in optical networks using hybrid unsu- pervised/supervised learning. In: 2018 European Conference on Optical Commu- nication (ECOC). pp. 1–3. IEEE (2018)

2018
[12]

In: Advances in neural information processing systems

Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., Bengio, Y.: Generative adversarial nets. In: Advances in neural information processing systems. pp. 2672–2680. MIT Press, Cambridge, MA, USA (2014)

2014
[13]

In: Data engineering (ICDE), 2012 IEEE 28th international conference (2012)

Graham, C.: Diﬀerentially private spatial decompositions. In: Data engineering (ICDE), 2012 IEEE 28th international conference (2012)

2012
[14]

Jan, S.T., Hao, Q., Hu, T., Pu, J., Oswal, S., Wang, G., Viswanath, B.: Throwing darts in the dark? detecting bots with limited data using neural data augmentation
[15]

arXiv preprint arXiv:1412.6980 (2014)

Kingma, D.P., Ba, J.: Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)

2014 arXiv
[16]

Cluster Computing pp

Kwon, D., Kim, H., Kim, J., Suh, S.C., Kim, I., Kim, K.J.: A survey of deep learning-based network anomaly detection. Cluster Computing pp. 1–13 (2017)

2017
[17]

In: Proceedings of the ACM Internet Measurement Conference

Lin, Z., Jain, A., Wang, C., Fanti, G., Sekar, V.: Using gans for sharing networked time series data: Challenges, initial promise, and open questions. In: Proceedings of the ACM Internet Measurement Conference. pp. 464–483 (2020)

2020
[18]

Computers & Security 73, 411–424 (2018)

Maci´ a-Fern´ andez, G., Camacho, J., Mag´ an-Carri´ on, R., Garc´ ıa-Teodoro, P., Ther´ on, R.: Ugr ’16: A new dataset for the evaluation of cyclostationarity-based network idss. Computers & Security 73, 411–424 (2018)

2018
[19]

In: Proceedings of INFO- COM’97

Mah, B.A.: An empirical model of http network traﬃc. In: Proceedings of INFO- COM’97. vol. 2, pp. 592–600. IEEE (1997)

1997
[20]

In: Metcalf, L., Casey, W

Metcalf, L., Casey, W.: Chapter 3 - probability models. In: Metcalf, L., Casey, W. (eds.) Cybersecurity and Applied Mathematics, pp. 23 – 42. Syngress, Boston (2016). https://doi.org/https://doi.org/10.1016/B978- 0-12-804452-0.00003-8, http://www.sciencedirect.com/science/arti...

2016 doi
[21]

In: Advances in neural in- formation processing systems

Van den Oord, A., Kalchbrenner, N., Espeholt, L., Vinyals, O., Graves, A., et al.: Conditional image generation with pixelcnn decoders. In: Advances in neural in- formation processing systems. pp. 4790–4798 (2016)

2016
[22]

arXiv preprint arXiv:1601.06759 (2016) STAN 27

Oord, A.v.d., Kalchbrenner, N., Kavukcuoglu, K.: Pixel recurrent neural networks. arXiv preprint arXiv:1601.06759 (2016) STAN 27

2016 arXiv
[23]

Proceedings of the VLDB Endowment 11(10), 1071–1083 (2018)

Park, N., Mohammadi, M., Gorde, K., Jajodia, S., Park, H., Kim, Y.: Data synthe- sis based on generative adversarial networks. Proceedings of the VLDB Endowment 11(10), 1071–1083 (2018)

2018
[24]

ACM SIGCOMM Computer Communication Review 27(5), 5–18 (1997)

Paxson, V.: Fast, approximate synthesis of fractional gaussian noise for generating self-similar network traﬃc. ACM SIGCOMM Computer Communication Review 27(5), 5–18 (1997)

1997
[25]

IEEE Access (2020)

Razak, S., Haﬁzah, N., Al-Dhaqm, A.: Data anonymization using pseudonym sys- tem to preserve data privacy. IEEE Access (2020)

2020
[26]

IEEE transactions on Information The- ory 45(3), 992–1018 (1999)

Riedi, R.H., Crouse, M.S., Ribeiro, V.J., Baraniuk, R.G.: A multifractal wavelet model with application to network traﬃc. IEEE transactions on Information The- ory 45(3), 992–1018 (1999)

1999
[27]

In: 2017 IEEE International Conference on Data Mining Work- shops (ICDMW)

Ring, M., Dallmann, A., Landes, D., Hotho, A.: Ip2vec: Learning similarities be- tween ip addresses. In: 2017 IEEE International Conference on Data Mining Work- shops (ICDMW). pp. 657–666. IEEE (2017)

2017
[28]

Computers & Security 82, 156–172 (2019)

Ring, M., Schl¨ or, D., Landes, D., Hotho, A.: Flow-based network traﬃc generation using generative adversarial networks. Computers & Security 82, 156–172 (2019)

2019
[29]

RiskiqInc.: The evil internet minute 2019, https://www.riskiq.com/infographic/evil- internet-minute-2019 (2019), https://www.riskiq.com/infographic/ evil-internet-minute-2019

2019
[30]

In: 2017 IEEE Symposium on Security and Pri- vacy (SP)

Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: 2017 IEEE Symposium on Security and Pri- vacy (SP). pp. 3–18. IEEE (2017)

2017
[31]

In: Proceedings of the AAAI Conference on Artiﬁcial Intelligence

Sun, Y., Cuesta-Infante, A., Veeramachaneni, K.: Learning vine copula models for synthetic data generation. In: Proceedings of the AAAI Conference on Artiﬁcial Intelligence. vol. 33, pp. 5049–5057 (2019)

2019
[32]

In: Proceedings of the European Conference on Computer Vision (ECCV)

Vyas, A., Jammalamadaka, N., Zhu, X., Das, D., Kaul, B., Willke, T.L.: Out- of-distribution detection using an ensemble of self supervised leave-out classiﬁers. In: Proceedings of the European Conference on Computer Vision (ECCV). pp. 550–564 (2018)

2018
[33]

econ- omy (2018), https://www.whitehouse.gov/wp-content/uploads/2018/03/ The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf

WhiteHouse: The cost of malicious cyber activity to the u.s. econ- omy (2018), https://www.whitehouse.gov/wp-content/uploads/2018/03/ The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf

2018
[34]

In: Advances in Neural Information Processing Systems

Xu, L., Skoularidou, M., Cuesta-Infante, A., Veeramachaneni, K.: Modeling tab- ular data using conditional gan. In: Advances in Neural Information Processing Systems. pp. 7333–7343 (2019)

2019

Pith tools

Reviewed August 27, 2026 · model on record in the stance chip above.

[1] [1]

https://en.wikipedia.org/wiki/QUIC, accessed: 2020-11-20

Quic. https://en.wikipedia.org/wiki/QUIC, accessed: 2020-11-20

work page 2020

[2] [2]

Aggarwal, C.C., Yu, P.S.: A General Survey of Privacy-Preserving Data Mining Models and Algorithms, pp. 11–52. Springer US, Boston, MA (2008)

work page 2008

[3] [3]

IEEE Security & Privacy 17(2), 49–58 (2019) 26 Shengzhe Xu, Manish Marwah, Martin Arlitt, and Naren Ramakrishnan

Al-Rubaie, M., Chang, J.M.: Privacy-preserving machine learning: Threats and solutions. IEEE Security & Privacy 17(2), 49–58 (2019) 26 Shengzhe Xu, Manish Marwah, Martin Arlitt, and Naren Ramakrishnan

work page 2019

[4] [4]

Generating Synthetic but Plausible Healthcare Record Datasets

Avi˜ n´ o, L., Ruﬃni, M., Gavald` a, R.: Generating synthetic but plausible healthcare record datasets. arXiv preprint arXiv:1807.01514 (2018)

work page Pith review arXiv 2018

[5] [5]

Information 10(4), 122 (2019)

Berman, D.S., Buczak, A.L., Chavis, J.S., Corbett, C.L.: A survey of deep learning methods for cyber security. Information 10(4), 122 (2019)

work page 2019

[6] [6]

Bishop, C.M.: Mixture density networks (1994)

1994

[7] [7]

IEEE Communications surveys & tutorials 18(2), 1153–1176 (2015)

Buczak, A.L., Guven, E.: A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications surveys & tutorials 18(2), 1153–1176 (2015)

2015

[8] [8]

In: IEEE INFOCOM 2004

Cao, J., Cleveland, W.S., Gao, Y., Jeﬀay, K., Smith, F.D., Weigle, M.: Stochastic models for generating synthetic http source traﬃc. In: IEEE INFOCOM 2004. vol. 3, pp. 1546–1557. IEEE (2004)

work page 2004