1. NetDiffus Framework

The NetDiffus project is one of the first to apply diffusion models to network traffic generation. It converts 1D time-series network data into 2D images using Gramian Angular Summation Fields (GASF), which capture packet sizes, inter-packet times, and temporal correlations. These images are then used to train diffusion models that generate high-fidelity synthetic traffic. Compared to GAN-based methods, NetDiffus showed:

• 66.4% improvement in data fidelity
• 18.1% better performance in downstream ML tasks
• .Enhanced results in traffic fingerprinting, anomaly detection, and classification1

2. Diffusion–Attention Traffic Generation (DATG)

Another approach, DATG, combines diffusion models with self-attention mechanisms to better capture temporal dependencies in traffic sequences. This hybrid model improves the realism and diversity of generated traffic, outperforming GANs in metrics like Jensen-Shannon Divergence (JSD) and Continuous Ranked Probability Score (CRPS). It’s particularly effective in simulating multi-scenario traffic for IDS training and evaluation

2

.

3. AdvDiffuser for Adversarial Example Synthesis

Although focused on image data, AdvDiffuser demonstrates how diffusion models can be used to generate natural adversarial examples. It perturbs images in a perceptually stealthy way, suggesting that similar techniques could be adapted for network traffic adversarial simulation. This could help train IDS models to detect sophisticated evasion tactics while maintaining high fidelity to real-world traffic patterns

3

.

Architectural Advantages

• Stability: Diffusion models avoid common GAN issues like mode collapse and training instability.
• High Fidelity: They can better capture complex distributions and temporal features.
• Scalability: Suitable for generating diverse traffic types (e.g., IoT, video, web).
• Adversarial Training: Can be used to simulate evasive traffic for robust IDS development.

Challenges

• Computational Cost: Diffusion models are resource-intensive.
• Data Representation: Converting network traffic to formats suitable for diffusion (e.g., GASF) requires careful preprocessing.
• Evaluation Metrics: Measuring realism and adversarial effectiveness in synthetic traffic is still evolving.