# Synthetic Network Traffic Generation for Intrusion Detection Systems: a Systematic Literature Review

Pierre-François Gimenez

► To cite this version:

Pierre-François Gimenez. Synthetic Network Traffic Generation for Intrusion Detection Systems: a Systematic Literature Review. ANUBIS 2025 - 1st International Workshop on Assessment with New methodologies, Unified Benchmarks, and environments, of Intrusion detection and response Systems, Sep 2025, Toulouse, France. pp.1-18. hal-05379236

HAL Id: hal-05379236

https://hal.science/hal-05379236v1

Submitted on 24 Nov 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Synthetic Network Traffic Generation for
Intrusion Detection Systems: a Systematic
Literature Review

Pierre-François Gimenez[0000-0002-4238-4423]

Univ. Rennes, Inria, IRISA
pierre-francois.gimenez@inria.fr

**Abstract.** Network data can be difficult to collect due to privacy and confidentiality reasons. For these reasons, network datasets are typically created with controlled environments called testbeds. However, these datasets are regularly criticized for their limited size, class imbalance, obsolescence, and lack of actual user activity. Following the rapid development of generative artificial intelligence, new methods have been applied to synthetic network traffic generation without emulation or simulation. This systematic literature review assesses the current state of synthetic network traffic generation for intrusion detection systems.

**Keywords:** Networking · Generative AI · Traffic Generation

# 1 Introduction

Data is central in many applications: to analyze and visualize the state of a system, to train AI-based models, to assess processes, etc. However, accessing such data in computer networks can be challenging due to their sensitive and private nature. For this reason, network analysis generally relies on controlled and simplified environments, called testbeds, that do not contain private or sensitive information. However, testbeds have limitations too. First, they lack real user behavior and suffer from a limited diversity of technologies and usages. Due to this issue, it may not be possible to extrapolate results obtained on a testbed, such as an intrusion detection system, to a network with actual, more complex and varied user behavior. Second, collecting data is slow: to generate a dataset including several weeks of data, such as CICIDS2018 [57], the testbeds must run for several weeks. So, when errors [31] happen during an experiment, rerunning can be very costly. Besides, it also means that it is difficult to quickly create a dataset that contains recent technologies or attacks, contributing to the overall obsolescence of datasets.

Synthetic network traffic generators create network traffic without emulation or simulation. Molnar et al. [41] identified five categories of synthetic network traffic generators: replay engines, maximum throughput generators, model-based generators, high-level and auto-configurable generators, and special scenario generators. Due to the recent surge of generative artificial intelligence, this study
is focused on model-based generators. New models such as Generative Adversarial Networks (GAN), Variational Auto-Encoder (VAE), diffusion models, and Large Language Models (LLMs) are more and more used in academia to generate synthetic network traffic. These models are generally trained on network traffic datasets and can generate synthetic data far faster than a testbed. However, their quality may not be up to par with that of testbeds.

This article proposes a Systematic Literature Review (SLR) [26] on this topic.

## 2 Background and Scope of the Study

Writing a survey involves summarizing many works to produce and analyze a snapshot of scientific effort within some scope. However, many biases can alter such surveys. Important articles may be missed, such as work from other scientific communities than the authors, using different keywords, or published in less prestigious venues. Systematic Literature Review (SLR) [26] is a methodology that notably aims at reducing such biases with a systematic and reproducible procedure. This procedure can be summarized in the following steps: 1) defining the scope of the study; 2) identifying precise research questions; 3) systematically collecting articles by using regular expressions on specialized search platforms; 4) reading and analyzing them.

The subject of synthetic network traffic generation is at the intersection of three domains: networking, cybersecurity, and machine learning. To deal with the large variety of works, we reduce the scope of the study with three restrictions. First, we limit our study to IT networks based on the IP protocol, because most of the literature on intrusion detection systems and synthetic network traffic generation focuses on such networks. In particular, we do not include works on industrial (OT) networks, IoT networks, or 5G networks unless they are generic enough to be applied to IT networks. Second, as motivated in the introduction, we only consider *model-based* generation, i.e., generation relying on machine learning or statistical methods. In particular, a large body of work focuses on hand-written generation rules. Such rules are generally designed for a specific need. They are not scalable and cannot accommodate the large variety of attacks or user behavior in IT networks. Third, we focus on applications for cybersecurity, such as intrusion detection systems, honeynets for malware analysis, or environments for cybersecurity experts' training.

## 3 Research Questions Definition

We propose the following research questions as a way to build a snapshot of the practices of the synthetic network traffic generation community:

**RQ1:** Which communities work on synthetic network traffic generation?

**RQ2:** What are the applications of synthetic network traffic generation in cybersecurity?

**RQ3:** What types of data are generated?
<figure><img src="image_2.png" /><figcaption>Fig. 1. The PRISMA diagram of this systematic literature review.</figcaption></figure>

**RQ4:** *What generation techniques are used?*

**RQ5:** *How are generated data evaluated?*

**RQ6:** *What open-source implementations exist?*

**RQ7:** *What are the performances of the generators?*

# 4 Corpus Creation

We based our systematic literature enumeration on the IEEE Xplore and Google Scholar search engines. IEEE Xplore supports regular expressions for searching. After reviewing several works in the domain, we decided on this expression:

(("Document Title": "generative" OR "Document Title": "synthetic" OR "Document Title": "generation" OR "Document Title": "generator" OR "Document Title": "data augmentation") AND ("Document Title": "network data" OR "Document Title": "network traces" OR "Document Title": "traffic" OR "Document Title": "packet" OR "Document Title": "pcap" OR "Document Title": "log" OR "Document Title": "internet") AND NOT "Document Title": "next generation")

We search Google Scholar with the following keywords: *generative synthetic generation "data augmentation" network traffic packet pcap internet*.

The article collection was performed on April 28th and updated on August 8th. We collected 630 articles published since 2010 from IEEE Xplore. Google Scholar does not provide a definite list of relevant articles, so we collected articles until the results were no longer relevant. The complete selection process is detailed in Fig. 1. The final corpus is composed of 68 articles. We did not filter the articles by the rank of their conference nor by the number of citations.

# 5 Answers to Research Questions

## 5.1 RQ1: Which communities work on synthetic network traffic generation?

Synthetic network traffic generation is a multidisciplinary topic. In our corpus, 37 articles have been published in networking-adjacent venues, 10 in cybersecurity-adjacent venues, 4 in AI-adjacent venues, and 17 in other venues. Details are available in the Appendix. Generally, AI models are mere tools and cybersecurity is only considered a possible application. Surprisingly, the cybersecurity community seems to downplay the importance and the impact of synthetic data.
## 5.2 RQ2: What Are the Application of Synthetic Network Traffic Generation in Cybersecurity?

We identified two main applications with different challenges. Some articles do not clearly state their applications and have been classified to our best guess.

*Data Augmentation (30 articles)* The motivation for data augmentation is the imbalance in network datasets, e.g., if there is more benign traffic than malicious traffic. This imbalance typically causes performance issues with machine learning algorithms [64]. Data augmentation proposes to generate more examples of the minority classes (generally attacks) to reduce this imbalance. This application aims to expand real data with synthetic ones, not to supplant them.

*Dataset Generation (38 articles)* Dataset generation can be useful when actual data is scarce or difficult to share due to privacy or confidentiality issues. Such datasets can be used for machine learning training or classifier evaluation. For some works, the goal is to simulate benign, real-world traffic, e.g., for digital twins [73] or cybersecurity exercises [28]. Articles may focus on generating just one data class, such as video traffic [25] or a specific attack [42].

Data augmentation is more common in cybersecurity (50% of these articles use data augmentation) to enhance detection performances and less prevalent in the networking community (only 32%) that focuses more on building and analyzing datasets.

## 5.3 RQ3: What Types of Data Are Generated?

There are four main types of generated data. Table 1 details which data type is more common for different applications. One method can generate several types of data.

*Traffic Statistics (3 articles)* Traffic statistics describe the traffic without detailing each flow e.g., with throughput time series [44, 49, 25]. This is the least common data type.

*Flow Statistics (41 articles)* Flow statistics are the most commonly generated data, notably for data augmentation. Indeed, many IDS rely on flows for their decision. Since there is no standard flow statistics, there is a wide variety of output formats: while some articles generate 5-uplets, others create up to 84 statistics, which is in line with what the CICFlowMeter tool produces.

*Packet Metadata (25 articles)* Due to the widespread use of cryptography in packet payloads, packet metadata is considered sufficient for many applications. The nature of these metadata depends from one article to another: e.g., [56] generates a sequence of packet sizes, and [47] generates sequences of TCP flags, inter-packet arrival times, and packet sizes.
*Packet Payloads (16 articles)* The last category of generated data is packet payloads. Packet payloads are necessary to send packets on the wire, but are rarely analyzed by security tools due to privacy concerns and the widespread use of cryptography.

The most common format for data augmentation is flow statistics. Indeed, flow statistics are tabular data, making them very suitable for a wide range of machine learning techniques. For dataset generation, while flow statistics are also popular, a large proportion generates pcap files with packet payload and metadata, making them applicable to a wider range of usages.

<table><caption>**Table 1.** Number of articles per types of generated data and applications.</caption><thead><tr><th>Applications</th><th>Data augmentation</th><th>Dataset generation</th></tr></thead><tbody><tr><td>Traffic</td><td>0</td><td>3</td></tr><tr><td>Flow</td><td><b>23</b></td><td><b>18</b></td></tr><tr><td>Packet metadata only</td><td>3</td><td>8</td></tr><tr><td>Packet payload only</td><td>1</td><td>1</td></tr><tr><td>Packet metadata and payload</td><td>3</td><td>11</td></tr></tbody></table>

## 5.4 RQ4: What Generation Techniques Are Used?

Various techniques are used in model-based generation. The most popular techniques are deep learning techniques [32], namely Generative Adversarial Networks (GAN), Variational AutoEncoder (VAE), diffusion models and Large Language Models (LLMs). Surprisingly, *all but one article* [71] of the corpus experiment with a deep learning method, either in a new method or as a baseline.

*Generative Adversarial Networks (47 articles)* Vanilla GAN are by far the most used techniques. The most common variants are CGAN, which allow for conditional generation (11 articles), CTGAN, which allow for conditional generation and are specialized in tabular data (10 articles), and WGAN (13 articles), a more classical flavor of GAN. A few articles use CNN-GAN to generate images ([72, 11, 9, 68]) and a few architectures are used to generate time sequences (RCGAN, TimeGan, and SigCWGAN). Besides, some articles introduce their own GAN variants, such as CCGAN [51], PcapGAN [18] or MF-CGAN [50]. The reader is encouraged to read this survey [45] on GAN in networking to learn more about these models. Overall, GAN are present in 47 articles, i.e., 69% of the corpus.

*Other Deep Learning Techniques (24 articles)* The second most popular technique is VAE (and variations), with 8 articles: [14, 56, 67, 1, 47, 54, 62, 40]. Diffusion and LLMs are more recent techniques. Diffusion is used in 7 articles ([22, 67, 23, 73, 24, 77, 60]) and LLMs in 5 articles ([39, 27, 15, 36, 16]). A few more deep learning techniques are used, such as Seq2Seq (an ancestor of transformers) by [34], LSTM by [43], transformers by [59, 76] and convolutional networks by [20, 70]. Figure 2 presents the number of times a deep learning technique is used per year. First, we can remark that the popularity of the field is accelerating quickly.
Second, the proportion of articles using GAN is decreasing and new techniques, such as diffusion and LLMs, are gaining popularity.

<figure><img src="image_3.png" /><figcaption>**Fig. 2.** The number of occurrences of deep learning generation techniques across the years. The year 2025 is incomplete.</figcaption></figure>

*Other Techniques (8 articles)* Some other techniques have been used, such as SMOTE [10] (by [14, 67, 43, 30, 39, 65]) that was specifically introduced for data augmentation, its variant ADASYN (by [67]), Bayesian networks (by [55, 15]), a graphical and probabilistic model, and network flow pattern mining (by [15]).

## 5.5 RQ5: How Are Generated Data Evaluated?

A wide variety of metrics have been proposed to evaluate synthetic data.

*TSTR (47 articles)* The most common way in our corpus to evaluate synthetic data is called TSTR (for "Train on Synthetic, Test on Real"), proposed in this domain by [80]. This metric does not assess the data themselves but their effect on a downstream task, typically intrusion detection performance.

*Marginal distribution distance (19 articles)* Such metrics compare the distribution of each features independently. The metrics include Earth Mover Distance (8 articles: [56, 47, 72, 55, 15, 21, 24, 53]) for continuous features, and Jensen-Shannon Divergence (9 articles: [22, 70, 1, 72, 55, 15, 24, 53, 77]) or Kullback-Leibler Divergence (2 articles: [44, 53]) for categorical features.

*Qualitative visual evaluation (16 articles)* Such metrics typically rely on dimension reduction techniques such as PCA or t-SNE.

*Similarity distance (15 articles)* This metrics compare data points. This metrics include cosine similarity ([58, 54, 21, 34, 78]), the Euclidian distance ([54, 21]), Total Variation Distance ([22, 33, 77]), the Hellinger distance ([22]), the distance to nearest neighbors ([8]), the Fréchet Inception Distance between images ([7, 60]) and the $L_1$ metric ([42]).
*Networking metrics (11 articles)* These metrics are specific to the networking domain. For example, "packet generation success rate" evaluates the proportion of packet that can be correctly sent to the network ([27, 11, 48, 38, 7, 16]) and Domain Knowledge Check (DKC) verifies some network rules (port 53 should use UDP, ICMP packets should have empty payloads, etc.) in the generated data ([70, 13, 55, 15, 16]).

*Pairwise correlations (5 articles)* These metrics compare pairwise features. A few metrics have been used, such as pairwise correlation ([55, 15, 8]), Pearson correlation ([54, 33]) and Spearman correlation ([54]).

The two applications use different metrics. The TSTR metric have become standard for data augmentation: 97% of the article using data augmentation rely on the TSTR metric. However, such a metric does not easily apply to dataset generation, as one seeks to assess data quality itself and not necessarily through its utility. A few articles focus on evaluation metrics, such as [67] and [55], and they highlight the requirements of using multiple metrics to assess the quality according to different criteria (such as diversity, realism and fidelity) and different scale (packets-level or flow-level).

## 5.6 RQ6: What open-source implementations exist?

Out of the 68 articles we examined, only 14 referenced an open-source implementation, and only 5 were replicated (details are available in the Appendix). Some work may simply be too recent, published the same year as this systematic literature review. Overall, the vast majority of the articles do not compare empirically their contribution to the state of the art. In fact, except NetShare, these methods were only replicated once. This could be caused by the diversity of generated data (flow statistics or pcap, attack or benign) and a lack of standard baselines accepted in the community.

## 5.7 RQ7: What are the performances of the generators?

It is difficult to conclude on the effectiveness of the vast majority of the articles of our corpus because they generate different kinds of data, for different purposes, evaluate with different metrics, rely on different datasets and do not compare their results to baselines. Nonetheless, there is an overall consensus from the articles that do compare their methods to baselines.

*Impact of data augmentation for classification* In [14], SMOTE [10], a classical oversampling method, outperforms CTGAN, Copula GAN, and VAE in a data augmentation task. The systematic evaluation of [67] revealed that most resampling strategies negatively impacted the classification performance across all models. [39] has a similar conclusion: the best classifiers used no data augmentation or SMOTE. In [30], SMOTE is second to WGANGP. In [43], SMOTE is better than CNN-based generation, and in [65], the method proposed by the authors is better than random oversampling (ROS), which is better than GAN.
*Dataset generation quality* In [55], Bayesian networks outperform CTGAN, E-WGAN-GP, and NetShare, and NetShare is worse than a method that samples each feature independently. In [15], a mix of Bayesian networks and data mining outperforms TVAE, CTGAN, E-WGAN-GP, a method based on GPT2, and NetShare on the same metrics as [55].

Overall, the classical SMOTE algorithm can be very effective and should be systematically used as a baseline. Even if deep learning methods are commonly used, they are consistently outperformed by simpler methods. This conclusion is consistent with findings in other communities, such as image classification [63].

# 6 Conclusion

Model-based synthetic network traffic generation is an active research domain with an increasing number of articles that benefit from the current surge of generative AI. However, the performance of deep learning methods over statistical methods has not yet been proven and the utility of these methods is still discussed. We believe synthetic network traffic generation could be more helpful to the cybersecurity community. To that end, we propose a few open challenges to the community.

**Challenge 1** Define a standard benchmark with a set of metrics that could capture the quality of synthetic network traffic, a standard network dataset, and standard baselines. The set of metrics should include temporal consistency and non-functional characteristics of the generator (such as training and generation times). The standard baselines should include state-of-the-art methods and simple methods like SMOTE and random oversampling (ROS) as a low baseline and real data, as proposed in [55], as a high baseline. Such a benchmark could help articles compare each other.

**Challenge 2** Concept drift (the fact that the behavior of a network changes over time) is an operational issue. Research on the subject is difficult due to the lack of appropriate datasets. Thus, cybersecurity could benefit from datasets that include concept drift [6]. However, this subject is never mentioned in our corpus.

**Challenge 3** Recent cybersecurity datasets include APT-like behavior to challenge IDS with stealthy, multi-step, and long-time attacks. The articles of our corpus that create synthetic attacks for dataset generation are limited to single-step attacks. Testbed-based generation cannot easily create months-long datasets and tends to perform APT attacks within a week, which is unrealistic. Synthetic datasets could fill that gap since the generation time is generally much shorter than the dataset duration.

The surge of deep learning methods for synthetic network traffic generation is still not backed by performance increases. Nonetheless, synthetic network traffic generation could become more useful in cybersecurity by focusing more on dataset generation that could foster new research directions.
**Acknowledgements** This work has been partially supported by the French Na-
tional Research Agency under the France 2030 label (Superviz ANR-22-PECY-
0008). The views reflected herein do not necessarily reflect the opinion of the
French government. This work has been also partially supported by Inria under
the SecGen collaboration between Inria, CentraleSupélec and CISPA Helmholtz
Center for Information Security.

References

1. Aceto, G., Giampaolo, F., Guida, C., Izzo, S., Pescapè, A., Piccialli, F., Prezioso, E.: Synthetic and privacy-preserving traffic trace generation using generative AI models for training Network Intrusion Detection Systems. Journal of Network and Computer Applications **229**, 103926 (Sep 2024). https://doi.org/10.1016/j.jnca.2024.103926, https://linkinghub.elsevier.com/retrieve/pii/S1084804524001036

2. Ahmed, H.A., Nepomuceno, J.A., Vega-Márquez, B., Nepomuceno-Chamorro, I.A.: Synthetic data generation for healthcare: Exploring generative adversarial networks variants for medical tabular data. International Journal of Data Science and Analytics pp. 1–16 (2025)

3. Al Olaimat, M., Lee, D., Kim, Y., Kim, J., Kim, J.: A Learning-based Data Augmentation for Network Anomaly Detection. In: 2020 29th International Conference on Computer Communications and Networks (ICCCN). pp. 1–10. IEEE, Honolulu, HI, USA (Aug 2020). https://doi.org/10.1109/ICCCN49398.2020.9209598, https://ieeexplore.ieee.org/document/9209598/

4. Alabsi, B., Anbar, M., Rihan, S.: Conditional Tabular Generative Adversarial Based Intrusion Detection System for Detecting Ddos and Dos Attacks on the Internet of Things Networks. Sensors **23**(12), 5644 (Jun 2023). https://doi.org/10.3390/s23125644, https://www.mdpi.com/1424-8220/23/12/5644

5. Almasre, M., Subahi, A.: Create a Realistic IoT Dataset Using Conditional Generative Adversarial Network. Journal of Sensor and Actuator Networks **13**(5), 62 (Oct 2024). https://doi.org/10.3390/jsan13050062, https://www.mdpi.com/2224-2708/13/5/62

6. Andresini, G., Pendlebury, F., Pierazzi, F., Loglisci, C., Appice, A., Cavallaro, L.: Insomnia: Towards concept-drift robustness in network intrusion detection. In: Proceedings of the 14th ACM workshop on artificial intelligence and security. pp. 111–122 (2021)

7. Bianchi, L.A., Pregardier, R.C., Silva, L.A.L., Dos Santos, C.R.P.: 2PackGAN: Exploring Transfer Learning to Fine-Tune Generative Adversarial Networks for Network Packet Generation. In: NOMS 2025-2025 IEEE Network Operations and Management Symposium. pp. 1–9. IEEE, Honolulu, HI, USA (May 2025). https://doi.org/10.1109/NOMS57970.2025.11073639, https://ieeexplore.ieee.org/document/11073639/

8. Bouzeraib, W., Ghenai, A., Zeghib, N.: Enhancing IoT Intrusion Detection Systems Through Horizontal Federated Learning and Optimized WGAN-GP. IEEE Access **13**, 45059–45076 (2025). https://doi.org/10.1109/ACCESS.2025.3547255, https://ieeexplore.ieee.org/document/10908853/

9. Byun, G., Vo, V.V., Raza, S.M., Le, D.T., Yang, H., Choo, H.: Proactive Network Traffic Prediction using Generative Adversarial Network. In: 2024 International
Conference on Information Networking (ICOIN). pp. 156–159. IEEE, Ho Chi Minh City, Vietnam (Jan 2024). https://doi.org/10.1109/ICOIN59985.2024.10572129, https://ieeexplore.ieee.org/document/10572129/

10. Chawla, N.V., Bowyer, K.W., Hall, L.O., Kegelmeyer, W.P.: Smote: synthetic minority over-sampling technique. Journal of artificial intelligence research **16**, 321–357 (2002)

11. Cheng, A.: PAC-GAN: Packet Generation of Network Traffic using Generative Adversarial Networks. In: 2019 IEEE 10th Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON). pp. 0728–0734. IEEE, Vancouver, BC, Canada (Oct 2019). https://doi.org/10.1109/IEMCON.2019.8936224, https://ieeexplore.ieee.org/document/8936224/

12. Chu, H.C., Lin, Y.J.: Improving the IoT Attack Classification Mechanism with Data Augmentation for Generative Adversarial Networks. Applied Sciences **13**(23), 12592 (Nov 2023). https://doi.org/10.3390/app132312592, https://www.mdpi.com/2076-3417/13/23/12592

13. Constantin, M.G., Stanciu, D.C., tefan, L.D., Dogariu, M., Mihilescu, D., Ciobanu, G., Bergeron, M., Liu, W., Belov, K., Radu, O., Ionescu, B.: Exploring Generative Adversarial Networks for Augmenting Network Intrusion Detection Tasks. ACM Transactions on Multimedia Computing, Communications, and Applications **21**(1), 1–19 (Jan 2025). https://doi.org/10.1145/3689636, https://dl.acm.org/doi/10.1145/3689636

14. Cullen, D., Halladay, J., Briner, N., Basnet, R., Bergen, J., Doleck, T.: Evaluation of Synthetic Data Generation Techniques in the Domain of Anonymous Traffic Classification. IEEE Access **10**, 129612–129625 (2022). https://doi.org/10.1109/ACCESS.2022.3228507, https://ieeexplore.ieee.org/document/9980373/

15. Cüppers, J., Schoen, A., Blanc, G., Gimenez, P.F.: FlowChronicle: Synthetic Network Flow Generation through Pattern Set Mining. Proceedings of the ACM on Networking **2**(CoNEXT4), 1–20 (Dec 2024). https://doi.org/10.1145/3696407, https://dl.acm.org/doi/10.1145/3696407

16. Delgado-Soto, J.A., López De Vergara, J.E., González, I., Perdices, D., De Pedro, L.: GPT on the wire: Towards realistic network traffic conversations generated with large language models. Computer Networks **265**, 111308 (Jun 2025). https://doi.org/10.1016/j.comnet.2025.111308, https://linkinghub.elsevier.com/retrieve/pii/S1389128625002762

17. Dina, A.S., Siddique, A.B., Manivannan, D.: Effect of Balancing Data Using Synthetic Data on the Performance of Machine Learning Classifiers for Intrusion Detection in Computer Networks. IEEE Access **10**, 96731–96747 (2022). https://doi.org/10.1109/ACCESS.2022.3205337, https://ieeexplore.ieee.org/document/9882118/

18. Dowoo, B., Jung, Y., Choi, C.: PcapGAN: Packet Capture File Generator by Style-Based Generative Adversarial Networks. In: 2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA). pp. 1149–1154. IEEE, Boca Raton, FL, USA (Dec 2019). https://doi.org/10.1109/ICMLA.2019.00191, https://ieeexplore.ieee.org/document/8999252/

19. Hossain, M.J., Alam, K., Fahad Monir, M., Mozammal Hoque, M., Ahmed, T.: Explainable AI Meets Synthetic Data: A Deep Learning Framework for Detecting Network Intrusion in NextG Network Infrastructure. IEEE Access **13**, 114979–115001 (2025). https://doi.org/10.1109/ACCESS.2025.3585783, https://ieeexplore.ieee.org/document/11069291/
20. Jiang, A., Shi, K., Wang, M., Zhang, Z.: Research on Network Traffic Feature Map Generation and Evaluation Methods. In: 2023 4th International Conference on Big Data & Artificial Intelligence & Software Engineering (ICBASE). pp. 429–433. IEEE, Nanjing, China (Aug 2023). https://doi.org/10.1109/ICBASE59196.2023.10303124, https://ieeexplore.ieee.org/document/10303124/

21. Jiang, D., Wang, Z., Liu, X., Xu, Q., Zou, T., Zhang, R., Tan, L., Zhang, P.: Toward Synthetic Network Traffic Generating in NTN-Enabled IoT: A Generative AI Approach. IEEE Internet of Things Journal 12(2), 2174–2187 (Jan 2025). https://doi.org/10.1109/JIOT.2024.3468209, https://ieeexplore.ieee.org/document/10716549/

22. Jiang, X., Liu, S., Gember-Jacobson, A., Bhagoji, A.N., Schmitt, P., Bronzino, F., Feamster, N.: NetDiffusion: Network Data Augmentation Through Protocol-Constrained Traffic Generation. Proceedings of the ACM on Measurement and Analysis of Computing Systems 8(1), 1–32 (Feb 2024). https://doi.org/10.1145/3639037, https://dl.acm.org/doi/10.1145/3639037

23. Jiang, X., Liu, S., Gember-Jacobson, A., Schmitt, P., Bronzino, F., Feamster, N.: Generative, High-Fidelity Network Traces. In: Proceedings of the 22nd ACM Workshop on Hot Topics in Networks. pp. 131–138. ACM, Cambridge MA USA (Nov 2023). https://doi.org/10.1145/3626111.3628196, https://dl.acm.org/doi/10.1145/3626111.3628196

24. Kang, M., Cho, G., Yun, S., Lee, Y.: Differentially Private Synthetic Adversarial Network Traffic Generation Based on Tabular Diffusion Processes. In: 2025 International Conference on Artificial Intelligence in Information and Communication (ICAIIC). pp. 0620–0626. IEEE, Fukuoka, Japan (Feb 2025). https://doi.org/10.1109/ICAIIC64266.2025.10920736, https://ieeexplore.ieee.org/document/10920736/

25. Kattadige, C., Muramudalige, S.R., Choi, K.N., Jourjon, G., Wang, H., Jayasumana, A., Thilakarathna, K.: VideoTrain: A Generative Adversarial Framework for Synthetic Video Traffic Generation. In: 2021 IEEE 22nd International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoW-MoM). pp. 209–218. IEEE, Pisa, Italy (Jun 2021). https://doi.org/10.1109/WoW-MoM51794.2021.00034, https://ieeexplore.ieee.org/document/9469502/

26. Keele, S., et al.: Guidelines for performing systematic literature reviews in software engineering. Tech. rep., Technical report, ver. 2.3 ebse technical report. ebse (2007)

27. Kholgh, D.K., Kostakos, P.: PAC-GPT: A Novel Approach to Generating Synthetic Network Traffic With GPT-3. IEEE Access 11, 114936–114951 (2023). https://doi.org/10.1109/ACCESS.2023.3325727, https://ieeexplore.ieee.org/document/10287342/

28. Kim, D.W., Sin, G.Y., Kim, K., Kang, J., Im, S.Y., Han, M.M.: Network Traffic Synthesis and Simulation Framework for Cybersecurity Exercise Systems. Computers, Materials & Continua 80(3), 3637–3653 (2024). https://doi.org/10.32604/cmc.2024.054108, https://www.techscience.com/cmc/v80n3/57885

29. Kim, M., Kang, M., Park, E., Pack, S., Han, J.: Network Data Generation using IP2Vec Embedding. In: 2023 14th International Conference on Information and Communication Technology Convergence (ICTC). pp. 872–874. IEEE, Jeju Island, Korea, Republic of (Oct 2023). https://doi.org/10.1109/ICTC58733.2023.10393857, https://ieeexplore.ieee.org/document/10393857/
30. Kostage, K., West, D., Meinert, T., Qu, C., Calyam, P., Mazzola, L.: Enhancing Autonomous Intrusion Detection System with Generative Adversarial Networks. In: 2024 IEEE 20th International Conference on e-Science (e-Science). pp. 1–10. IEEE, Osaka, Japan (Sep 2024). https://doi.org/10.1109/e-Science62913.2024.10678662, https://ieeexplore.ieee.org/document/10678662/

31. Lanvin, M., Gimenez, P.F., Han, Y., Majorczyk, F., Mé, L., Totel, É.: Errors in the cicids2017 dataset and the significant differences in detection performances it makes. In: International Conference on Risks and Security of Internet and Systems. pp. 18–33. Springer (2022)

32. LeCun, Y., Bengio, Y., Hinton, G.: Deep learning. nature **521**(7553), 436–444 (2015)

33. Li, R., Li, Q., Zou, Q., Zhao, D., Zeng, X., Huang, Y., Jiang, Y., Lyu, F., Ormazabal, G., Singh, A., Schulzrinne, H.: IoTGemini: Modeling IoT Network Behaviors for Synthetic Traffic Generation. IEEE Transactions on Mobile Computing **23**(12), 13240–13257 (Dec 2024). https://doi.org/10.1109/TMC.2024.3426600, https://ieeexplore.ieee.org/document/10595132/

34. Li, Y., Liu, T., Jiang, D., Meng, T.: Transfer-learning-based Network Traffic Automatic Generation Framework. In: 2021 6th International Conference on Intelligent Computing and Signal Processing (ICSP). pp. 851–854. IEEE, Xi’an, China (Apr 2021). https://doi.org/10.1109/ICSP51882.2021.9408767, https://ieeexplore.ieee.org/document/9408767/

35. Li, Z., Chen, S., Dai, H., Xu, D., Chu, C.K., Xiao, B.: Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation. IEEE Transactions on Reliability **72**(2), 498–510 (Jun 2023). https://doi.org/10.1109/TR.2022.3204349, https://ieeexplore.ieee.org/document/9893038/

36. Li, Z., Li, S., Fang, D., Chen, X., Song, Z., Li, Z., Lv, S., Sun, L.: PNet-GPT: Proprietary Protocol Network Traffic Generation with Pre-trained Transformer. In: ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1–5. IEEE, Hyderabad, India (Apr 2025). https://doi.org/10.1109/ICASSP49660.2025.10890383, https://ieeexplore.ieee.org/document/10890383/

37. Liang, R., Zhang, H., Liu, F., Zhang, J., Sun, Z., Song, Y., Li, C., Zhang, L.: Encrypted Malicious Traffic Detection Based on Sample Selection Optimization and Data Augmentation. In: 2024 IEEE 9th International Conference on Data Science in Cyberspace (DSC). pp. 567–574. IEEE, Jinan, China (Aug 2024). https://doi.org/10.1109/DSC63484.2024.00085, https://ieeexplore.ieee.org/document/10858885/

38. Meddahi, A., Drira, H., Meddahi, A.: SIP-GAN: Generative Adversarial Networks for SIP traffic generation. In: 2021 International Symposium on Networks, Computers and Communications (ISNCC). pp. 1–6. IEEE, Dubai, United Arab Emirates (Oct 2021). https://doi.org/10.1109/ISNCC52172.2021.9615632, https://ieeexplore.ieee.org/document/9615632/

39. Melícias, F.S., Ribeiro, T.F.R., Rabadão, C., Santos, L., Costa, R.L.D.C.: GPT and Interpolation-Based Data Augmentation for Multiclass Intrusion Detection in IIoT. IEEE Access **12**, 17945–17965 (2024). https://doi.org/10.1109/ACCESS.2024.3360879, https://ieeexplore.ieee.org/document/10418592/

40. Meslet-Millet, F., Mouysset, S., Chaput, E.: NeCSTGen: An approach for realistic network traffic generation using Deep Learning. In: GLOBECOM 2022 - 2022 IEEE Global Communications Conference. pp. 3108–3113. IEEE, Rio de Janeiro,
Brazil (Dec 2022). https://doi.org/10.1109/GLOBECOM48099.2022.10000731, https://ieeexplore.ieee.org/document/10000731/

41. Molnár, S., Megyesi, P., Szabó, G.: How to validate traffic generators? In: 2013 IEEE International Conference on Communications Workshops (ICC). pp. 1340–1344. IEEE (2013)

42. Mozo, A., González-Prieto, Á., Pastor, A., Gómez-Canaval, S., Talavera, E.: Synthetic flow-based cryptomining attack generation through generative adversarial networks. Scientific reports 12(1), 2091 (2022)

43. Munaye, Y.Y., Molla, A., Belayneh, Y., Simegnew, B.: Long Short-Term Memory and Synthetic Minority Over Sampling Technique-Based Network Traffic Classification. In: 2024 International Conference on Information and Communication Technology for Development for Africa (ICT4DA). pp. 120–124. IEEE, Bahir Dar, Ethiopia (Nov 2024). https://doi.org/10.1109/ICT4DA62874.2024.10777078, https://ieeexplore.ieee.org/document/10777078/

44. Naveed, M.H., Hashmi, U.S., Tajved, N., Sultan, N., Imran, A.: Assessing Deep Generative Models on Time Series Network Data. IEEE Access 10, 64601–64617 (2022). https://doi.org/10.1109/ACCESS.2022.3177906, https://iee-explore.ieee.org/document/9781420/

45. Navidan, H., Moshiri, P.F., Nabati, M., Shahbazian, R., Ghorashi, S.A., Shah-Mansouri, V., Windridge, D.: Generative Adversarial Networks (GANs) in networking: A comprehensive survey & evaluation. Computer Networks 194, 108149 (Jul 2021). https://doi.org/10.1016/j.comnet.2021.108149, https://linkinghub.el-sevier.com/retrieve/pii/S1389128621002139

46. Nekvi, R.I., Saha, S., Mtawa, Y.A., Haque, A.: Examining Generative Adversarial Network for Smart Home DDoS Traffic Generation. In: 2023 International Symposium on Networks, Computers and Communications (ISNCC). pp. 1–6. IEEE, Doha, Qatar (Oct 2023). https://doi.org/10.1109/ISNCC58260.2023.10323616, https://ieeexplore.ieee.org/document/10323616/

47. Noblet, G., Lefebvre, C., Owezarski, P., Ritchie, W.: NetGlyph: Representation Learning to generate Network Traffic with Transformers. In: 2024 20th International Conference on Network and Service Management (CNSM). pp. 1–9. IEEE, Prague, Czech Republic (Oct 2024). https://doi.org/10.23919/CNSM62983.2024.10814626, https://ieeexplore.ieee.org/document/10814626/

48. Nukavarapu, S.K., Ayyat, M., Nadeem, T.: MirageNet - Towards a GAN-based Framework for Synthetic Network Traffic Generation. In: GLOBECOM 2022 - 2022 IEEE Global Communications Conference. pp. 3089–3095. IEEE, Rio de Janeiro, Brazil (Dec 2022). https://doi.org/10.1109/GLOBECOM48099.2022.10001494, https://ieeexplore.ieee.org/document/10001494/

49. Onodera, Y., Takeshita, E., Kosugi, T., Suzuki, S.: Proposal of Temporal Feature Layers for Network Traffic Dataset Generation Using C-GAN. IEICE Communications Express 13(8), 319–322 (Aug 2024). https://doi.org/10.23919/comex.2024XBL0062, https://ieeexplore.ieee.org/document/10554803/

50. Pandey, C., Tiwari, V., Francis, S.A.J., Pal, V., Sinha Roy, D.: MF-CGAN: Multifeature Conditional GAN for Synthetic Data Generation in Internet of Medical Things. IEEE Internet of Things Journal 12(10), 13469–13476 (May 2025). https://doi.org/10.1109/JIOT.2025.3554207, https://ieeexplore.ieee.org/document/10945752/
51. Pavlik, J., Bastian, N.D.: Cyber creative GAN for novel malicious packets. In: Manser, K.E., Rao, R.M., Howell, C.L. (eds.) Synthetic Data for Artificial Intelligence and Machine Learning: Tools, Techniques, and Applications. p. 23. SPIE, Orlando, United States (Jun 2023). https://doi.org/10.1117/12.2663700, https://www.spiedigitallibrary.org/conference-proceedings-of-spie/12529/2663700/Cyber-creative-GAN-for-novel-malicious-packets/10.1117/12.2663700.full

52. Peppes, N., Alexakis, T., Demestichas, K., Adamopoulou, E.: A Comparison Study of Generative Adversarial Network Architectures for Malicious Cyber-Attack Data Generation. Applied Sciences 13(12), 7106 (Jun 2023). https://doi.org/10.3390/app13127106, https://www.mdpi.com/2076-3417/13/12/7106

53. Ribeiro, I.F., Brotto, G., Comarela, G., Villaca, R.S., Mota, V.F.S.: IoTTraffic: Assessing Generative Models for Internet of Things Attack Data Flows. In: 2024 IEEE 10th World Forum on Internet of Things (WF-IoT). pp. 1–6. IEEE, Ottawa, ON, Canada (Nov 2024). https://doi.org/10.1109/WF-IoT62078.2024.10811444, https://ieeexplore.ieee.org/document/10811444/

54. Saka, S., Al-Ataby, A., Selis, V.: Generating Synthetic Tabular Data for DDoS Detection Using Generative Models. In: 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). pp. 1436–1442. IEEE, Exeter, United Kingdom (Nov 2023). https://doi.org/10.1109/TrustCom60117.2023.00196, https://ieeexplore.ieee.org/document/10538767/

55. Schoen, A., Blanc, G., Gimenez, P.F., Han, Y., Majorczyk, F., Me, L.: A Tale of Two Methods: Unveiling the Limitations of GAN and the Rise of Bayesian Networks for Synthetic Network Traffic Generation. In: 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&amp;PW). pp. 273–286. IEEE, Vienna, Austria (Jul 2024). https://doi.org/10.1109/EuroSPW61312.2024.00036, https://ieeexplore.ieee.org/document/10628855/

56. Shahid, M.R., Blanc, G., Jmila, H., Zhang, Z., Debar, H.: Generative Deep Learning for Internet of Things Network Traffic Generation. In: 2020 IEEE 25th Pacific Rim International Symposium on Dependable Computing (PRDC). pp. 70–79. IEEE, Perth, WA, Australia (Dec 2020). https://doi.org/10.1109/PRDC50213.2020.00018, https://ieeexplore.ieee.org/document/9320384/

57. Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A., et al.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp 1(2018), 108–116 (2018)

58. Shin, C.Y., Choi, Y.S., Kim, M.S.: Data Augmentation-Based Enhancement for Efficient Network Traffic Classification. IEEE Access 13, 6006–6028 (2025). https://doi.org/10.1109/ACCESS.2024.3525000, https://ieeexplore.ieee.org/document/10819380/

59. Shukla, R.S., Alatawi, A.M.: Enhancing Internet Traffic Forecasting in MEC Environments With 5GT-Trans: Leveraging Synthetic Data and Transformer-Based Models. IEEE Access 13, 83607–83618 (2025). https://doi.org/10.1109/ACCESS.2025.3569389, https://ieeexplore.ieee.org/document/11002480/

60. Sivaroopan, N., Bandara, D., Madarasingha, C., Jourjon, G., Jayasumana, A.P., Thilakarathna, K.: NetDiffus: Network traffic generation by diffusion models through time-series imaging. Computer Networks 251, 1106–1116
(Sep 2024). https://doi.org/10.1016/j.comnet.2024.110616, https://linkinghub.elsevier.com/retrieve/pii/S1389128624004481

61. Sivaroopan, N., Madarasingha, C., Muramudalige, S., Jourjon, G., Jayasumana, A., Thilakarathna, K.: SynNIG: Synthetic Network Traffic Generation through Time Series Imaging. In: 2023 IEEE 48th Conference on Local Computer Networks (LCN). pp. 1–9. IEEE, Daytona Beach, FL, USA (Oct 2023). https://doi.org/10.1109/LCN58197.2023.10223392, https://ieeexplore.ieee.org/document/10223392/

62. Soper, J., Xu, Y., Foo, E., Jadidi, Z., Thanh, K.N.: Improved Packet-Level Synthetic Network Traffic Generation. In: 2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). pp. 1928–1934. IEEE, Sanya, China (Dec 2024). https://doi.org/10.1109/TrustCom63139.2024.00267, https://ieeexplore.ieee.org/document/10945224/

63. Tarawneh, A.S., Hassanat, A.B., Altarawneh, G.A., Almuhaimeed, A.: Stop oversampling for class imbalance learning: A review. IEEe Access 10, 47643–47660 (2022)

64. Thabtah, F., Hammoud, S., Kamalov, F., Gonsalves, A.: Data imbalance in classification: Experimental evaluation. Information Sciences 513, 429–441 (2020)

65. Wang, P., Li, S., Ye, F., Wang, Z., Zhang, M.: PacketCGAN: Exploratory Study of Class Imbalance for Encrypted Traffic Classification Using CGAN. In: ICC 2020 - 2020 IEEE International Conference on Communications (ICC). pp. 1–7. IEEE, Dublin, Ireland (Jun 2020). https://doi.org/10.1109/ICC40277.2020.9148946, https://ieeexplore.ieee.org/document/9148946/

66. Wang, X., Sun, S., Han, L.: A Study of Data Augmentation for Imbalance Problem in Network Traffic. In: 2023 International Conference on Blockchain Technology and Information Security (ICBCTIS). pp. 174–179. IEEE, Xi’an, China (Jun 2023). https://doi.org/10.1109/ICBCTIS59921.2023.00034, https://ieeexplore.ieee.org/document/10224686/

67. Wolf, M., Landes, D., Hotho, A., Schlör, D.: Systematic Evaluation of Synthetic Data Augmentation for Multi-class NetFlow Traffic. European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECMLPKDD) (Aug 2024)

68. Wong, C., Wang, M., Hossain, M.F., Munasinghe, K.: Internet of Things Anomaly Detection Enhancement using GAN-based Data Augmentation. In: 2024 17th International Conference on Signal Processing and Communication System (ICSPCS). pp. 1–7. IEEE, Surfers Paradise, Australia (Dec 2024). https://doi.org/10.1109/ICSPCS63175.2024.10815773, https://ieeexplore.ieee.org/document/10815773/

69. Wu, C.L., Chen, Y.Y., Chou, P.Y., Wang, C.Y.: Synthetic Traffic Generation with Wasserstein Generative Adversarial Networks. In: GLOBECOM 2022 - 2022 IEEE Global Communications Conference. pp. 1503–1508. IEEE, Rio de Janeiro, Brazil (Dec 2022). https://doi.org/10.1109/GLOBECOM48099.2022.10001157, https://ieeexplore.ieee.org/document/10001157/

70. Xu, S., Marwah, M., Arlitt, M., Ramakrishnan, N.: Stan: Synthetic network traffic generation with generative neural models. In: International Workshop on Deployable Machine Learning for Security Defense. pp. 3–29. Springer (2021)

71. Yan-hui, P., Tao, W., Jian-peng, Z.: A Distributed Synthetic Network Traffic Generation System. In: 2010 First International Conference on Pervasive Computing, Signal Processing and Applications. pp. 1061–1064. IEEE, Harbin, China (Sep 2010). https://doi.org/10.1109/PCSPA.2010.261, http://ieeexplore.ieee.org/document/5635869/
72. Yin, Y., Lin, Z., Jin, M., Fanti, G., Sekar, V.: Practical GAN-based synthetic IP header trace generation using NetShare. In: Proceedings of the ACM SIGCOMM 2022 Conference. pp. 458–472. ACM, Amsterdam Netherlands (Aug 2022). https://doi.org/10.1145/3544216.3544251, https://dl.acm.org/doi/10.1145/3544216.3544251

73. Yuan, H., Yan, X., Li, C.: A Semantic-Driven Data Generative Traffic Modeling Method for Digital Twin Networks. In: 2024 International Conference on Engineering and Emerging Technologies (ICEET). pp. 01–06. IEEE, Dubai, United Arab Emirates (Dec 2024). https://doi.org/10.1109/ICEET65156.2024.10913930, https://ieeexplore.ieee.org/document/10913930/

74. Zacaron, A.M., Lent, D.M.B., Da Silva Ruffo, V.G., Carvalho, L.F., Proença, M.L.: Generative Adversarial Network Models for Anomaly Detection in Software-Defined Networks. Journal of Network and Systems Management 32(4), 93 (Oct 2024). https://doi.org/10.1007/s10922-024-09867-z, https://link.springer.com/10.1007/s10922-024-09867-z

75. Zang, J., Li, H.: Abnormal Traffic Detection Based on Data Augmentation and Hybrid Neural Network. In: 2024 2nd International Conference on Signal Processing and Intelligent Computing (SPIC). pp. 249–253. IEEE, Guangzhou, China (Sep 2024). https://doi.org/10.1109/SPIC62469.2024.10691452, https://ieeexplore.ieee.org/document/10691452/

76. Zeeshan, M., Maasooma: Trans-GAN: A Deep Learning Paradigm for Multi-Type Anomaly Detection in Network Traffic. In: 2024 International Conference on Frontiers of Information Technology (FIT). pp. 1–6. IEEE, Islamabad, Pakistan (Dec 2024). https://doi.org/10.1109/FIT63703.2024.10838443, https://ieeexplore.ieee.org/document/10838443/

77. Zhang, S., Li, T., Jin, D., Li, Y.: NetDiff: A Service-Guided Hierarchical Diffusion Model for Network Flow Trace Generation. Proceedings of the ACM on Networking 2 (CoNEXT3), 1–21 (Aug 2024). https://doi.org/10.1145/3676870, https://dl.acm.org/doi/10.1145/3676870

78. Zhao, X., Fok, K.W., Thing, V.L.: Enhancing network intrusion detection performance using generative adversarial networks. Computers & Security 145, 104005 (Oct 2024). https://doi.org/10.1016/j.cose.2024.104005, https://linkinghub.elsevier.com/retrieve/pii/S0167404824003109

79. Zingo, P., Novocin, A.: Can GAN-Generated Network Traffic be used to Train Traffic Anomaly Classifiers? In: 2020 11th IEEE Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON). pp. 0540–0545. IEEE, Vancouver, BC, Canada (Nov 2020). https://doi.org/10.1109/IEMCON51383.2020.9284901, https://ieeexplore.ieee.org/document/9284901/

80. Zingo, P., Novocin, A.: Introducing the tstr metric to improve network traffic gans. In: Advances in Information and Communication: Proceedings of the 2021 Future of Information and Communication Conference (FICC), Volume 1. pp. 643–650. Springer (2021)

Appendix

This appendix includes the subset of corpus associated to several research questions.
**RQ1** The articles published in networking-adjacent venues are: [1, 9, 11, 13, 15, 22, 23, 25, 29, 5, 21, 33, 38, 40, 43, 46-50, 53, 61, 68, 69, 71, 36, 72, 75, 7, 3, 79, 74, 16, 76, 65, 60, 77]. The articles published in cybersecurity-adjacent venues are: [35, 37, 54-56, 62, 66, 67, 70, 78]. The articles published in AI-adjacent venues are: [18, 20, 24, 51]. The articles published in other venues are: [14, 27, 34, 39, 44, 52, 58, 73, 4, 17, 30, 59, 8, 19, 12, 42, 28].

**RQ2** The articles performing data augmentation: [22, 67, 13, 39, 51, 50, 18, 75, 35, 9, 43, 46, 34, 68, 66, 37, 3, 79, 4, 17, 30, 59, 8, 78, 19, 12, 76, 74, 20, 58]. The articles performing dataset generation: [14, 11, 69, 25, 55, 15, 61, 36, 5, 27, 72, 62, 38, 49, 53, 42, 1, 65, 77, 60, 16, 7, 28, 33, 71, 21, 73, 48, 47, 70, 56, 54, 52, 23, 29, 24, 40, 44].

**RQ3** The articles generating flow statistics: [14, 70, 67, 5, 13, 54, 52, 39, 50, 72, 69, 29, 75, 55, 15, 35, 21, 43, 73, 24, 33, 46, 34, 20, 66, 53, 40, 3, 79, 4, 17, 30, 8, 78, 19, 12, 42, 76, 77, 68, 74]. The articles generating packet metadata: [22, 58, 28, 47, 23, 27, 72, 18, 71, 62, 11, 9, 33, 61, 48, 38, 37, 40, 7, 59, 16, 60, 65, 1, 56]. The articles generating packet payload: [51, 22, 23, 27, 18, 71, 62, 11, 9, 33, 48, 38, 36, 7, 16, 65].

**RQ4** The articles using GAN: [14, 58, 56, 67, 28, 5, 13, 54, 52, 51, 50, 72, 18, 11, 69, 25, 29, 75, 55, 35, 21, 9, 33, 48, 46, 38, 49, 68, 66, 37, 53, 7, 30, 78, 19, 12, 76, 74, 44]. The articles using CGAN: [58, 5, 13, 50, 21, 49, 66, 67, 3, 30, 65]. The articles using CT-GAN: [14, 54, 72, 75, 55, 53, 4, 17, 30, 78]. The articles using WGAN: [56, 13, 72, 25, 55, 7, 79, 30, 8, 78, 42, 74, 61]. Some articles experiment with several variants of GAN.

**RQ5** The articles using TSTR: [14, 22, 58, 70, 56, 67, 1, 47, 13, 54, 39, 51, 50, 23, 72, 18, 25, 75, 15, 35, 9, 43, 73, 24, 61, 46, 44, 20, 68, 66, 37, 53, 3, 79, 4, 17, 30, 59, 8, 78, 19, 12, 42, 76, 60, 65, 74, 44]. The articles using qualitative visual evaluation: [58, 47, 50, 18, 69, 21, 73, 24, 38, 44, 49, 40, 3, 17, 59, 8].

**RQ6** Our findings are summarized in Table 2.
<table><caption>**Table 2.** Number of articles per types of generated data and applications. To access the repository, prefix them with https://github.com/. Replication is to the best of our knowledge at time of writing.</caption><thead><tr><td>Method</td><td>Year</td><td>GitHub Repository</td><td>Replicated?</td></tr></thead><tbody><tr><td>SIP-GAN [38]</td><td>2021</td><td>amarmeddahi/sip-gan</td><td>No</td></tr><tr><td>STAN [70]</td><td>2021</td><td>ShengzheXu/stan</td><td>Yes (e.g., [1])</td></tr><tr><td>NetShare [72]</td><td>2022</td><td>netsharecmu/NetShare</td><td>Yes (e.g., [55])</td></tr><tr><td>NeCSTGen [40]</td><td>2022</td><td>fmeslet/NeCSTGen</td><td>Yes (e.g., [62])</td></tr><tr><td>SyNIG [61]</td><td>2023</td><td>Nirhoshan/SyNIG</td><td>No</td></tr><tr><td>PAC-GPT [27]</td><td>2023</td><td>dark-0ne/NetworkPacketGenerator</td><td>No</td></tr><tr><td>NetDiffusion[22]</td><td>2024</td><td>noise-lab/NetDiffusion_Generator</td><td>No</td></tr><tr><td>FlowChronicle [15]</td><td>2024</td><td>joschac/FlowChronicleCoNEXT</td><td>No</td></tr><tr><td>CGAN-based-Tool [5]</td><td>2024</td><td>Alanoud-Subahi/CGAN-based-Tool</td><td>No</td></tr><tr><td>NetDiffus [60]</td><td>2024</td><td>Nirhoshan/NetDiffus</td><td>Yes (e.g., [77])</td></tr><tr><td>GAN-based [78]</td><td>2024</td><td>ydataai/ydata-synthetic</td><td>Yes (e.g., [2])</td></tr><tr><td>PNetGPT [36]</td><td>2025</td><td>Snail1502/PNetGPT</td><td>No</td></tr><tr><td>GAN-based [19]</td><td>2025</td><td>i-am-junayed/XAI-Intrusion-Detection-System</td><td>No</td></tr><tr><td>GPT on the wire [16]</td><td>2025</td><td>javieradelgado/GPT-on-the-wire</td><td>No</td></tr></tbody></table>