# A Multimodal Framework for Advanced Cybersecurity Threat Detection Using GAN-Driven Data Synthesis
## 3 Proposed Methodology
### Synthetic Data Generation
#### 3.2.2 ZDGAN for Tabular Botnets Data Synthesis  
To further enrich the training set of the tabular threat detection branch, we incorporate synthetic botnet intrusion data generated from subsets of the CTU-13 dataset. These samples represent a variety of botnet behaviors, including Neris, Rbot, and Virut traffic patterns. For the generation process, we adopt the same ZDGAN architecture as described in Section 3.2.2, due to its proven ability to capture rare patterns across sparse and imbalanced features. This approach ensures architectural consistency while enabling the synthesis of an expanded range of malicious behaviors. The generated botnet samples augment the existing dataset used by the ensemble classifier, improving its ability to generalize to diverse threat categories. To support the generation of synthetic botnet traffic, we utilized a labeled and preprocessed subset of the CTU-13 dataset, following the methodology introduced in our previous study [11]. From the original dataset of over 32 million flow records, we extracted 140,849 botnet samples and 75,503 benign ones for training the ZDGAN model. The dataset was preprocessed through a tailored pipeline designed for network flow data, including protocol filtering, removal of incomplete connections, normalization, and label encoding of categorical variables. The selected features emphasized flow-level attributes (e.g., connection duration, bytes exchanged, state transitions) that are known to be effective for botnet detection. This configuration ensured the synthesized data retained realistic behavioral and structural traits observed in previously unseen botnet families. A representative portion of these synthetic samples was later used to simulate botnet attacks in our classification experiments. Validation of these botnet-specific synthetic samples follows the same methodology as the zero-day variants, using feature distribution comparisons, deviation metrics, and clustering visualizations. The combined augmentation strategy strengthens the classifier's detection capabilities across a wider spectrum of real-world attack types without requiring additional data collection from live environments. It is important to highlight the different uses of ZDGAN in this framework and specifically between the two data sources engaged and the modeling objectives involved. Although both implementations rely on the same GAN (ZDGAN) architecture, the nature of the training data and the targets of the data samples generation differ significantly. In the case of zero-day attacks, ZDGAN is trained using NSL-KDD and generic CTU-13 entries to simulate infrequent or unknown threat vectors generally categorized as anomalies. In the opposite direction, the botnet data synthesis variant of ZDGAN is constrained to a subset of CTU-13 focused specifically on botnet activity, generating labeled records that reflect behavior from families like Neris, Rbot, and Virut. This results in varying feature schemas, label distributions, and operational roles despite relying on the equal architectural model. Table 3 summarizes these differences to clarify how ZDGAN contributes to diversified threat modeling within the tabular processing pipeline and during synthetic data generation on different data modalities. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Feature** & **Data Type** & **Value Range/Examples** & **Description** \\ \hline Flow Duration & Float & 0.0–1200 s & Total duration of the network flow \\ Src Packets & Integer & 1–4000 & Packets sent from the source IP \\ Dst Packets & Integer & 1–3500 & Packets received by the destination IP \\ Bytes Sent & Integer & 0–2,000,000 & Volume of outgoing traffic \\ Bytes Received & Integer & 0–1,500,000 & Volume of incoming traffic \\ Protocol & Categorical & TCP, UDP, ICMP & Protocol type used in the session \\ Botnet Family & Categorical & Neris, Rbot, Virut & Botnet label from CTU-13 annotations \\ Label & Binary & 0 = benign, 1 = botnet & Ground truth label \\ \hline \hline \end{tabular}
\end{table}