## 1 Introduction  
Because of the rapid development of wireless technology and semiconductor manufacturing, the application of the Internet of Things (IoT) and mobile networks is becoming increasingly widespread. The application of the IoT is not only limited to computer and communication applications, but has been extended to e-commerce, industrial manufacturing, and other services. Because of the widespread application of the IoT and mobile networks to all walks of life, cyber-attacks are becoming increasingly frequent, and the harm to the government and enterprises is now more severe than ever. Therefore, cyber security is becoming an important issue that cannot be ignored.  
Network intrusion detection systems (NIDS) are defense systems for cyber security. Traditional NIDSs can be divided into two categories: signature-based and anomaly-based. The detection principle of the signature-based NIDS is to compare the traffic data to be detected with the attack signature database in the system. Therefore, the attack signature database needs to be maintained and updated regularly so that the system can support effective detection. The anomaly-based NIDS system mainly uses statistical analysis to detect and identify anomalous traffic data such as an attack. Irrespective of the method adopted, both detection approaches can no longer adapt to ever-changing cyber-attacks. The use of artificial intelligence to improve NIDSs has been a significant trend in recent years. However, many of the NIDS datasets currently used by scholars suffer from severe data imbalances. It is challenging to identify these types of sparse attack data using traditional machine learning and deep learning algorithms. While certain types of attacks are rare, we believe that by improving the accuracy of identifying these attacks with sparse data, we can prevent more severe attacks in the future. This study mainly used the WGAN-GP generation model to augment the sparse data in the NSL-KDD dataset to improve the identification accuracy of sparse attacks in network intrusion detection. To evaluate the effectiveness of WGAN-GP data enhancement for attacks with sparse data, this study focused on the performance analysis of three data enhancement methods to increase the percentage distribution of sparse attack classes through data augmentation, thereby improving the recognition accuracy of sparse data classes. We then analyzed the sparse class recognition accuracy to find the best data generation model. Based on this generation model, a two-stage fine-tuning algorithm was further designed to fine-tune the parameters of the best data-enhanced model and classification algorithms, thereby optimizing the recognition accuracy of the sparse attack data.  
This paper is structured as follows. Section 1 presents the background and motivation of the research. Section 2 introduces related research in the field of AI-based network intrusion detection, research on data imbalance problems, and research on GAN-based data enhancement. Section 3 concerns data enhancement methods, including Gaussian noise, WGAN-GP, and the synthetic minority oversampling technique (SMOTE). Section 4 is the data enhancement experimental methodology, mainly introducing the two-stage fine-tuning algorithm, the data enhancement for rare data in the NSL-KDD dataset, and the classification algorithms for the enhanced NSL-KDD. Section 5 discusses the experimental results, including the first-stage results for the three rare data enhancement methods and the improved results of the second-stage fine-tuning experiments. Section 6 is the conclusion.