# A Multimodal Framework for Advanced Cybersecurity Threat Detection Using GAN-Driven Data Synthesis
## 3 Proposed Methodology
### Synthetic Data Generation  
#### 3.2.1 ZDGAN for Zero-Day Tabular Data Synthesis  
Data scarcity remains a critical challenge for both labeled and unlabeled cybersecurity datasets. To address this issue, particularly in the context of labeled zero-day attack data in structured network intrusion logs, we have adopted the Zero-Day Generative Adversarial Network (ZDGAN), an enhanced GAN variant introduced and developed within our prior work [11]. Tables 1 and 2 present the features derived from open-source cybersecurity datasets (e.g, NSL-KDD, CTU-13) and have been validated in prior GAN-based data generation studies [11; 39]. These features have been preprocessed and have been used as input for training the different GAN architectures, as presented within the next Sections of the current study. ZDGAN has been especially designed to simulate rare or previously unseen attack patterns by learning complex feature relationships from open-source datasets such as NSL-KDD and CTU-13. To this end, we utilize the CTU-13 dataset, a widely used benchmark in cybersecurity research, which includes network traffic captures of both benign and botnet-infected traffic. The original dataset comprises over 32 million packets collected during controlled malware-injection scenarios and includes diverse network protocol types (e.g., TCP, UDP, ICMP). From this, we extract a training subset of 216,352 labeled flows, consisting of 140,849 botnet (malicious) and 75,503 legitimate samples. Additionally, an unlabeled evaluation subset of 88,258 flows has been used. The dataset includes 57 initial features (such as IP addresses, port numbers, timestamps, traffic volume indicators), which were reduced through preprocessing and feature selection techniques, as highlighted within our previous study [39]. Specifically, we applied univariate feature selection using the SelectKBest method with a chi-squared scoring function, in combination with feature importance scoring using an Extra Trees Classifier. This resulted in a final optimized dataset of 8 independent variables. The selected features include a mix of categorical (e.g., protocol state), numerical (e.g., packet counts, byte volume), and port-related attributes. Categorical fields were transformed via label encoding, while all numeric attributes were normalized to ensure compatibility with downstream neural network models. This structured preprocessing ensures that the dataset is not only clean and balanced but also optimized for deep learning-based data synthesis and classification tasks. The selected dataset was used during the training and evaluation of ZDGAN, though the model has been designed to receive additional data sources as input in future extensions. The model architecture consists of fully connected layers in both the generator and discriminator, trained adversarially to synthesize tabular data that properly preserves the structural and statistical properties of real-world network traffic and events. The model's primary objective focuses mainly on preserving class-conditional feature distributions while also generating realistic variations that accurately reflect emerging attack behaviors. The synthetic records generated by ZDGAN serve as the augmentation layer for the training of the ensemble classifier, which will be detailed in Section 3.4. This integration enables the tabular processing branch to detect not only known threats but also to generalize to approximations of zero-day behaviors. To assess the quality and fidelity of the generated samples, we apply validation techniques, such as log-mean deviation analysis, feature-wise cosine similarity, and visual inspection of class-wise t-SNE plots. These techniques also confirm both the diversity and realism of the synthetic dataset. Table 1 summarizes the structure and data feature types of the ZDGAN-generated dataset used in this study.