# A Multimodal Framework for Advanced Cybersecurity Threat Detection Using GAN-Driven Data Synthesis
## 3 Proposed Methodology
### Ensemble Learning for Tabular Threat Detection  
The tabular data processing branch adopts a soft voting ensemble classifier composed of five distinct base learners: K-Nearest Neighbors (KNN), Support Vector Classifier (SVC), RF, DT, and Stochastic Gradient Descent (SGD). Each of these base classifiers is selected for  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter** & **Value** \\ \hline Input Resolution & 64 \(\times\) 64 pixels \\ Base Model & ResNet50 (ImageNet pretrained) \\ Frozen Layers & All convolutional base layers \\ Fine-tuned Layers & Fully connected classifier head \\ Loss Function & Binary Cross-Entropy \\ Optimizer & Adam (with weight decay) \\ Augmentation & Flip, Rotation, Scaling \\ Training Epochs & 25–30 (with early stopping) \\ \hline \hline \end{tabular}
\end{table}
Table 5: ResNet50 Transfer Learning Configuration.  
its unique inductive bias and learning characteristics, enhancing the ensemble's robustness and generalization capabilities when applied to heterogeneous network intrusion datasets.  
These classifiers are trained on a composite dataset that includes both real-world network traffic records and synthetic samples generated by the ZDGAN model, as previously discussed in Section 3.2. To manage class imbalance commonly present in intrusion detection datasets, two complementary strategies are applied: (1) oversampling of minority attack classes (using SMOTE or GAN-augmented sampling) and/or (2) undersampling of dominant benign records. This ensures that each model within the ensemble learns from a balanced distribution and is less susceptible to bias.  
Training and hyperparameter tuning are performed independently for each base classifier, using stratified cross-validation on a training-validation split. Key hyperparameters, including the number of neighbors in KNN, kernel type for SVC, depth and number of trees in RF and DT, and learning rate (lr) in SGD, are optimized through a grid search. The ensemble then aggregates predictions from all base models using a soft voting mechanism, which averages the predicted class probabilities and selects the class with the highest mean probability as the final output.  
This ensemble approach offers enhanced resilience to overfitting phenomena, improved detection of low-frequency threats, and greater adaptability results across different network environments and data modalities. Its integration with the synthetic data generation process ensures that the system remains capable of detecting rare or evolving attack patterns that would otherwise be underrepresented in real-world datasets or scenarios. These models are trained on a combination of real and synthetic tabular records. Experiments include variations of the training dataset, such as undersampled and oversampled versions, to address class imbalance. As a result, this ensemble method improves detection robustness and reduces overfitting to any single classifier.  
Before concluding this section, Table 6 summarizes the key training configurations of the base learners that comprise the soft-voting ensemble classifier.