# A Multimodal Framework for Advanced Cybersecurity Threat Detection Using GAN-Driven Data Synthesis
## 4 Experimental Analysis and Results
### Performance of Individual Branches  
The performance of the two modality-specific detection branches of the proposed framework, the CNN-based image classifier for malware detection and the ensemble learning model for network intrusion analysis using tabular data, is evaluated in this section of the current study. Each branch is assessed independently to measure its detection capacity when it can also operate autonomously, prior to the fusion processes. The CNN-based branch leverages a pre-trained VGG16 architecture, fine-tuned on malware image data synthesized and augmented using a DCGAN. A balanced dataset of 50,000 real and 50,000 synthetic grayscale malware samples was used to train and test the model. The tabular branch integrates three classifiers--Random Forest, XGBoost, and SVM--into a soft voting ensemble. It was trained and tested on a combination of NSL-KDD and CTU-13 datasets, augmented by synthetic samples from ZDGAN. The test set also included 50,000 real and 50,000 synthetic intrusion records. Table 14 presents a comprehensive summary of the evaluation metrics for the two detection branches of the proposed framework. The image-based CNN classifier achieved an accuracy of 97.2% and an F1-score of 97.3% when trained on a balanced dataset of 100,000 grayscale malware images (50% real, 50% synthetic). Precision and recall remained closely aligned at 97.5% and 97.1% respectively, while the Area Under the ROC Curve (AUC) was exceptionally high at 99.1%, indicating the model's strong discriminative ability even under varied data sample complexities. On the other hand, the tabular-based classifier also showed reliable performance. Trained on a similarly sized dataset of 100,000 intrusion records (comprising real and ZDGAN-synthesized samples from NSL-KDD and CTU-13), it reached 94.5% accuracy and an F1-score of 94.6%. Its precision and recall were also high, 95.2% and 94.1%, respectively, with a robust AUC of 98.2%, which reflects consistent performance across various intrusion types, including zero-day and botnet attacks. Together, these results establish the individual and combined efficiency of both detection branches before fusion integration. Figures 8 and 9 provide a visual comparison of the classification performance metrics between the image and tabular branches. Figure 8 illustrates a radar chart capturing five key metrics, as presented in Table 14, for both branches, allowing for an intuitive side-by-side performance overview. The chart reveals a consistently higher metric profile for the image-based CNN branch, particularly in precision and AUC, while the tabular branch remains competitive, especially in recall. Figure 9 further reinforces this comparison through a grouped bar chart, highlighting metric-wise differences between the two branches. The visual separation between bars clearly highlights the quantitative margins, with the CNN-based model achieving slightly higher performance in most categories. These visualizations emphasize the complementary strengths of each modality and justify their joint use in a unified fusion architecture as described in Section 3. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Metric** & **Image Branch (CNN)** & **Tabular Branch (Ensemble)** \\ \hline Accuracy & 0.972 & 0.945 \\ F1-Score & 0.973 & 0.946 \\ Precision & 0.975 & 0.952 \\ Recall & 0.971 & 0.941 \\ AUC (ROC) & 0.991 & 0.982 \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Summary of Evaluation Metrics for the Image and Tabular Branch. To further validate the performance of the tabular branch of our proposed framework, we compare it against a set of recent and representative GAN-based models designed for intrusion detection and botnet traffic analysis. Table 15 presents a comparative analysis of the Zero-Day GAN (ZDGAN) module against three representative state-of-the-art GAN-based approaches for tabular intrusion detection: FLGAN [28], WCGAN + XGBoost [29], and TransGAN-IDS [22].