# A Multimodal Framework for Advanced Cybersecurity Threat Detection Using GAN-Driven Data Synthesis
## 4 Experimental Analysis and Results
### Evaluation of GAN Models for Data Synthesis  
#### 4.3.1 Evaluation of ZDGAN for Zero-Day Data Synthesis  
The ZDGAN, introduced in the previous chapter, has been adopted to generate synthetic zero-day attack records for tabular network intrusion data. The main goal of this model, in the context of this integrated system, is to enhance the generalization capacity of the tabular-processing branch by introducing simulated examples of novel or rare cyberattacks. Rather than retraining or modifying the ZDGAN architecture, this evaluation focuses on quantifying the quality and diversity of the generated data, ensuring that the augmentation process contributes to improved threat detection coverage in a meaningful way. To evaluate the output of ZDGAN, a set of synthetic tabular samples was generated, using the pre-trained generator, which was then compared against real data records from NSL-KDD and CTU-13. A total of 10,000 synthetic and 10,000 real samples were used for comparison purposes. Hence, their similarity underwent further evaluation using five key metrics: mean cosine similarity, log-mean deviation, Jensen-Shannon divergence, diversity index, and dimensionality reduction-based cluster visualization. Cosine similarity measures directional alignment across feature vectors, while log-mean deviation quantifies statistical distance between distributions of real and synthetic records. To visualize \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **Accuracy** & **F1-Score** & **Inference Time (ms)** \\ \hline Decision Tree & 1.00 & 1.00 & 6.04 \\ Logistic Regression & 1.00 & 1.00 & 94.45 \\ Random Forest & 1.00 & 1.00 & 147.96 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Accuracy, F1-Score and Inference Time metrics per input-type classifier. Figure 2: Inference Time per ML Classifier. how well synthetic records cluster with their real counterparts, the method of Principal Component Analysis (PCA) was selected and applied to project both datasets into a 2D embedding space. Table 11 reports a detailed summary of metrics extracted using and evaluating the ZDGAN model. These metrics offer strong evidence of the synthetic data's structure and statistical distribution and its capacity to serve as a meaningful augmentation to real-world intrusion datasets. The average cosine similarity was calculated at 81.9%, indicating a strong feature-level alignment. The average log-mean deviation across all features was found to be 82%, confirming that the synthetic records remain close to the real data distributions without exhibiting mode collapse or over-smoothing results. Beyond these core metrics, Jensen-Shannon divergence was estimated at 10.4%, reflecting a modest divergence in probability distributions that is still within acceptable limits for high-quality data synthesis. Additionally, a synthetic sample diversity index of 77% suggests the generator introduces meaningful variation among samples, preventing overfitting in downstream classifiers. Finally, the t-SNE cluster metric achieved a result of 87%, confirming that synthetic records were inserted well within the high-dimensional space of their real counterparts. Together, these metrics extracted highlight that the ZDGAN-generated samples are not only statistically like real data, but also diverse and semantically meaningful in terms of quality, an aspect essential for improving generalization in zero-day attack detection tasks. To mitigate potential overfitting and bias introduced by the synthetic data, several validation mechanisms were adopted. First, a feature-wise log-mean deviation and cosine similarity mechanisms were used to verify that the synthetic samples closely approximate the statistical structure and properties of real-world data without collapsing into redundant or unrealistic outputs. Secondly, PCA visualizations were used to confirm that synthetic and real samples are grouped in similar ways based on their features.