DSTF-Diffusion: Packet-Level DDoS Augmentation

• The paper’s main contribution is demonstrating that dual-stream modeling of packet semantics and temporal dynamics significantly improves the realism of synthetic DDoS traces.
• It employs a field stream that remaps packet features into image-like representations via Stable Diffusion, alongside a temporal stream that disassembles and regenerates irregular attack timelines.
• Empirical results reveal marked gains, including up to a 7x improvement in data efficiency and enhanced statistical fidelity for downstream machine-learning detection.

Dual-Stream Temporal-Field Diffusion (DSTF-Diffusion) is a packet-level DDoS data augmentation framework that models synthetic trace generation as a coupled problem over packet-field semantics and attack-time dynamics. It is introduced as a multi-view, multi-stream network traffic generative model based on diffusion models, with a field stream that transfers network packet semantics into the visual domain of Stable Diffusion and a temporal stream that decomposes and regenerates irregular attack time series. The stated objective is to generate packet-level traces that more closely resemble real DDoS traffic and that improve downstream machine-learning-based detection under data-scarce and class-imbalanced conditions (Xi et al., 27 Jul 2025).

1. Problem setting and conceptual scope

DSTF-Diffusion is motivated by a specific limitation of DDoS research workflows: effective ML-based detectors require large, diverse, labeled packet traces, but public datasets such as CAIDA-2007, DARPA, and CIC-DDoS-2019 are described as outdated, simulated, imbalanced, or otherwise inadequate for modern DDoS research, while real collected traces are constrained by privacy and legal restrictions. In that setting, synthetic data augmentation is attractive, but the paper argues that existing generators do not jointly capture two aspects that are especially salient in DDoS traffic: the “field aspect” of packet content and the “behavior aspect” of temporal evolution (Xi et al., 27 Jul 2025).

The field aspect includes source IP, destination port, protocol, TCP flags, subnet, and attack type. The behavior aspect includes pulse-wave bursts, overlapping attack phases, and carpet-bombing across CIDR blocks. DSTF-Diffusion is presented as a response to the claim that prior methods tend to model either packet fields or temporal structure, but not both. Its “multi-stream” organization refers to two distinct generative pathways that model complementary aspects of the same trace, while its “multi-view” organization refers to semantic conditioning through multiple attack views rather than a single monolithic label (Xi et al., 27 Jul 2025).

This factorization is central to the method’s identity. The overall system first splits real packet traces into field information and time-series information, processes them separately during generation, and finally recombines generated fields and generated timestamps into complete packet-level traces. A plausible implication is that DSTF-Diffusion treats trace realism as a compositional property rather than a property that can be recovered from a single undifferentiated latent representation.

2. Field stream: semantic remapping into the Stable Diffusion domain

The field stream adapts a pre-trained image diffusion model to packet-level traffic generation. The paper’s key premise is that Stable Diffusion is organized around RGB image semantics and is more sensitive to color structure than to arbitrary numeric symbols or network-specific tokens. To bridge this domain gap, DSTF-Diffusion first converts each packet into a 1088-dimensional nPrint vector over $\{-1,0,1\}$ and maps those values to color channels: blue for $0$, red for $1$, and green for $-1$. The result is an image-like representation compatible with a visual diffusion backbone (Xi et al., 27 Jul 2025).

The stream conditions generation on three attack views,

$$V = (\text{protocol}, \text{subnet}, \text{attack type}).$$

The mapping procedure begins by sorting a list of colors by RGB values:

$$\text{colors} = \text{sort}(\{(\text{Name}_i, RGB_i)\}).$$

For subnets, the mapping is defined by nearest color in RGB space:

$$\text{MP}(C_{\text{subnet}}^j) = \min_{(\text{Name}, RGB)} \left\{ \text{D}(RGB, C_{\text{subnet}}^j) \right\}.$$

For the other views, categories are assigned evenly spaced colors:

$$\text{MP}(C_{V_i}^j) = \text{colors}_{\left\lfloor j \cdot \frac{\text{len}(\text{colors})}{\text{len}(C_{V_i})} \right\rfloor}.$$

These mappings are inserted into prompt templates:

$$\text{pmt}_{C_{V_i}^j} = \text{pmt}_{G} + \text{pmt}_{V_i}\left(\text{MP}(C_{V_i}^j)\right),$$

and during generation selected categories can be combined as

$$\text{pmt}_{S} = \text{pmt}_{G} + \sum_{C_{V_i}^j \in S} \text{pmt}_{V_i}\left(\text{MP}(C_{V_i}^j)\right).$$

The training and generation protocol deliberately differ. Training uses single-view prompts, whereas generation uses multi-view prompts. The stated rationale is to avoid overfitting to unpredictable combinations during fine-tuning while still exploiting compositional generalization at inference. The field stream is fine-tuned with LoRA, and ControlNet is used during inference to bias generation toward protocol-consistent outputs (Xi et al., 27 Jul 2025).

Its diffusion formulation follows standard DDPM and latent-diffusion notation. The forward and reverse processes are written as

$0$0

$0$1

Under Stable Diffusion conditioning, the latent reverse process is

$0$2

The paper does not introduce a new closed-form field-stream loss beyond standard diffusion fine-tuning under LoRA, but emphasizes prompt conditioning and denoising toward network-specific semantics (Xi et al., 27 Jul 2025).

3. Temporal stream: disassembly, generation, and recombination of attack timelines

The temporal stream addresses the claim that raw time-series modeling can overfit and generate traffic too close to the original. DSTF-Diffusion therefore adopts a “disassembly-generation-recombination” strategy. It first decomposes attack timestamps into structured temporal components, then learns to generate and recombine patterns, and finally synthesizes new higher-level attack organizations (Xi et al., 27 Jul 2025).

The first stage is Integrated Feature Clustering (IF Clustering). Timestamps are organized into a set of time series,

$0$3

Each series is decomposed with STL:

$0$4

where $0$5 is trend or intensity, $0$6 is periodic pattern, and $0$7 is residual noise. The method defines intensity as $0$8 and mode as $0$9, computes a DTW distance matrix over intensities and a Fourier-based Euclidean distance matrix over modes, and combines them into a joint distance:

$1$0

The resulting sequences are clustered with k-means. Each sequence is also summarized by metadata $1$1, and the metadata are sorted by start time into a chain $1$2 (Xi et al., 27 Jul 2025).

The second stage is time-series generation. Each $1$3 is segmented into subsequences $1$4 of variable length $1$5. A greedy DTW-based pattern-mining procedure identifies recurring subsequences and represents each by a state triplet,

$1$6

where $1$7 is the pattern, $1$8 is the length, and $1$9 is the magnitude. The model then learns an evolution process

$-1$0

Generation uses a conditional diffusion model with reverse process

$-1$1

and training objective

$-1$2

This is explicitly described as denoising error minimization conditioned on reference patterns (Xi et al., 27 Jul 2025).

The third stage is time-series combination. After generating individual series, DSTF-Diffusion synthesizes a new metadata chain $-1$3. Three schemes are defined. Random Combination is

$-1$4

Markov-based Combination is

$-1$5

Imitative Combination is

$-1$6

The paper associates these with different operational goals: random for diversity and prevention, Markov for ongoing attacks, and imitative for reproducing a known attacker’s organization (Xi et al., 27 Jul 2025).

4. End-to-end synthesis, packet-level outputs, and experimental corpus

DSTF-Diffusion’s inputs and outputs are packet-level. In the field stream, inputs are packet fields extracted from real traces and converted into nPrint vectors and images. The emphasized packet-level features are source IP, destination port, protocol, TCP flags, subnet, and attack type, with protocol categories including TCP, UDP, and ICMP. In the temporal stream, inputs are attack timestamps, sequence durations, and attack behavior clusters. Outputs are synthetic packet-level traces: the field stream produces image-like packet-field representations that are inverse-mapped back to packet vectors, and the temporal stream produces synthetic timestamp sequences and metadata chains. Final recombination attaches generated timestamps to generated attack fields to yield complete packet traces suitable for downstream ML training and evaluation (Xi et al., 27 Jul 2025).

The experimental study uses two datasets. CIC-DDoS-2019 is described as a public, structurally simulated benchmark with seven attack types and relatively balanced classes. IMB-DDoS 2023 is described as a real-world dataset collected from 50 clients over two days, containing nearly 700,000 packets sampled at an 8:1 ratio and ten attack types with imbalanced distribution, including carpetnet and pulse-wave. For fairness, the generation setup follows NetDiffusion: packets are converted into 1088-dimensional nPrint vectors over $-1$7, mapped to RGB colors, Stable Diffusion is fine-tuned with LoRA, and ControlNet is used during generation to enforce protocol consistency (Xi et al., 27 Jul 2025).

This workflow positions DSTF-Diffusion as a data augmentation method rather than a detector. A plausible implication is that its primary contribution lies in improving the training distribution available to downstream classifiers, rather than in replacing the classification stage itself.

5. Reported empirical behavior, ablations, and stated limitations

Evaluation proceeds along two axes: statistical similarity to real traffic and downstream utility for DDoS detection. Against Random generation, NetShare, and NetDiffusion, the paper reports JSD, TVD, Hellinger Distance, and Validity. On the global “All Generated Features” setting, DSTF-Diffusion reports, for TCP, JSD 0.043, TVD 0.111, HD 0.120, and Valid 0.965; for UDP, JSD 0.046, TVD 0.101, HD 0.115, and Valid 0.987; and for ICMP, JSD 0.027, TVD 0.072, HD 0.069, and Valid 1.000. The paper states that these values are best or near-best and that protocol-level realism improves especially on UDP and ICMP relative to NetDiffusion (Xi et al., 27 Jul 2025).

For downstream offline DDoS classification, the study uses Random Forest, Decision Tree, and SVM under data-hungry and data-imbalance settings. In the data-hungry setting, the training set is reduced to between 10% and 90% of the test set and then augmented back to test-set size. With only 10% of training data, DSTF-Diffusion enables an average accuracy of 85.65% at a hungry rate of 0.9, whereas NetDiffusion reaches 60.42% under the same conditions. The authors characterize this as requiring only 10% of the training data to achieve what NetDiffusion requires 70% training data for, i.e., a 7x improvement in data-hunger handling. In the imbalance setting, augmentation improves classification accuracy more than NetDiffusion, especially for SVM: in the 10% variance case from 89.62% to 93.64%, and in the 20% variance case from 90.97% to 93.71% (Xi et al., 27 Jul 2025).

The real-time detection study uses approximately 1.1 million benign and 160,000 malicious flows collected across months in 2022–2023, including RST flood, ACK flood, SYN/ACK flood, carpet-bombing, and pulse-wave. A three-layer CNN is trained for detection. Without combination, the model reports 77.05% ACC and 89.53% Top-1 ACC. With imitative combination these rise to 82.74% and 96.30%; with Markov-based combination to 82.96% and 96.84%; and with random combination to 84.61% and 97.26%. The paper also reports t-SNE evidence that average intra-class distance drops from 3.55 to 1.64 while inter-class distance increases from 8.02 to 9.34, and that for unseen attack types the feature-space distance between unseen attacks and benign traffic increases by +4.58, or 59.25% (Xi et al., 27 Jul 2025).

The ablations isolate the contribution of semantic mappings, view structure, and temporal combination. In the field-stream ablation, multi-view with numeric mapping and single-view with color mapping both improve over simpler encodings, while the full DSTF configuration yields the strongest statistical fidelity. On UDP, the full setup reports JSD 0.046, TVD 0.101, HD 0.115, and Valid 0.987 for all features. A mapping ablation further states that random nouns or random colors are much better than arbitrary numeric coding, supporting the hypothesis that Stable Diffusion benefits from semantically interpretable conditioning. For the temporal stream, all three combination modes are reported to add value, with random composition giving the broadest diversity and best average detection performance (Xi et al., 27 Jul 2025).

The limitations are explicitly stated. DSTF-Diffusion inherits Stable Diffusion’s fixed input size, constraining synthesis to 1,024-packet windows and potentially weakening continuity across longer segments. It relies on implicit modeling of inter-field dependencies, so relations such as source-address correlation are not explicitly modeled. Benchmark coverage is limited to CIC-DDoS-2019 and IMB-DDoS-2023, leaving broader attack families such as encrypted payload attacks or zero-day variants unvalidated. Privacy and regulatory restrictions continue to limit access to large-scale real traces, so the framework still depends on scarce but representative seed data (Xi et al., 27 Jul 2025).

6. Position within dual-stream diffusion research

Within the provided literature, DSTF-Diffusion is the paper that uses the exact name “Dual-Stream Temporal-Field Diffusion” and applies it to packet-level DDoS augmentation (Xi et al., 27 Jul 2025). Related dual-stream diffusion ideas appear in other domains, but under different names and with different objects of generation.

“Uni-Renderer: Unifying Rendering and Inverse Rendering Via Dual Stream Diffusion” jointly models rendering and inverse rendering through two parallel diffusion streams, two distinct timestep schedules, cross-conditioned feature exchange between pre-trained diffusion branches, and a cycle-consistency constraint linking intrinsic PBR attributes and RGB images (Chen et al., 2024). “Dual-Stream Diffusion for World-Model Augmented Vision-Language-Action Model” introduces DUST, a dual-stream multimodal diffusion transformer in which action sequences and future observation embeddings retain separate streams, undergo independent noise perturbations, and are trained with a decoupled flow-matching loss, with asynchronous test-time sampling across modalities (Won et al., 31 Oct 2025).

These works are not instances of DSTF-Diffusion in the narrow sense. However, they show a recurring pattern: dual-stream diffusion architectures are used when a single generation problem decomposes into strongly heterogeneous but coupled modalities. This suggests that DSTF-Diffusion belongs to a broader family of methods that preserve domain-specific inductive structure while allowing cross-domain coordination, even though its field–temporal factorization, multi-view prompting, and packet-level recombination are specific to DDoS traffic synthesis (Chen et al., 2024, Won et al., 31 Oct 2025).